2 # Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
13 use OpenSSL
::Test
::Utils
;
14 use OpenSSL
::Test qw
/:DEFAULT srctop_file/;
20 require_ok
(srctop_file
('test', 'recipes', 'tconversion.pl'));
22 my @certs = qw(test certs);
24 # What type of key to generate?
26 if (disabled
("rsa")) {
27 @req_new = ("-newkey", "dsa:".srctop_file
("apps", "dsa512.pem"));
30 note
("There should be a 2 sequences of .'s and some +'s.");
31 note
("There should not be more that at most 80 per line");
34 # Prevent MSys2 filename munging for arguments that look like file paths but
36 $ENV{MSYS2_ARG_CONV_EXCL
} = "/CN=";
38 # Check for duplicate -addext parameters, and one "working" case.
39 my @addext_args = ( "openssl", "req", "-new", "-out", "testreq.pem",
40 "-key", srctop_file
(@certs, "ee-key.pem"),
41 "-config", srctop_file
("test", "test.cnf"), @req_new );
42 my $val = "subjectAltName=DNS:example.com";
43 my $val1 = "subjectAltName=otherName:1.2.3.4;UTF8:test,email:info\@example.com";
44 my $val2 = " " . $val;
47 ok
( run
(app
([@addext_args, "-addext", $val])));
48 ok
( run
(app
([@addext_args, "-addext", $val1])));
49 $val1 =~ s/UTF8/XXXX/; # execute the error handling in do_othername
50 ok
(!run
(app
([@addext_args, "-addext", $val1])));
51 ok
(!run
(app
([@addext_args, "-addext", $val, "-addext", $val])));
52 ok
(!run
(app
([@addext_args, "-addext", $val, "-addext", $val2])));
53 ok
(!run
(app
([@addext_args, "-addext", $val, "-addext", $val3])));
54 ok
(!run
(app
([@addext_args, "-addext", $val2, "-addext", $val3])));
55 ok
(run
(app
([@addext_args, "-addext", "SXNetID=1:one, 2:two, 3:three"])));
56 ok
(run
(app
([@addext_args, "-addext", "subjectAltName=dirName:dirname_sec"])));
58 # If a CSR is provided with neither of -key or -CA/-CAkey, this should fail.
59 ok
(!run
(app
(["openssl", "req", "-x509",
60 "-in", srctop_file
(@certs, "x509-check.csr"),
61 "-out", "testreq.pem"])));
63 subtest
"generating alt certificate requests with RSA" => sub {
67 skip
"RSA is not supported by this OpenSSL build", 2
70 ok
(run
(app
(["openssl", "req",
71 "-config", srctop_file
("test", "test.cnf"),
73 "-new", "-out", "testreq-rsa.pem", "-utf8",
74 "-key", srctop_file
("test", "testrsa.pem")])),
75 "Generating request");
77 ok
(run
(app
(["openssl", "req",
78 "-config", srctop_file
("test", "test.cnf"),
79 "-verify", "-in", "testreq-rsa.pem", "-noout"])),
80 "Verifying signature on request");
82 ok
(run
(app
(["openssl", "req",
83 "-config", srctop_file
("test", "test.cnf"),
85 "-verify", "-in", "testreq-rsa.pem", "-noout"])),
86 "Verifying signature on request");
91 subtest
"generating certificate requests with RSA" => sub {
95 skip
"RSA is not supported by this OpenSSL build", 2
98 ok
(!run
(app
(["openssl", "req",
99 "-config", srctop_file
("test", "test.cnf"),
100 "-new", "-out", "testreq-rsa.pem", "-utf8",
101 "-key", srctop_file
("test", "testrsa.pem"),
102 "-keyform", "DER"])),
103 "Checking that mismatching keyform fails");
105 ok
(run
(app
(["openssl", "req",
106 "-config", srctop_file
("test", "test.cnf"),
107 "-new", "-out", "testreq-rsa.pem", "-utf8",
108 "-key", srctop_file
("test", "testrsa.pem"),
109 "-keyform", "PEM"])),
110 "Generating request");
112 ok
(run
(app
(["openssl", "req",
113 "-config", srctop_file
("test", "test.cnf"),
114 "-verify", "-in", "testreq-rsa.pem", "-noout"])),
115 "Verifying signature on request");
117 ok
(run
(app
(["openssl", "req",
118 "-config", srctop_file
("test", "test.cnf"),
119 "-modulus", "-in", "testreq-rsa.pem", "-noout"])),
120 "Printing a modulus of the request key");
122 ok
(run
(app
(["openssl", "req",
123 "-config", srctop_file
("test", "test.cnf"),
124 "-new", "-out", "testreq_withattrs_pem.pem", "-utf8",
125 "-key", srctop_file
("test", "testrsa_withattrs.pem")])),
126 "Generating request from a key with extra attributes - PEM");
128 ok
(run
(app
(["openssl", "req",
129 "-config", srctop_file
("test", "test.cnf"),
130 "-verify", "-in", "testreq_withattrs_pem.pem", "-noout"])),
131 "Verifying signature on request from a key with extra attributes - PEM");
133 ok
(run
(app
(["openssl", "req",
134 "-config", srctop_file
("test", "test.cnf"),
135 "-new", "-out", "testreq_withattrs_der.pem", "-utf8",
136 "-key", srctop_file
("test", "testrsa_withattrs.der"),
137 "-keyform", "DER"])),
138 "Generating request from a key with extra attributes - PEM");
140 ok
(run
(app
(["openssl", "req",
141 "-config", srctop_file
("test", "test.cnf"),
142 "-verify", "-in", "testreq_withattrs_der.pem", "-noout"])),
143 "Verifying signature on request from a key with extra attributes - PEM");
147 subtest
"generating certificate requests with RSA-PSS" => sub {
151 skip
"RSA is not supported by this OpenSSL build", 2
154 ok
(run
(app
(["openssl", "req",
155 "-config", srctop_file
("test", "test.cnf"),
156 "-new", "-out", "testreq-rsapss.pem", "-utf8",
157 "-key", srctop_file
("test", "testrsapss.pem")])),
158 "Generating request");
159 ok
(run
(app
(["openssl", "req",
160 "-config", srctop_file
("test", "test.cnf"),
161 "-verify", "-in", "testreq-rsapss.pem", "-noout"])),
162 "Verifying signature on request");
164 ok
(run
(app
(["openssl", "req",
165 "-config", srctop_file
("test", "test.cnf"),
166 "-new", "-out", "testreq-rsapss2.pem", "-utf8",
167 "-sigopt", "rsa_padding_mode:pss",
168 "-sigopt", "rsa_pss_saltlen:-1",
169 "-key", srctop_file
("test", "testrsapss.pem")])),
170 "Generating request");
171 ok
(run
(app
(["openssl", "req",
172 "-config", srctop_file
("test", "test.cnf"),
173 "-verify", "-in", "testreq-rsapss2.pem", "-noout"])),
174 "Verifying signature on request");
176 ok
(run
(app
(["openssl", "req",
177 "-config", srctop_file
("test", "test.cnf"),
178 "-new", "-out", "testreq-rsapssmand.pem", "-utf8",
179 "-sigopt", "rsa_padding_mode:pss",
180 "-key", srctop_file
("test", "testrsapssmandatory.pem")])),
181 "Generating request");
182 ok
(run
(app
(["openssl", "req",
183 "-config", srctop_file
("test", "test.cnf"),
184 "-verify", "-in", "testreq-rsapssmand.pem", "-noout"])),
185 "Verifying signature on request");
187 ok
(run
(app
(["openssl", "req",
188 "-config", srctop_file
("test", "test.cnf"),
189 "-new", "-out", "testreq-rsapssmand2.pem", "-utf8",
190 "-sigopt", "rsa_pss_saltlen:100",
191 "-key", srctop_file
("test", "testrsapssmandatory.pem")])),
192 "Generating request");
193 ok
(run
(app
(["openssl", "req",
194 "-config", srctop_file
("test", "test.cnf"),
195 "-verify", "-in", "testreq-rsapssmand2.pem", "-noout"])),
196 "Verifying signature on request");
198 ok
(!run
(app
(["openssl", "req",
199 "-config", srctop_file
("test", "test.cnf"),
200 "-new", "-out", "testreq-rsapss3.pem", "-utf8",
201 "-sigopt", "rsa_padding_mode:pkcs1",
202 "-key", srctop_file
("test", "testrsapss.pem")])),
203 "Generating request with expected failure");
205 ok
(!run
(app
(["openssl", "req",
206 "-config", srctop_file
("test", "test.cnf"),
207 "-new", "-out", "testreq-rsapss3.pem", "-utf8",
208 "-sigopt", "rsa_pss_saltlen:-5",
209 "-key", srctop_file
("test", "testrsapss.pem")])),
210 "Generating request with expected failure");
212 ok
(!run
(app
(["openssl", "req",
213 "-config", srctop_file
("test", "test.cnf"),
214 "-new", "-out", "testreq-rsapssmand3.pem", "-utf8",
215 "-sigopt", "rsa_pss_saltlen:10",
216 "-key", srctop_file
("test", "testrsapssmandatory.pem")])),
217 "Generating request with expected failure");
219 ok
(!run
(app
(["openssl", "req",
220 "-config", srctop_file
("test", "test.cnf"),
221 "-new", "-out", "testreq-rsapssmand3.pem", "-utf8",
223 "-key", srctop_file
("test", "testrsapssmandatory.pem")])),
224 "Generating request with expected failure");
228 subtest
"generating certificate requests with DSA" => sub {
232 skip
"DSA is not supported by this OpenSSL build", 2
235 ok
(run
(app
(["openssl", "req",
236 "-config", srctop_file
("test", "test.cnf"),
237 "-new", "-out", "testreq-dsa.pem", "-utf8",
238 "-key", srctop_file
("test", "testdsa.pem")])),
239 "Generating request");
241 ok
(run
(app
(["openssl", "req",
242 "-config", srctop_file
("test", "test.cnf"),
243 "-verify", "-in", "testreq-dsa.pem", "-noout"])),
244 "Verifying signature on request");
248 subtest
"generating certificate requests with ECDSA" => sub {
252 skip
"ECDSA is not supported by this OpenSSL build", 2
255 ok
(run
(app
(["openssl", "req",
256 "-config", srctop_file
("test", "test.cnf"),
257 "-new", "-out", "testreq-ec.pem", "-utf8",
258 "-key", srctop_file
("test", "testec-p256.pem")])),
259 "Generating request");
261 ok
(run
(app
(["openssl", "req",
262 "-config", srctop_file
("test", "test.cnf"),
263 "-verify", "-in", "testreq-ec.pem", "-noout"])),
264 "Verifying signature on request");
268 subtest
"generating certificate requests with Ed25519" => sub {
272 skip
"Ed25519 is not supported by this OpenSSL build", 2
275 ok
(run
(app
(["openssl", "req",
276 "-config", srctop_file
("test", "test.cnf"),
277 "-new", "-out", "testreq-ed25519.pem", "-utf8",
278 "-key", srctop_file
("test", "tested25519.pem")])),
279 "Generating request");
281 ok
(run
(app
(["openssl", "req",
282 "-config", srctop_file
("test", "test.cnf"),
283 "-verify", "-in", "testreq-ed25519.pem", "-noout"])),
284 "Verifying signature on request");
288 subtest
"generating certificate requests with Ed448" => sub {
292 skip
"Ed448 is not supported by this OpenSSL build", 2
295 ok
(run
(app
(["openssl", "req",
296 "-config", srctop_file
("test", "test.cnf"),
297 "-new", "-out", "testreq-ed448.pem", "-utf8",
298 "-key", srctop_file
("test", "tested448.pem")])),
299 "Generating request");
301 ok
(run
(app
(["openssl", "req",
302 "-config", srctop_file
("test", "test.cnf"),
303 "-verify", "-in", "testreq-ed448.pem", "-noout"])),
304 "Verifying signature on request");
308 subtest
"generating certificate requests" => sub {
311 ok
(run
(app
(["openssl", "req", "-config", srctop_file
("test", "test.cnf"),
312 "-key", srctop_file
(@certs, "ee-key.pem"),
313 @req_new, "-out", "testreq.pem"])),
314 "Generating request");
316 ok
(run
(app
(["openssl", "req", "-config", srctop_file
("test", "test.cnf"),
317 "-verify", "-in", "testreq.pem", "-noout"])),
318 "Verifying signature on request");
321 subtest
"generating SM2 certificate requests" => sub {
325 skip
"SM2 is not supported by this OpenSSL build", 4
327 ok
(run
(app
(["openssl", "req",
328 "-config", srctop_file
("test", "test.cnf"),
329 "-new", "-key", srctop_file
(@certs, "sm2.key"),
330 "-sigopt", "distid:1234567812345678",
331 "-out", "testreq-sm2.pem", "-sm3"])),
332 "Generating SM2 certificate request");
334 ok
(run
(app
(["openssl", "req",
335 "-config", srctop_file
("test", "test.cnf"),
336 "-verify", "-in", "testreq-sm2.pem", "-noout",
337 "-vfyopt", "distid:1234567812345678", "-sm3"])),
338 "Verifying signature on SM2 certificate request");
340 ok
(run
(app
(["openssl", "req",
341 "-config", srctop_file
("test", "test.cnf"),
342 "-new", "-key", srctop_file
(@certs, "sm2.key"),
343 "-sigopt", "hexdistid:DEADBEEF",
344 "-out", "testreq-sm2.pem", "-sm3"])),
345 "Generating SM2 certificate request with hex id");
347 ok
(run
(app
(["openssl", "req",
348 "-config", srctop_file
("test", "test.cnf"),
349 "-verify", "-in", "testreq-sm2.pem", "-noout",
350 "-vfyopt", "hexdistid:DEADBEEF", "-sm3"])),
351 "Verifying signature on SM2 certificate request");
355 my @openssl_args = ("req", "-config", srctop_file
("apps", "openssl.cnf"));
357 run_conversion
('req conversions',
359 run_conversion
('req conversions -- testreq2',
360 srctop_file
("test", "testreq2.pem"));
366 subtest
$title => sub {
367 run
(app
(["openssl", @openssl_args,
368 "-in", $reqfile, "-inform", "p",
370 stderr
=> "req-check.err", stdout
=> undef));
371 open DATA
, "req-check.err";
373 plan skip_all
=> "skipping req conversion test for $reqfile"
374 if grep /Unknown Public Key/, map { s/\R//; } <DATA
>;
376 tconversion
( -type
=> 'req', -in => $reqfile,
377 -args
=> [ @openssl_args ] );
380 unlink "req-check.err";
386 # Test both generation and verification of certs w.r.t. RFC 5280 requirements
388 my $ca_cert; # will be set below
391 my $ss = $cert =~ m/self-signed/;
392 my $is_ca = $cert =~ m/CA/;
393 my $cn = $is_ca ?
"CA" : "EE";
394 my $ca_key = srctop_file
(@certs, "ca-key.pem");
395 my $key = $is_ca ?
$ca_key : srctop_file
(@certs, "ee-key.pem");
396 my @cmd = ("openssl", "req", "-config", "", "-x509",
397 "-subj", "/CN=$cn", @_, "-out", $cert);
398 push(@cmd, ("-key", $key)) if $ss;
399 push(@cmd, ("-CA", $ca_cert, "-CAkey", $ca_key)) unless $ss;
400 ok
(run
(app
([@cmd])), "generate $cert");
405 my $expect = shift @_;
406 cert_contains
($cert, "Key Usage", $expect);
410 my $expect = shift @_;
411 my $trusted = shift @_;
412 $trusted = $cert unless $trusted;
413 ok
(run
(app
(["openssl", "verify", "-x509_strict", "-trusted", $trusted,
414 "-partial_chain", $cert])) == $expect,
415 "strict verify allow $cert");
418 my @v3_ca = ("-addext", "basicConstraints = critical,CA:true",
419 "-addext", "keyUsage = keyCertSign");
420 my $SKID_AKID = "subjectKeyIdentifier,authorityKeyIdentifier";
424 my $cert = "self-signed_default_SKID_no_explicit_exts.pem";
425 generate_cert
($cert);
426 has_version
($cert, 3);
427 has_SKID
($cert, 1); # SKID added, though no explicit extensions given
430 my $cert = "self-signed_v3_CA_hash_SKID.pem";
431 generate_cert
($cert, @v3_ca, "-addext", "subjectKeyIdentifier = hash");
432 has_SKID
($cert, 1); # explicit hash SKID
434 $cert = "self-signed_v3_CA_no_SKID.pem";
435 generate_cert
($cert, @v3_ca, "-addext", "subjectKeyIdentifier = none");
436 cert_ext_has_n_different_lines
($cert, 0, $SKID_AKID); # no SKID and no AKID
437 #TODO strict_verify($cert, 0);
439 $cert = "self-signed_v3_CA_given_SKID.pem";
440 generate_cert
($cert, @v3_ca, "-addext", "subjectKeyIdentifier = 45");
441 cert_contains
($cert, "Subject Key Identifier: 45 ", 1); # given SKID
442 strict_verify
($cert, 1);
444 # AKID of self-signed certs
446 $cert = "self-signed_v1_CA_no_KIDs.pem";
447 generate_cert
($cert, "-x509v1");
448 has_version
($cert, 1);
449 cert_ext_has_n_different_lines
($cert, 0, $SKID_AKID); # no SKID and no AKID
450 #TODO strict_verify($cert, 1); # self-signed v1 root cert should be accepted as CA
452 $ca_cert = "self-signed_v3_CA_default_SKID.pem"; # will also be used below
453 generate_cert
($ca_cert, @v3_ca);
454 has_SKID
($ca_cert, 1); # default SKID
455 has_AKID
($ca_cert, 0); # no default AKID
456 strict_verify
($ca_cert, 1);
458 $cert = "self-signed_v3_CA_no_AKID.pem";
459 generate_cert
($cert, @v3_ca, "-addext", "authorityKeyIdentifier = none");
460 has_AKID
($cert, 0); # forced no AKID
462 $cert = "self-signed_v3_CA_explicit_AKID.pem";
463 generate_cert
($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid");
464 has_AKID
($cert, 0); # for self-signed cert, AKID suppressed and not forced
466 $cert = "self-signed_v3_CA_forced_AKID.pem";
467 generate_cert
($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid:always");
468 cert_ext_has_n_different_lines
($cert, 3, $SKID_AKID); # forced AKID, AKID == SKID
469 strict_verify
($cert, 1);
471 $cert = "self-signed_v3_CA_issuer_AKID.pem";
472 generate_cert
($cert, @v3_ca, "-addext", "authorityKeyIdentifier = issuer");
473 has_AKID
($cert, 0); # suppressed AKID since not forced
475 $cert = "self-signed_v3_CA_forced_issuer_AKID.pem";
476 generate_cert
($cert, @v3_ca, "-addext", "authorityKeyIdentifier = issuer:always");
477 cert_contains
($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 1); # forced issuer AKID
479 $cert = "self-signed_v3_CA_nonforced_keyid_issuer_AKID.pem";
480 generate_cert
($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid, issuer");
481 has_AKID
($cert, 0); # AKID not present because not forced and cert self-signed
483 $cert = "self-signed_v3_CA_keyid_forced_issuer_AKID.pem";
484 generate_cert
($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid, issuer:always");
485 cert_contains
($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 1); # issuer AKID forced, with keyid not forced
487 $cert = "self-signed_v3_CA_forced_keyid_issuer_AKID.pem";
488 generate_cert
($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid:always, issuer");
489 has_AKID
($cert, 1); # AKID with keyid forced
490 cert_contains
($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 0); # no issuer AKID
492 $cert = "self-signed_v3_CA_forced_keyid_forced_issuer_AKID.pem";
493 generate_cert
($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid:always, issuer:always");
494 cert_contains
($cert, "Authority Key Identifier: keyid(:[0-9A-Fa-f]{2})+ DirName:/CN=CA serial:", 1); # AKID with keyid and issuer forced
496 $cert = "self-signed_v3_EE_wrong_keyUsage.pem";
497 generate_cert
($cert, "-addext", "keyUsage = keyCertSign");
498 #TODO strict_verify($cert, 1); # should be accepted because RFC 5280 does not apply
500 # AKID of self-issued but not self-signed certs
502 $cert = "self-issued_x509_v3_CA_default_KIDs.pem";
503 ok
(run
(app
([("openssl", "x509", "-copy_extensions", "copy",
504 "-req", "-in", srctop_file
(@certs, "ext-check.csr"),
505 "-key", srctop_file
(@certs, "ca-key.pem"),
506 "-force_pubkey", srctop_file
("test", "testrsapub.pem"),
507 "-out", $cert)])), "generate using x509: $cert");
508 cert_contains
($cert, "Issuer: CN=test .*? Subject: CN=test", 1);
509 cert_ext_has_n_different_lines
($cert, 4, $SKID_AKID); # SKID != AKID
510 strict_verify
($cert, 1);
512 $cert = "self-issued_v3_CA_default_KIDs.pem";
513 generate_cert
($cert, "-addext", "keyUsage = dataEncipherment",
514 "-in", srctop_file
(@certs, "x509-check.csr"));
515 cert_contains
($cert, "Issuer: CN=CA .*? Subject: CN=CA", 1);
516 cert_ext_has_n_different_lines
($cert, 4, $SKID_AKID); # SKID != AKID
517 strict_verify
($cert, 1);
519 $cert = "self-issued_v3_CA_no_AKID.pem";
520 generate_cert
($cert, "-addext", "authorityKeyIdentifier = none",
521 "-in", srctop_file
(@certs, "x509-check.csr"));
522 has_version
($cert, 3);
523 has_SKID
($cert, 1); # SKID added, though no explicit extensions given
525 strict_verify
($cert, 1);
527 $cert = "self-issued_v3_CA_explicit_AKID.pem";
528 generate_cert
($cert, "-addext", "authorityKeyIdentifier = keyid",
529 "-in", srctop_file
(@certs, "x509-check.csr"));
530 cert_ext_has_n_different_lines
($cert, 4, $SKID_AKID); # SKID != AKID
531 strict_verify
($cert, 1);
533 $cert = "self-issued_v3_CA_forced_AKID.pem";
534 generate_cert
($cert, "-addext", "authorityKeyIdentifier = keyid:always",
535 "-in", srctop_file
(@certs, "x509-check.csr"));
536 cert_ext_has_n_different_lines
($cert, 4, $SKID_AKID); # SKID != AKID
538 $cert = "self-issued_v3_CA_issuer_AKID.pem";
539 generate_cert
($cert, @v3_ca, "-addext", "authorityKeyIdentifier = issuer",
540 "-in", srctop_file
(@certs, "x509-check.csr"));
541 cert_contains
($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 1); # just issuer AKID
543 $cert = "self-issued_v3_CA_forced_issuer_AKID.pem";
544 generate_cert
($cert, @v3_ca, "-addext", "authorityKeyIdentifier = issuer:always",
545 "-in", srctop_file
(@certs, "x509-check.csr"));
546 cert_contains
($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 1); # just issuer AKID
548 $cert = "self-issued_v3_CA_keyid_issuer_AKID.pem";
549 generate_cert
($cert, "-addext", "authorityKeyIdentifier = keyid, issuer",
550 "-in", srctop_file
(@certs, "x509-check.csr"));
551 cert_ext_has_n_different_lines
($cert, 4, $SKID_AKID); # SKID != AKID, not forced
553 $cert = "self-issued_v3_CA_keyid_forced_issuer_AKID.pem";
554 generate_cert
($cert, "-addext", "authorityKeyIdentifier = keyid, issuer:always",
555 "-in", srctop_file
(@certs, "x509-check.csr"));
556 cert_ext_has_n_different_lines
($cert, 6, $SKID_AKID); # SKID != AKID, with forced issuer
558 $cert = "self-issued_v3_CA_forced_keyid_and_issuer_AKID.pem";
559 generate_cert
($cert, "-addext", "authorityKeyIdentifier = keyid:always, issuer:always",
560 "-in", srctop_file
(@certs, "x509-check.csr"));
561 cert_ext_has_n_different_lines
($cert, 6, $SKID_AKID); # SKID != AKID, both forced
563 # AKID of not self-issued certs
565 $cert = "regular_v3_EE_default_KIDs_no_other_exts.pem";
566 generate_cert
($cert, "-key", srctop_file
(@certs, "ee-key.pem"));
567 has_version
($cert, 3);
568 cert_ext_has_n_different_lines
($cert, 4, $SKID_AKID); # SKID != AKID
570 $cert = "regular_v3_EE_default_KIDs.pem";
571 generate_cert
($cert, "-addext", "keyUsage = dataEncipherment",
572 "-key", srctop_file
(@certs, "ee-key.pem"));
573 cert_ext_has_n_different_lines
($cert, 4, $SKID_AKID); # SKID != AKID
574 strict_verify
($cert, 1, $ca_cert);
576 $cert = "regular_v3_EE_copied_exts_default_KIDs.pem";
577 generate_cert
($cert, "-copy_extensions", "copy",
578 "-in", srctop_file
(@certs, "ext-check.csr"));
579 cert_ext_has_n_different_lines
($cert, 4, $SKID_AKID); # SKID != AKID
580 strict_verify
($cert, 1);
582 $cert = "v3_EE_no_AKID.pem";
583 generate_cert
($cert, "-addext", "authorityKeyIdentifier = none",
584 "-key", srctop_file
(@certs, "ee-key.pem"));
587 strict_verify
($cert, 0, $ca_cert);
592 $cert = "self-signed_CA_no_keyUsage.pem";
593 generate_cert
($cert, "-in", srctop_file
(@certs, "ext-check.csr"));
594 has_keyUsage
($cert, 0);
595 $cert = "self-signed_CA_with_keyUsages.pem";
596 generate_cert
($cert, "-in", srctop_file
(@certs, "ext-check.csr"),
597 "-copy_extensions", "copy");
598 has_keyUsage
($cert, 1);
600 # Generate cert using req with '-modulus'
601 ok
(run
(app
(["openssl", "req", "-x509", "-new", "-days", "365",
602 "-key", srctop_file
("test", "testrsa.pem"),
603 "-config", srctop_file
('test', 'test.cnf'),
604 "-out", "testreq-cert.pem",
605 "-modulus"])), "cert req creation - with -modulus");
608 ok
(run
(app
(["openssl", "x509", "-in", "testreq-cert.pem",
609 "-noout", "-text"])), "cert verification");
611 # Generate cert with explicit start and end dates
612 my %today = (strftime
("%Y-%m-%d", gmtime) => 1);
613 my $cert = "self-signed_explicit_date.pem";
614 ok
(run
(app
(["openssl", "req", "-x509", "-new", "-text",
615 "-config", srctop_file
('test', 'test.cnf'),
616 "-key", srctop_file
("test", "testrsa.pem"),
617 "-not_before", "today",
618 "-not_after", "today",
620 && ++$today{strftime
("%Y-%m-%d", gmtime)}
621 && (grep { defined $today{$_} } get_not_before_date
($cert))
622 && (grep { defined $today{$_} } get_not_after_date
($cert)), "explicit start and end dates");