]>
git.ipfire.org Git - thirdparty/openssl.git/blob - test/recipes/80-test_ocsp.t
2 # Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
14 use File
::Spec
::Functions qw
/devnull catfile/;
17 use OpenSSL
::Test qw
/:DEFAULT with pipe srctop_dir data_file/;
18 use OpenSSL
::Test
::Utils
;
22 plan skip_all
=> "OCSP is not supported by this OpenSSL build"
25 my $ocspdir=srctop_dir
("test", "ocsp-tests");
26 # 17 December 2012 so we don't get certificate expiry errors.
27 my @check_time=("-attime", "1355875200");
31 my $inputfile = shift;
33 my $untrusted = shift;
34 if ($untrusted eq "") {
37 my $expected_exit = shift;
39 my $outputfile = basename
($inputfile, '.ors') . '.dat';
41 run
(app
(["openssl", "base64", "-d",
42 "-in", catfile
($ocspdir,$inputfile),
43 "-out", $outputfile]));
44 with
({ exit_checker
=> sub { return shift == $expected_exit; } },
45 sub { ok
(run
(app
(["openssl", "ocsp", "-respin", $outputfile,
46 "-partial_chain", @check_time,
47 "-CAfile", catfile
($ocspdir, $CAfile),
48 "-verify_other", catfile
($ocspdir, $untrusted),
49 "-no-CApath", "-no-CAstore",
50 $nochecks ?
"-no_cert_checks" : ()])),
56 subtest
"=== VALID OCSP RESPONSES ===" => sub {
59 test_ocsp
("NON-DELEGATED; Intermediate CA -> EE",
60 "ND1.ors", "ND1_Issuer_ICA.pem", "", 0, 0);
61 test_ocsp
("NON-DELEGATED; Root CA -> Intermediate CA",
62 "ND2.ors", "ND2_Issuer_Root.pem", "", 0, 0);
63 test_ocsp
("NON-DELEGATED; Root CA -> EE",
64 "ND3.ors", "ND3_Issuer_Root.pem", "", 0, 0);
65 test_ocsp
("NON-DELEGATED; 3-level CA hierarchy",
66 "ND1.ors", "ND1_Cross_Root.pem", "ND1_Issuer_ICA-Cross.pem", 0, 0);
67 test_ocsp
("DELEGATED; Intermediate CA -> EE",
68 "D1.ors", "D1_Issuer_ICA.pem", "", 0, 0);
69 test_ocsp
("DELEGATED; Root CA -> Intermediate CA",
70 "D2.ors", "D2_Issuer_Root.pem", "", 0, 0);
71 test_ocsp
("DELEGATED; Root CA -> EE",
72 "D3.ors", "D3_Issuer_Root.pem", "", 0, 0);
75 subtest
"=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
78 test_ocsp
("NON-DELEGATED; Intermediate CA -> EE",
79 "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
80 test_ocsp
("NON-DELEGATED; Root CA -> Intermediate CA",
81 "ISOP_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
82 test_ocsp
("NON-DELEGATED; Root CA -> EE",
83 "ISOP_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
84 test_ocsp
("DELEGATED; Intermediate CA -> EE",
85 "ISOP_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
86 test_ocsp
("DELEGATED; Root CA -> Intermediate CA",
87 "ISOP_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
88 test_ocsp
("DELEGATED; Root CA -> EE",
89 "ISOP_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
92 subtest
"=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
95 test_ocsp
("NON-DELEGATED; Intermediate CA -> EE",
96 "WRID_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
97 test_ocsp
("NON-DELEGATED; Root CA -> Intermediate CA",
98 "WRID_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
99 test_ocsp
("NON-DELEGATED; Root CA -> EE",
100 "WRID_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
101 test_ocsp
("DELEGATED; Intermediate CA -> EE",
102 "WRID_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
103 test_ocsp
("DELEGATED; Root CA -> Intermediate CA",
104 "WRID_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
105 test_ocsp
("DELEGATED; Root CA -> EE",
106 "WRID_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
109 subtest
"=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
112 test_ocsp
("NON-DELEGATED; Intermediate CA -> EE",
113 "WINH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
114 test_ocsp
("NON-DELEGATED; Root CA -> Intermediate CA",
115 "WINH_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
116 test_ocsp
("NON-DELEGATED; Root CA -> EE",
117 "WINH_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
118 test_ocsp
("DELEGATED; Intermediate CA -> EE",
119 "WINH_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
120 test_ocsp
("DELEGATED; Root CA -> Intermediate CA",
121 "WINH_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
122 test_ocsp
("DELEGATED; Root CA -> EE",
123 "WINH_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
126 subtest
"=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
129 test_ocsp
("NON-DELEGATED; Intermediate CA -> EE",
130 "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
131 test_ocsp
("NON-DELEGATED; Root CA -> Intermediate CA",
132 "WIKH_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
133 test_ocsp
("NON-DELEGATED; Root CA -> EE",
134 "WIKH_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
135 test_ocsp
("DELEGATED; Intermediate CA -> EE",
136 "WIKH_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
137 test_ocsp
("DELEGATED; Root CA -> Intermediate CA",
138 "WIKH_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
139 test_ocsp
("DELEGATED; Root CA -> EE",
140 "WIKH_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
143 subtest
"=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
146 test_ocsp
("DELEGATED; Intermediate CA -> EE",
147 "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
148 test_ocsp
("DELEGATED; Root CA -> Intermediate CA",
149 "WKDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
150 test_ocsp
("DELEGATED; Root CA -> EE",
151 "WKDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
154 subtest
"=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
157 test_ocsp
("DELEGATED; Intermediate CA -> EE",
158 "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
159 test_ocsp
("DELEGATED; Root CA -> Intermediate CA",
160 "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
161 test_ocsp
("DELEGATED; Root CA -> EE",
162 "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
163 test_ocsp
("DELEGATED; Intermediate CA -> EE",
164 "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 1);
165 test_ocsp
("DELEGATED; Root CA -> Intermediate CA",
166 "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 1);
167 test_ocsp
("DELEGATED; Root CA -> EE",
168 "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 1);
171 subtest
"=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
174 test_ocsp
("NON-DELEGATED; Intermediate CA -> EE",
175 "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", "", 1, 0);
176 test_ocsp
("NON-DELEGATED; Root CA -> Intermediate CA",
177 "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", "", 1, 0);
178 test_ocsp
("NON-DELEGATED; Root CA -> EE",
179 "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", "", 1, 0);
180 test_ocsp
("DELEGATED; Intermediate CA -> EE",
181 "D1.ors", "WSNIC_D1_Issuer_ICA.pem", "", 1, 0);
182 test_ocsp
("DELEGATED; Root CA -> Intermediate CA",
183 "D2.ors", "WSNIC_D2_Issuer_Root.pem", "", 1, 0);
184 test_ocsp
("DELEGATED; Root CA -> EE",
185 "D3.ors", "WSNIC_D3_Issuer_Root.pem", "", 1, 0);
188 subtest
"=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
191 test_ocsp
("NON-DELEGATED; Intermediate CA -> EE",
192 "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", "", 1, 0);
193 test_ocsp
("NON-DELEGATED; Root CA -> Intermediate CA",
194 "ND2.ors", "WKIC_ND2_Issuer_Root.pem", "", 1, 0);
195 test_ocsp
("NON-DELEGATED; Root CA -> EE",
196 "ND3.ors", "WKIC_ND3_Issuer_Root.pem", "", 1, 0);
197 test_ocsp
("DELEGATED; Intermediate CA -> EE",
198 "D1.ors", "WKIC_D1_Issuer_ICA.pem", "", 1, 0);
199 test_ocsp
("DELEGATED; Root CA -> Intermediate CA",
200 "D2.ors", "WKIC_D2_Issuer_Root.pem", "", 1, 0);
201 test_ocsp
("DELEGATED; Root CA -> EE",
202 "D3.ors", "WKIC_D3_Issuer_Root.pem", "", 1, 0);
205 subtest
"=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
208 # Expect success, because we're explicitly trusting the issuer certificate.
209 test_ocsp
("NON-DELEGATED; Intermediate CA -> EE",
210 "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", "", 0, 0);
211 test_ocsp
("NON-DELEGATED; Root CA -> Intermediate CA",
212 "ND2.ors", "ISIC_ND2_Issuer_Root.pem", "", 0, 0);
213 test_ocsp
("NON-DELEGATED; Root CA -> EE",
214 "ND3.ors", "ISIC_ND3_Issuer_Root.pem", "", 0, 0);
215 test_ocsp
("DELEGATED; Intermediate CA -> EE",
216 "D1.ors", "ISIC_D1_Issuer_ICA.pem", "", 0, 0);
217 test_ocsp
("DELEGATED; Root CA -> Intermediate CA",
218 "D2.ors", "ISIC_D2_Issuer_Root.pem", "", 0, 0);
219 test_ocsp
("DELEGATED; Root CA -> EE",
220 "D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0, 0);
223 subtest
"=== OCSP API TESTS===" => sub {
226 ok
(run
(test
(["ocspapitest", data_file
("cert.pem"), data_file
("key.pem")])),
227 "running ocspapitest");