root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity

25-test_verify.t: add test for trusted root excluding key usage KeyCertSign 

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18764)
This commit is contained in:
Dr. David von Oheimb 2023-03-21 14:21:45 +01:00 committed by Tomas Mraz
parent dcac2c9e29
commit 2bd5e6f338
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
test/certs/setup.sh
View File

@ -223,6 +223,8 @@ OPENSSL_KEYBITS=4096 \
OPENSSL_KEYBITS=8192 \ OPENSSL_KEYBITS=8192 \
./mkcert.sh genee server.example ee-key-8192 ee-cert-8192 ca-key ca-cert ./mkcert.sh genee server.example ee-key-8192 ee-cert-8192 ca-key ca-cert
# root CA cert with explicit keyUsage not including KeyCertSign
openssl req -new -x509 -key root-key.pem -subj /CN="Root CA" -out root-no-KeyCertSign.pem -addext keyUsage=digitalSignature -days 36525
# self-signed end-entity cert with explicit keyUsage not including KeyCertSign # self-signed end-entity cert with explicit keyUsage not including KeyCertSign
openssl req -new -x509 -key ee-key.pem -subj /CN=ee-self-signed -out ee-self-signed.pem -addext keyUsage=digitalSignature -days 36525 openssl req -new -x509 -key ee-key.pem -subj /CN=ee-self-signed -out ee-self-signed.pem -addext keyUsage=digitalSignature -days 36525

4
test/recipes/25-test_verify.t
View File

@ -30,7 +30,7 @@ sub verify {
run(app([@args])); run(app([@args]));
} }
plan tests => 205; plan tests => 206;
# Canonical success # Canonical success
ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]), ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),
@ -39,6 +39,8 @@ ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),
# Root CA variants # Root CA variants
ok(!verify("ee-cert", "sslserver", [qw(root-nonca)], [qw(ca-cert)]), ok(!verify("ee-cert", "sslserver", [qw(root-nonca)], [qw(ca-cert)]),
"fail trusted non-ca root"); "fail trusted non-ca root");
ok(!verify("ee-cert", "sslserver", [qw(root-no-KeyCertSign)], [qw(ca-cert)]),
"fail trusted root excluding key usage KeyCertSign");
ok(!verify("ee-cert", "sslserver", [qw(nroot+serverAuth)], [qw(ca-cert)]), ok(!verify("ee-cert", "sslserver", [qw(nroot+serverAuth)], [qw(ca-cert)]),
"fail server trust non-ca root"); "fail server trust non-ca root");
ok(!verify("ee-cert", "sslserver", [qw(nroot+anyEKU)], [qw(ca-cert)]), ok(!verify("ee-cert", "sslserver", [qw(nroot+anyEKU)], [qw(ca-cert)]),