3 # Copyright (c) 2004 - 2006 Kungliga Tekniska Högskolan
4 # (Royal Institute of Technology, Stockholm, Sweden).
7 # Redistribution and use in source and binary forms, with or without
8 # modification, are permitted provided that the following conditions
11 # 1. Redistributions of source code must retain the above copyright
12 # notice, this list of conditions and the following disclaimer.
14 # 2. Redistributions in binary form must reproduce the above copyright
15 # notice, this list of conditions and the following disclaimer in the
16 # documentation and/or other materials provided with the distribution.
18 # 3. Neither the name of the Institute nor the names of its contributors
19 # may be used to endorse or promote products derived from this software
20 # without specific prior written permission.
22 # THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
23 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 # ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
26 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 # $Id: test_chain.in 21278 2007-06-25 04:54:43Z lha $
40 stat="--statistic-file=${objdir}/statfile"
42 hxtool="${TESTS_ENVIRONMENT} ./hxtool ${stat}"
43 if ${hxtool} info | grep 'rsa: hcrypto null RSA' > /dev/null ; then
46 if ${hxtool} info | grep 'rand: not available' > /dev/null ; then
51 ${hxtool} verify --missing-revoke \
52 cert:FILE:$srcdir/data/test.crt \
53 chain:FILE:$srcdir/data/test.crt \
54 chain:FILE:$srcdir/data/ca.crt \
55 anchor:FILE:$srcdir/data/ca.crt > /dev/null || exit 1
58 ${hxtool} verify --missing-revoke \
59 cert:FILE:$srcdir/data/test.crt \
60 chain:FILE:$srcdir/data/ca.crt \
61 anchor:FILE:$srcdir/data/ca.crt > /dev/null || exit 1
64 ${hxtool} verify --missing-revoke \
65 cert:FILE:$srcdir/data/test.crt \
66 anchor:FILE:$srcdir/data/ca.crt > /dev/null || exit 1
68 echo "sub-cert -> root"
69 ${hxtool} verify --missing-revoke \
70 cert:FILE:$srcdir/data/sub-cert.crt \
71 chain:FILE:$srcdir/data/ca.crt \
72 anchor:FILE:$srcdir/data/ca.crt > /dev/null && exit 1
74 echo "sub-cert -> sub-ca -> root"
75 ${hxtool} verify --missing-revoke \
76 cert:FILE:$srcdir/data/sub-cert.crt \
77 chain:FILE:$srcdir/data/sub-ca.crt \
78 chain:FILE:$srcdir/data/ca.crt \
79 anchor:FILE:$srcdir/data/ca.crt > /dev/null || exit 1
81 echo "sub-cert -> sub-ca"
82 ${hxtool} verify --missing-revoke \
83 cert:FILE:$srcdir/data/sub-cert.crt \
84 anchor:FILE:$srcdir/data/sub-ca.crt > /dev/null || exit 1
86 echo "sub-cert -> sub-ca -> root"
87 ${hxtool} verify --missing-revoke \
88 cert:FILE:$srcdir/data/sub-cert.crt \
89 chain:FILE:$srcdir/data/sub-ca.crt \
90 chain:FILE:$srcdir/data/ca.crt \
91 anchor:FILE:$srcdir/data/ca.crt > /dev/null || exit 1
93 echo "sub-cert -> sub-ca -> root"
94 ${hxtool} verify --missing-revoke \
95 cert:FILE:$srcdir/data/sub-cert.crt \
96 chain:FILE:$srcdir/data/ca.crt \
97 chain:FILE:$srcdir/data/sub-ca.crt \
98 anchor:FILE:$srcdir/data/ca.crt > /dev/null || exit 1
100 echo "sub-cert -> sub-ca -> root"
101 ${hxtool} verify --missing-revoke \
102 cert:FILE:$srcdir/data/sub-cert.crt \
103 chain:FILE:$srcdir/data/sub-ca.crt \
104 anchor:FILE:$srcdir/data/ca.crt > /dev/null || exit 1
106 echo "max depth 2 (ok)"
107 ${hxtool} verify --missing-revoke \
109 cert:FILE:$srcdir/data/sub-cert.crt \
110 chain:FILE:$srcdir/data/sub-ca.crt \
111 anchor:FILE:$srcdir/data/ca.crt > /dev/null && exit 1
113 echo "max depth 1 (fail)"
114 ${hxtool} verify --missing-revoke \
116 cert:FILE:$srcdir/data/sub-cert.crt \
117 chain:FILE:$srcdir/data/sub-ca.crt \
118 anchor:FILE:$srcdir/data/ca.crt > /dev/null && exit 1
120 echo "ocsp non-ca responder"
122 cert:FILE:$srcdir/data/test.crt \
123 anchor:FILE:$srcdir/data/ca.crt \
124 ocsp:FILE:$srcdir/data/ocsp-resp1-ocsp.der > /dev/null || exit 1
126 echo "ocsp ca responder"
128 cert:FILE:$srcdir/data/test.crt \
129 anchor:FILE:$srcdir/data/ca.crt \
130 ocsp:FILE:$srcdir/data/ocsp-resp1-ca.der > /dev/null || exit 1
132 echo "ocsp no-ca responder, missing cert"
134 cert:FILE:$srcdir/data/test.crt \
135 anchor:FILE:$srcdir/data/ca.crt \
136 ocsp:FILE:$srcdir/data/ocsp-resp1-ocsp-no-cert.der > /dev/null && exit 1
138 echo "ocsp no-ca responder, missing cert, in pool"
140 cert:FILE:$srcdir/data/test.crt \
141 anchor:FILE:$srcdir/data/ca.crt \
142 ocsp:FILE:$srcdir/data/ocsp-resp1-ocsp-no-cert.der \
143 chain:FILE:$srcdir/data/ocsp-responder.crt > /dev/null || exit 1
145 echo "ocsp no-ca responder, keyHash"
147 cert:FILE:$srcdir/data/test.crt \
148 anchor:FILE:$srcdir/data/ca.crt \
149 ocsp:FILE:$srcdir/data/ocsp-resp1-keyhash.der > /dev/null || exit 1
151 echo "ocsp revoked cert"
153 cert:FILE:$srcdir/data/revoke.crt \
154 anchor:FILE:$srcdir/data/ca.crt \
155 ocsp:FILE:$srcdir/data/ocsp-resp2.der > /dev/null && exit 1
157 for a in resp1-ocsp-no-cert resp1-ca resp1-keyhash resp2 ; do
158 echo "ocsp print reply $a"
159 ${hxtool} ocsp-print \
160 $srcdir/data/ocsp-${a}.der > /dev/null || exit 1
163 echo "ocsp verify exists"
164 ${hxtool} ocsp-verify \
165 --ocsp-file=$srcdir/data/ocsp-resp1-ca.der \
166 FILE:$srcdir/data/test.crt > /dev/null || exit 1
168 echo "ocsp verify not exists"
169 ${hxtool} ocsp-verify \
170 --ocsp-file=$srcdir/data/ocsp-resp1.der \
171 FILE:$srcdir/data/ca.crt > /dev/null && exit 1
173 echo "ocsp verify revoked"
174 ${hxtool} ocsp-verify \
175 --ocsp-file=$srcdir/data/ocsp-resp2.der \
176 FILE:$srcdir/data/revoke.crt > /dev/null && exit 1
178 echo "crl non-revoked cert"
180 cert:FILE:$srcdir/data/test.crt \
181 anchor:FILE:$srcdir/data/ca.crt \
182 crl:FILE:$srcdir/data/crl1.der > /dev/null || exit 1
184 echo "crl revoked cert"
186 cert:FILE:$srcdir/data/revoke.crt \
187 anchor:FILE:$srcdir/data/ca.crt \
188 crl:FILE:$srcdir/data/crl1.der > /dev/null && exit 1
191 ${hxtool} verify --missing-revoke \
192 --allow-proxy-certificate \
193 cert:FILE:$srcdir/data/proxy-test.crt \
194 chain:FILE:$srcdir/data/test.crt \
195 anchor:FILE:$srcdir/data/ca.crt > /dev/null || exit 1
197 echo "proxy cert (negative)"
198 ${hxtool} verify --missing-revoke \
199 cert:FILE:$srcdir/data/proxy-test.crt \
200 chain:FILE:$srcdir/data/test.crt \
201 anchor:FILE:$srcdir/data/ca.crt > /dev/null && exit 1
203 echo "proxy cert (level fail)"
204 ${hxtool} verify --missing-revoke \
205 --allow-proxy-certificate \
206 cert:FILE:$srcdir/data/proxy-level-test.crt \
207 chain:FILE:$srcdir/data/proxy-test.crt \
208 chain:FILE:$srcdir/data/test.crt \
209 anchor:FILE:$srcdir/data/ca.crt > /dev/null && exit 1
211 echo "not a proxy cert"
212 ${hxtool} verify --missing-revoke \
213 --allow-proxy-certificate \
214 cert:FILE:$srcdir/data/no-proxy-test.crt \
215 chain:FILE:$srcdir/data/test.crt \
216 anchor:FILE:$srcdir/data/ca.crt > /dev/null && exit 1
218 echo "proxy cert (max level 10)"
219 ${hxtool} verify --missing-revoke \
220 --allow-proxy-certificate \
221 cert:FILE:$srcdir/data/proxy10-test.crt \
222 chain:FILE:$srcdir/data/test.crt \
223 anchor:FILE:$srcdir/data/ca.crt > /dev/null || exit 1
225 echo "proxy cert (second level)"
226 ${hxtool} verify --missing-revoke \
227 --allow-proxy-certificate \
228 cert:FILE:$srcdir/data/proxy10-child-test.crt \
229 chain:FILE:$srcdir/data/proxy10-test.crt \
230 chain:FILE:$srcdir/data/test.crt \
231 anchor:FILE:$srcdir/data/ca.crt > /dev/null || exit 1
233 echo "proxy cert (third level)"
234 ${hxtool} verify --missing-revoke \
235 --allow-proxy-certificate \
236 cert:FILE:$srcdir/data/proxy10-child-child-test.crt \
237 chain:FILE:$srcdir/data/proxy10-child-test.crt \
238 chain:FILE:$srcdir/data/proxy10-test.crt \
239 chain:FILE:$srcdir/data/test.crt \
240 anchor:FILE:$srcdir/data/ca.crt > /dev/null || exit 1