test/recipes/25-test_req.t

   1 #! /usr/bin/env perl
   2 # Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
   3 #
   4 # Licensed under the Apache License 2.0 (the "License").  You may not use
   5 # this file except in compliance with the License.  You can obtain a copy
   6 # in the file LICENSE in the source distribution or at
   7 # https://www.openssl.org/source/license.html
   8
   9
  10 use strict;
  11 use warnings;
  12
  13 use OpenSSL::Test::Utils;
  14 use OpenSSL::Test qw/:DEFAULT srctop_file/;
  15
  16 setup("test_req");
  17
  18 plan tests => 43;
  19
  20 require_ok(srctop_file('test', 'recipes', 'tconversion.pl'));
  21
  22 my @certs = qw(test certs);
  23
  24 # What type of key to generate?
  25 my @req_new;
  26 if (disabled("rsa")) {
  27     @req_new = ("-newkey", "dsa:".srctop_file("apps", "dsa512.pem"));
  28 } else {
  29     @req_new = ("-new");
  30     note("There should be a 2 sequences of .'s and some +'s.");
  31     note("There should not be more that at most 80 per line");
  32 }
  33
  34 # Check for duplicate -addext parameters, and one "working" case.
  35 my @addext_args = ( "openssl", "req", "-new", "-out", "testreq.pem",
  36                     "-key",  srctop_file("test", "certs", "ee-key.pem"),
  37     "-config", srctop_file("test", "test.cnf"), @req_new );
  38 my $val = "subjectAltName=DNS:example.com";
  39 my $val2 = " " . $val;
  40 my $val3 = $val;
  41 $val3 =~ s/=/    =/;
  42 ok( run(app([@addext_args, "-addext", $val])));
  43 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val])));
  44 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val2])));
  45 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val3])));
  46 ok(!run(app([@addext_args, "-addext", $val2, "-addext", $val3])));
  47
  48 subtest "generating alt certificate requests with RSA" => sub {
  49     plan tests => 3;
  50
  51     SKIP: {
  52         skip "RSA is not supported by this OpenSSL build", 2
  53             if disabled("rsa");
  54
  55         ok(run(app(["openssl", "req",
  56                     "-config", srctop_file("test", "test.cnf"),
  57                     "-section", "altreq",
  58                     "-new", "-out", "testreq-rsa.pem", "-utf8",
  59                     "-key", srctop_file("test", "testrsa.pem")])),
  60            "Generating request");
  61
  62         ok(run(app(["openssl", "req",
  63                     "-config", srctop_file("test", "test.cnf"),
  64                     "-verify", "-in", "testreq-rsa.pem", "-noout"])),
  65            "Verifying signature on request");
  66
  67         ok(run(app(["openssl", "req",
  68                     "-config", srctop_file("test", "test.cnf"),
  69                     "-section", "altreq",
  70                     "-verify", "-in", "testreq-rsa.pem", "-noout"])),
  71            "Verifying signature on request");
  72     }
  73 };
  74
  75
  76 subtest "generating certificate requests with RSA" => sub {
  77     plan tests => 7;
  78
  79     SKIP: {
  80         skip "RSA is not supported by this OpenSSL build", 2
  81             if disabled("rsa");
  82
  83         ok(!run(app(["openssl", "req",
  84                      "-config", srctop_file("test", "test.cnf"),
  85                      "-new", "-out", "testreq-rsa.pem", "-utf8",
  86                      "-key", srctop_file("test", "testrsa.pem"),
  87                      "-keyform", "DER"])),
  88            "Checking that mismatching keyform fails");
  89
  90         ok(run(app(["openssl", "req",
  91                     "-config", srctop_file("test", "test.cnf"),
  92                     "-new", "-out", "testreq-rsa.pem", "-utf8",
  93                     "-key", srctop_file("test", "testrsa.pem"),
  94                     "-keyform", "PEM"])),
  95            "Generating request");
  96
  97         ok(run(app(["openssl", "req",
  98                     "-config", srctop_file("test", "test.cnf"),
  99                     "-verify", "-in", "testreq-rsa.pem", "-noout"])),
 100            "Verifying signature on request");
 101
 102         ok(run(app(["openssl", "req",
 103                     "-config", srctop_file("test", "test.cnf"),
 104                     "-new", "-out", "testreq_withattrs_pem.pem", "-utf8",
 105                     "-key", srctop_file("test", "testrsa_withattrs.pem")])),
 106            "Generating request from a key with extra attributes - PEM");
 107
 108         ok(run(app(["openssl", "req",
 109                     "-config", srctop_file("test", "test.cnf"),
 110                     "-verify", "-in", "testreq_withattrs_pem.pem", "-noout"])),
 111            "Verifying signature on request from a key with extra attributes - PEM");
 112
 113         ok(run(app(["openssl", "req",
 114                     "-config", srctop_file("test", "test.cnf"),
 115                     "-new", "-out", "testreq_withattrs_der.pem", "-utf8",
 116                     "-key", srctop_file("test", "testrsa_withattrs.der"),
 117                     "-keyform", "DER"])),
 118            "Generating request from a key with extra attributes - PEM");
 119
 120         ok(run(app(["openssl", "req",
 121                     "-config", srctop_file("test", "test.cnf"),
 122                     "-verify", "-in", "testreq_withattrs_der.pem", "-noout"])),
 123            "Verifying signature on request from a key with extra attributes - PEM");
 124     }
 125 };
 126
 127 subtest "generating certificate requests with RSA-PSS" => sub {
 128     plan tests => 12;
 129
 130     SKIP: {
 131         skip "RSA is not supported by this OpenSSL build", 2
 132             if disabled("rsa");
 133
 134         ok(run(app(["openssl", "req",
 135                     "-config", srctop_file("test", "test.cnf"),
 136                     "-new", "-out", "testreq-rsapss.pem", "-utf8",
 137                     "-key", srctop_file("test", "testrsapss.pem")])),
 138            "Generating request");
 139         ok(run(app(["openssl", "req",
 140                     "-config", srctop_file("test", "test.cnf"),
 141                     "-verify", "-in", "testreq-rsapss.pem", "-noout"])),
 142            "Verifying signature on request");
 143
 144         ok(run(app(["openssl", "req",
 145                     "-config", srctop_file("test", "test.cnf"),
 146                     "-new", "-out", "testreq-rsapss2.pem", "-utf8",
 147                     "-sigopt", "rsa_padding_mode:pss",
 148                     "-sigopt", "rsa_pss_saltlen:-1",
 149                     "-key", srctop_file("test", "testrsapss.pem")])),
 150            "Generating request");
 151         ok(run(app(["openssl", "req",
 152                     "-config", srctop_file("test", "test.cnf"),
 153                     "-verify", "-in", "testreq-rsapss2.pem", "-noout"])),
 154            "Verifying signature on request");
 155
 156         ok(run(app(["openssl", "req",
 157                     "-config", srctop_file("test", "test.cnf"),
 158                     "-new", "-out", "testreq-rsapssmand.pem", "-utf8",
 159                     "-sigopt", "rsa_padding_mode:pss",
 160                     "-key", srctop_file("test", "testrsapssmandatory.pem")])),
 161            "Generating request");
 162         ok(run(app(["openssl", "req",
 163                     "-config", srctop_file("test", "test.cnf"),
 164                     "-verify", "-in", "testreq-rsapssmand.pem", "-noout"])),
 165            "Verifying signature on request");
 166
 167         ok(run(app(["openssl", "req",
 168                     "-config", srctop_file("test", "test.cnf"),
 169                     "-new", "-out", "testreq-rsapssmand2.pem", "-utf8",
 170                     "-sigopt", "rsa_pss_saltlen:100",
 171                     "-key", srctop_file("test", "testrsapssmandatory.pem")])),
 172            "Generating request");
 173         ok(run(app(["openssl", "req",
 174                     "-config", srctop_file("test", "test.cnf"),
 175                     "-verify", "-in", "testreq-rsapssmand2.pem", "-noout"])),
 176            "Verifying signature on request");
 177
 178         ok(!run(app(["openssl", "req",
 179                      "-config", srctop_file("test", "test.cnf"),
 180                      "-new", "-out", "testreq-rsapss3.pem", "-utf8",
 181                      "-sigopt", "rsa_padding_mode:pkcs1",
 182                      "-key", srctop_file("test", "testrsapss.pem")])),
 183            "Generating request with expected failure");
 184
 185         ok(!run(app(["openssl", "req",
 186                      "-config", srctop_file("test", "test.cnf"),
 187                      "-new", "-out", "testreq-rsapss3.pem", "-utf8",
 188                      "-sigopt", "rsa_pss_saltlen:-4",
 189                      "-key", srctop_file("test", "testrsapss.pem")])),
 190            "Generating request with expected failure");
 191
 192         ok(!run(app(["openssl", "req",
 193                      "-config", srctop_file("test", "test.cnf"),
 194                      "-new", "-out", "testreq-rsapssmand3.pem", "-utf8",
 195                      "-sigopt", "rsa_pss_saltlen:10",
 196                      "-key", srctop_file("test", "testrsapssmandatory.pem")])),
 197            "Generating request with expected failure");
 198
 199         ok(!run(app(["openssl", "req",
 200                      "-config", srctop_file("test", "test.cnf"),
 201                      "-new", "-out", "testreq-rsapssmand3.pem", "-utf8",
 202                      "-sha256",
 203                      "-key", srctop_file("test", "testrsapssmandatory.pem")])),
 204            "Generating request with expected failure");
 205     }
 206 };
 207
 208 subtest "generating certificate requests with DSA" => sub {
 209     plan tests => 2;
 210
 211     SKIP: {
 212         skip "DSA is not supported by this OpenSSL build", 2
 213             if disabled("dsa");
 214
 215         ok(run(app(["openssl", "req",
 216                     "-config", srctop_file("test", "test.cnf"),
 217                     "-new", "-out", "testreq-dsa.pem", "-utf8",
 218                     "-key", srctop_file("test", "testdsa.pem")])),
 219            "Generating request");
 220
 221         ok(run(app(["openssl", "req",
 222                     "-config", srctop_file("test", "test.cnf"),
 223                     "-verify", "-in", "testreq-dsa.pem", "-noout"])),
 224            "Verifying signature on request");
 225     }
 226 };
 227
 228 subtest "generating certificate requests with ECDSA" => sub {
 229     plan tests => 2;
 230
 231     SKIP: {
 232         skip "ECDSA is not supported by this OpenSSL build", 2
 233             if disabled("ec");
 234
 235         ok(run(app(["openssl", "req",
 236                     "-config", srctop_file("test", "test.cnf"),
 237                     "-new", "-out", "testreq-ec.pem", "-utf8",
 238                     "-key", srctop_file("test", "testec-p256.pem")])),
 239            "Generating request");
 240
 241         ok(run(app(["openssl", "req",
 242                     "-config", srctop_file("test", "test.cnf"),
 243                     "-verify", "-in", "testreq-ec.pem", "-noout"])),
 244            "Verifying signature on request");
 245     }
 246 };
 247
 248 subtest "generating certificate requests with Ed25519" => sub {
 249     plan tests => 2;
 250
 251     SKIP: {
 252         skip "Ed25519 is not supported by this OpenSSL build", 2
 253             if disabled("ec");
 254
 255         ok(run(app(["openssl", "req",
 256                     "-config", srctop_file("test", "test.cnf"),
 257                     "-new", "-out", "testreq-ed25519.pem", "-utf8",
 258                     "-key", srctop_file("test", "tested25519.pem")])),
 259            "Generating request");
 260
 261         ok(run(app(["openssl", "req",
 262                     "-config", srctop_file("test", "test.cnf"),
 263                     "-verify", "-in", "testreq-ed25519.pem", "-noout"])),
 264            "Verifying signature on request");
 265     }
 266 };
 267
 268 subtest "generating certificate requests with Ed448" => sub {
 269     plan tests => 2;
 270
 271     SKIP: {
 272         skip "Ed448 is not supported by this OpenSSL build", 2
 273             if disabled("ec");
 274
 275         ok(run(app(["openssl", "req",
 276                     "-config", srctop_file("test", "test.cnf"),
 277                     "-new", "-out", "testreq-ed448.pem", "-utf8",
 278                     "-key", srctop_file("test", "tested448.pem")])),
 279            "Generating request");
 280
 281         ok(run(app(["openssl", "req",
 282                     "-config", srctop_file("test", "test.cnf"),
 283                     "-verify", "-in", "testreq-ed448.pem", "-noout"])),
 284            "Verifying signature on request");
 285     }
 286 };
 287
 288 subtest "generating certificate requests" => sub {
 289     plan tests => 2;
 290
 291     ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
 292                 "-key", srctop_file("test", "certs", "ee-key.pem"),
 293                 @req_new, "-out", "testreq.pem"])),
 294        "Generating request");
 295
 296     ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
 297                 "-verify", "-in", "testreq.pem", "-noout"])),
 298        "Verifying signature on request");
 299 };
 300
 301 subtest "generating SM2 certificate requests" => sub {
 302     plan tests => 4;
 303
 304     SKIP: {
 305         skip "SM2 is not supported by this OpenSSL build", 4
 306         if disabled("sm2");
 307         ok(run(app(["openssl", "req",
 308                     "-config", srctop_file("test", "test.cnf"),
 309                     "-new", "-key", srctop_file(@certs, "sm2.key"),
 310                     "-sigopt", "distid:1234567812345678",
 311                     "-out", "testreq-sm2.pem", "-sm3"])),
 312            "Generating SM2 certificate request");
 313
 314         ok(run(app(["openssl", "req",
 315                     "-config", srctop_file("test", "test.cnf"),
 316                     "-verify", "-in", "testreq-sm2.pem", "-noout",
 317                     "-vfyopt", "distid:1234567812345678", "-sm3"])),
 318            "Verifying signature on SM2 certificate request");
 319
 320         ok(run(app(["openssl", "req",
 321                     "-config", srctop_file("test", "test.cnf"),
 322                     "-new", "-key", srctop_file(@certs, "sm2.key"),
 323                     "-sigopt", "hexdistid:DEADBEEF",
 324                     "-out", "testreq-sm2.pem", "-sm3"])),
 325            "Generating SM2 certificate request with hex id");
 326
 327         ok(run(app(["openssl", "req",
 328                     "-config", srctop_file("test", "test.cnf"),
 329                     "-verify", "-in", "testreq-sm2.pem", "-noout",
 330                     "-vfyopt", "hexdistid:DEADBEEF", "-sm3"])),
 331            "Verifying signature on SM2 certificate request");
 332     }
 333 };
 334
 335 my @openssl_args = ("req", "-config", srctop_file("apps", "openssl.cnf"));
 336
 337 run_conversion('req conversions',
 338                "testreq.pem");
 339 run_conversion('req conversions -- testreq2',
 340                srctop_file("test", "testreq2.pem"));
 341
 342 sub run_conversion {
 343     my $title = shift;
 344     my $reqfile = shift;
 345
 346     subtest $title => sub {
 347         run(app(["openssl", @openssl_args,
 348                  "-in", $reqfile, "-inform", "p",
 349                  "-noout", "-text"],
 350                 stderr => "req-check.err", stdout => undef));
 351         open DATA, "req-check.err";
 352         SKIP: {
 353             plan skip_all => "skipping req conversion test for $reqfile"
 354                 if grep /Unknown Public Key/, map { s/\R//; } <DATA>;
 355
 356             tconversion( -type => 'req', -in => $reqfile,
 357                          -args => [ @openssl_args ] );
 358         }
 359         close DATA;
 360         unlink "req-check.err";
 361
 362         done_testing();
 363     };
 364 }
 365
 366 # Test both generation and verification of certs w.r.t. RFC 5280 requirements
 367
 368 my $ca_cert; # will be set below
 369 sub generate_cert {
 370     my $cert = shift @_;
 371     my $ss = $cert =~ m/self-signed/;
 372     my $is_ca = $cert =~ m/CA/;
 373     my $cn = $is_ca ? "CA" : "EE";
 374     my $ca_key = srctop_file(@certs, "ca-key.pem");
 375     my $key = $is_ca ? $ca_key : srctop_file(@certs, "ee-key.pem");
 376     my @cmd = ("openssl", "req", "-config", "", "-x509",
 377                "-key", $key, "-subj", "/CN=$cn", @_, "-out", $cert);
 378     push(@cmd, ("-CA", $ca_cert, "-CAkey", $ca_key)) unless $ss;
 379     ok(run(app([@cmd])), "generate $cert");
 380 }
 381 sub has_SKID {
 382     my $cert = shift @_;
 383     my $expect = shift @_;
 384     cert_contains($cert, "Subject Key Identifier", $expect);
 385 }
 386 sub has_AKID {
 387     my $cert = shift @_;
 388     my $expect = shift @_;
 389     cert_contains($cert, "Authority Key Identifier", $expect);
 390 }
 391 sub has_keyUsage {
 392     my $cert = shift @_;
 393     my $expect = shift @_;
 394     cert_contains($cert, "Key Usage", $expect);
 395 }
 396 sub strict_verify {
 397     my $cert = shift @_;
 398     my $expect = shift @_;
 399     my $trusted = shift @_;
 400     $trusted = $cert unless $trusted;
 401     ok(run(app(["openssl", "verify", "-x509_strict", "-trusted", $trusted,
 402                 "-partial_chain", $cert])) == $expect,
 403        "strict verify allow $cert");
 404 }
 405
 406 my @v3_ca = ("-addext", "basicConstraints = critical,CA:true",
 407              "-addext", "keyUsage = keyCertSign");
 408 my $SKID_AKID = "subjectKeyIdentifier,authorityKeyIdentifier";
 409 my $cert = "self-signed_v1_CA_no_KIDs.pem";
 410 generate_cert($cert);
 411 cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
 412 #TODO strict_verify($cert, 1); # self-signed v1 root cert should be accepted as CA
 413
 414 $ca_cert = "self-signed_v3_CA_default_SKID.pem";
 415 generate_cert($ca_cert, @v3_ca);
 416 has_SKID($ca_cert, 1);
 417 has_AKID($ca_cert, 0);
 418 strict_verify($ca_cert, 1);
 419
 420 $cert = "self-signed_v3_CA_no_SKID.pem";
 421 generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = none");
 422 cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
 423 #TODO strict_verify($cert, 0);
 424
 425 $cert = "self-signed_v3_CA_both_KIDs.pem";
 426 generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = hash",
 427             "-addext", "authorityKeyIdentifier = keyid");
 428 cert_ext_has_n_different_lines($cert, 3, $SKID_AKID); # SKID == AKID
 429 strict_verify($cert, 1);
 430
 431 $cert = "self-signed_v3_EE_wrong_keyUsage.pem";
 432 generate_cert($cert, "-addext", "keyUsage = keyCertSign");
 433 #TODO strict_verify($cert, 1); # should be accepted because RFC 5280 does not apply
 434
 435 $cert = "v3_EE_default_KIDs.pem";
 436 generate_cert($cert, "-addext", "keyUsage = dataEncipherment");
 437 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
 438 strict_verify($cert, 1, $ca_cert);
 439
 440 $cert = "v3_EE_no_AKID.pem";
 441 generate_cert($cert, "-addext", "authorityKeyIdentifier = none");
 442 has_SKID($cert, 1);
 443 has_AKID($cert, 0);
 444 strict_verify($cert, 0, $ca_cert);
 445
 446 $cert = "self-issued_v3_EE_default_KIDs.pem";
 447 generate_cert($cert, "-addext", "keyUsage = dataEncipherment",
 448     "-in", srctop_file(@certs, "x509-check.csr"));
 449 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
 450 strict_verify($cert, 1);
 451
 452 my $cert = "self-signed_CA_no_keyUsage.pem";
 453 generate_cert($cert, "-in", srctop_file(@certs, "ext-check.csr"));
 454 has_keyUsage($cert, 0);
 455 my $cert = "self-signed_CA_with_keyUsages.pem";
 456 generate_cert($cert, "-in", srctop_file(@certs, "ext-check.csr"),
 457     "-copy_extensions", "copy");
 458 has_keyUsage($cert, 1);