test/recipes/25-test_req.t

   1 #! /usr/bin/env perl
   2 # Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
   3 #
   4 # Licensed under the Apache License 2.0 (the "License").  You may not use
   5 # this file except in compliance with the License.  You can obtain a copy
   6 # in the file LICENSE in the source distribution or at
   7 # https://www.openssl.org/source/license.html
   8
   9
  10 use strict;
  11 use warnings;
  12
  13 use OpenSSL::Test::Utils;
  14 use OpenSSL::Test qw/:DEFAULT srctop_file/;
  15
  16 setup("test_req");
  17
  18 plan tests => 15;
  19
  20 require_ok(srctop_file('test','recipes','tconversion.pl'));
  21
  22 # What type of key to generate?
  23 my @req_new;
  24 if (disabled("rsa")) {
  25     @req_new = ("-newkey", "dsa:".srctop_file("apps", "dsa512.pem"));
  26 } else {
  27     @req_new = ("-new");
  28     note("There should be a 2 sequences of .'s and some +'s.");
  29     note("There should not be more that at most 80 per line");
  30 }
  31
  32 # Check for duplicate -addext parameters, and one "working" case.
  33 my @addext_args = ( "openssl", "req", "-new", "-out", "testreq.pem",
  34     "-config", srctop_file("test", "test.cnf"), @req_new );
  35 my $val = "subjectAltName=DNS:example.com";
  36 my $val2 = " " . $val;
  37 my $val3 = $val;
  38 $val3 =~ s/=/    =/;
  39 ok( run(app([@addext_args, "-addext", $val])));
  40 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val])));
  41 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val2])));
  42 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val3])));
  43 ok(!run(app([@addext_args, "-addext", $val2, "-addext", $val3])));
  44
  45 subtest "generating certificate requests with RSA" => sub {
  46     plan tests => 2;
  47
  48     SKIP: {
  49         skip "RSA is not supported by this OpenSSL build", 2
  50             if disabled("rsa");
  51
  52         ok(run(app(["openssl", "req",
  53                     "-config", srctop_file("test", "test.cnf"),
  54                     "-new", "-out", "testreq.pem", "-utf8",
  55                     "-key", srctop_file("test", "testrsa.pem")])),
  56            "Generating request");
  57
  58         ok(run(app(["openssl", "req",
  59                     "-config", srctop_file("test", "test.cnf"),
  60                     "-verify", "-in", "testreq.pem", "-noout"])),
  61            "Verifying signature on request");
  62     }
  63 };
  64
  65 subtest "generating certificate requests with DSA" => sub {
  66     plan tests => 2;
  67
  68     SKIP: {
  69         skip "DSA is not supported by this OpenSSL build", 2
  70             if disabled("dsa");
  71
  72         ok(run(app(["openssl", "req",
  73                     "-config", srctop_file("test", "test.cnf"),
  74                     "-new", "-out", "testreq.pem", "-utf8",
  75                     "-key", srctop_file("test", "testdsa.pem")])),
  76            "Generating request");
  77
  78         ok(run(app(["openssl", "req",
  79                     "-config", srctop_file("test", "test.cnf"),
  80                     "-verify", "-in", "testreq.pem", "-noout"])),
  81            "Verifying signature on request");
  82     }
  83 };
  84
  85 subtest "generating certificate requests with ECDSA" => sub {
  86     plan tests => 2;
  87
  88     SKIP: {
  89         skip "ECDSA is not supported by this OpenSSL build", 2
  90             if disabled("ec");
  91
  92         ok(run(app(["openssl", "req",
  93                     "-config", srctop_file("test", "test.cnf"),
  94                     "-new", "-out", "testreq.pem", "-utf8",
  95                     "-key", srctop_file("test", "testec-p256.pem")])),
  96            "Generating request");
  97
  98         ok(run(app(["openssl", "req",
  99                     "-config", srctop_file("test", "test.cnf"),
 100                     "-verify", "-in", "testreq.pem", "-noout"])),
 101            "Verifying signature on request");
 102     }
 103 };
 104
 105 subtest "generating certificate requests with Ed25519" => sub {
 106     plan tests => 2;
 107
 108     SKIP: {
 109         skip "Ed25519 is not supported by this OpenSSL build", 2
 110             if disabled("ec");
 111
 112         ok(run(app(["openssl", "req",
 113                     "-config", srctop_file("test", "test.cnf"),
 114                     "-new", "-out", "testreq.pem", "-utf8",
 115                     "-key", srctop_file("test", "tested25519.pem")])),
 116            "Generating request");
 117
 118         ok(run(app(["openssl", "req",
 119                     "-config", srctop_file("test", "test.cnf"),
 120                     "-verify", "-in", "testreq.pem", "-noout"])),
 121            "Verifying signature on request");
 122     }
 123 };
 124
 125 subtest "generating certificate requests with Ed448" => sub {
 126     plan tests => 2;
 127
 128     SKIP: {
 129         skip "Ed448 is not supported by this OpenSSL build", 2
 130             if disabled("ec");
 131
 132         ok(run(app(["openssl", "req",
 133                     "-config", srctop_file("test", "test.cnf"),
 134                     "-new", "-out", "testreq.pem", "-utf8",
 135                     "-key", srctop_file("test", "tested448.pem")])),
 136            "Generating request");
 137
 138         ok(run(app(["openssl", "req",
 139                     "-config", srctop_file("test", "test.cnf"),
 140                     "-verify", "-in", "testreq.pem", "-noout"])),
 141            "Verifying signature on request");
 142     }
 143 };
 144
 145 subtest "generating certificate requests" => sub {
 146     plan tests => 2;
 147
 148     ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
 149                 @req_new, "-out", "testreq.pem"])),
 150        "Generating request");
 151
 152     ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
 153                 "-verify", "-in", "testreq.pem", "-noout"])),
 154        "Verifying signature on request");
 155 };
 156
 157 subtest "generating SM2 certificate requests" => sub {
 158     plan tests => 4;
 159
 160     SKIP: {
 161         skip "SM2 is not supported by this OpenSSL build", 4
 162         if disabled("sm2");
 163         ok(run(app(["openssl", "req",
 164                     "-config", srctop_file("test", "test.cnf"),
 165                     "-new", "-key", srctop_file("test", "certs", "sm2.key"),
 166                     "-sigopt", "sm2_id:1234567812345678",
 167                     "-out", "testreq.pem", "-sm3"])),
 168            "Generating SM2 certificate request");
 169
 170         ok(run(app(["openssl", "req",
 171                     "-config", srctop_file("test", "test.cnf"),
 172                     "-verify", "-in", "testreq.pem", "-noout",
 173                     "-sm2-id", "1234567812345678", "-sm3"])),
 174            "Verifying signature on SM2 certificate request");
 175
 176         ok(run(app(["openssl", "req",
 177                     "-config", srctop_file("test", "test.cnf"),
 178                     "-new", "-key", srctop_file("test", "certs", "sm2.key"),
 179                     "-sigopt", "sm2_hex_id:DEADBEEF",
 180                     "-out", "testreq.pem", "-sm3"])),
 181            "Generating SM2 certificate request with hex id");
 182
 183         ok(run(app(["openssl", "req",
 184                     "-config", srctop_file("test", "test.cnf"),
 185                     "-verify", "-in", "testreq.pem", "-noout",
 186                     "-sm2-hex-id", "DEADBEEF", "-sm3"])),
 187            "Verifying signature on SM2 certificate request");
 188     }
 189 };
 190
 191 my @openssl_args = ("req", "-config", srctop_file("apps", "openssl.cnf"));
 192
 193 run_conversion('req conversions',
 194                "testreq.pem");
 195 run_conversion('req conversions -- testreq2',
 196                srctop_file("test", "testreq2.pem"));
 197
 198 unlink "testkey.pem", "testreq.pem";
 199
 200 sub run_conversion {
 201     my $title = shift;
 202     my $reqfile = shift;
 203
 204     subtest $title => sub {
 205         run(app(["openssl", @openssl_args,
 206                  "-in", $reqfile, "-inform", "p",
 207                  "-noout", "-text"],
 208                 stderr => "req-check.err", stdout => undef));
 209         open DATA, "req-check.err";
 210         SKIP: {
 211             plan skip_all => "skipping req conversion test for $reqfile"
 212                 if grep /Unknown Public Key/, map { s/\R//; } <DATA>;
 213
 214             tconversion("req", $reqfile, @openssl_args);
 215         }
 216         close DATA;
 217         unlink "req-check.err";
 218
 219         done_testing();
 220     };
 221 }