./mkcert.sh req bad-pc6-key "0.CN = server.example" "1.CN = proxy 1" "2.+CN = proxy 6" | \
./mkcert.sh genpc bad-pc6-key bad-pc6-cert pc1-key pc1-cert \
"language = id-ppl-anyLanguage" "pathlen = 0" "policy = text:AB"
+
+# Name constraints test certificates.
+
+# NC CA1 only permits the host www.good.org and *.good.com email address
+# good@good.org and *@good.com and IP addresses 127.0.0.1 and
+# 192.168.0.0/16
+
+NC="permitted;DNS:www.good.org, permitted;DNS:good.com,"
+NC="$NC permitted;email:good@good.org, permitted;email:good.com,"
+NC="$NC permitted;IP:127.0.0.1/255.255.255.255, permitted;IP:192.168.0.0/255.255.0.0"
+
+NC=$NC ./mkcert.sh genca "Test NC CA 1" ncca1-key ncca1-cert root-key root-cert
+
+# NC CA2 allows anything apart from hosts www.bad.org and *.bad.com
+# and email addresses bad@bad.org and *@bad.com
+
+NC="excluded;DNS:www.bad.org, excluded;DNS:bad.com,"
+NC="$NC excluded;email:bad@bad.org, excluded;email:bad.com, "
+NC="$NC excluded;IP:10.0.0.0/255.0.0.0"
+
+NC=$NC ./mkcert.sh genca "Test NC CA 2" ncca2-key ncca2-cert root-key root-cert
+
+# Name constraints subordinate CA. Adds www.good.net (which should be
+# disallowed because parent CA doesn't permit it) adds ok.good.com
+# (which should be allowed because parent allows *.good.com
+# and now excludes bad.ok.good.com (allowed in permitted subtrees
+# but explicitly excluded).
+
+NC="permitted;DNS:www.good.net, permitted;DNS:ok.good.com, "
+NC="$NC excluded;DNS:bad.ok.good.com"
+NC=$NC ./mkcert.sh genca "Test NC sub CA" ncca3-key ncca3-cert \
+ ncca1-key ncca1-cert
+
+# all subjectAltNames allowed by CA1.
+
+./mkcert.sh req alt1-key "O = Good NC Test Certificate 1" \
+ "1.CN=www.good.org" "2.CN=Joe Bloggs" "3.CN=any.good.com" | \
+ ./mkcert.sh geneealt alt1-key alt1-cert ncca1-key ncca1-cert \
+ "DNS.1 = www.good.org" "DNS.2 = any.good.com" \
+ "email.1 = good@good.org" "email.2 = any@good.com" \
+ "IP = 127.0.0.1" "IP = 192.168.0.1"
+
+# no subjectAltNames excluded by CA2.
+
+./mkcert.sh req alt2-key "O = Good NC Test Certificate 2" | \
+ ./mkcert.sh geneealt alt2-key alt2-cert ncca2-key ncca2-cert \
+ "DNS.1 = www.anything.org" "DNS.2 = any.other.com" \
+ "email.1 = other@bad.org" "email.2 = any@something.com"
+
+# hostname other.good.org which is not allowed by CA1.
+
+./mkcert.sh req badalt1-key "O = Bad NC Test Certificate 1" | \
+ ./mkcert.sh geneealt badalt1-key badalt1-cert ncca1-key ncca1-cert \
+ "DNS.1 = other.good.org" "DNS.2 = any.good.com" \
+ "email.1 = good@good.org" "email.2 = any@good.com"
+
+# any.bad.com is excluded by CA2.
+
+./mkcert.sh req badalt2-key 'O = Bad NC Test Certificate 2' | \
+ ./mkcert.sh geneealt badalt2-key badalt2-cert ncca2-key ncca2-cert \
+ "DNS.1 = www.good.org" "DNS.2 = any.bad.com" \
+ "email.1 = good@good.org" "email.2 = any@good.com"
+
+# other@good.org not permitted by CA1
+
+./mkcert.sh req badalt3-key "O = Bad NC Test Certificate 3" | \
+ ./mkcert.sh geneealt badalt3-key badalt1-cert ncca1-key ncca1-cert \
+ "DNS.1 = www.good.org" "DNS.2 = any.good.com" \
+ "email.1 = other@good.org" "email.2 = any@good.com"
+
+# all subject alt names OK but subject email address not allowed by CA1.
+
+./mkcert.sh req badalt4-key 'O = Bad NC Test Certificate 4' \
+ "emailAddress = any@other.com" | \
+ ./mkcert.sh geneealt badalt4-key badalt4-cert ncca1-key ncca1-cert \
+ "DNS.1 = www.good.org" "DNS.2 = any.good.com" \
+ "email.1 = good@good.org" "email.2 = any@good.com"
+
+# IP address not allowed by CA1
+./mkcert.sh req badalt5-key "O = Bad NC Test Certificate 5" | \
+ ./mkcert.sh geneealt badalt5-key badalt5-cert ncca1-key ncca1-cert \
+ "DNS.1 = www.good.org" "DNS.2 = any.good.com" \
+ "email.1 = good@good.org" "email.2 = any@good.com" \
+ "IP = 127.0.0.2"
+
+# all subject alt names OK but subject CN not allowed by CA1.
+./mkcert.sh req badalt6-key "O = Bad NC Test Certificate 6" \
+ "1.CN=other.good.org" "2.CN=Joe Bloggs" "3.CN=any.good.com" | \
+ ./mkcert.sh geneealt badalt6-key badalt6-cert ncca1-key ncca1-cert \
+ "DNS.1 = www.good.org" "DNS.2 = any.good.com" \
+ "email.1 = good@good.org" "email.2 = any@good.com" \
+ "IP = 127.0.0.1" "IP = 192.168.0.1"
+
+# all subject alt names OK but subject CN not allowed by CA1, BMPSTRING
+REQMASK=MASK:0x800 ./mkcert.sh req badalt7-key "O = Bad NC Test Certificate 7" \
+ "1.CN=other.good.org" "2.CN=Joe Bloggs" "3.CN=any.good.com" | \
+ ./mkcert.sh geneealt badalt7-key badalt7-cert ncca1-key ncca1-cert \
+ "DNS.1 = www.good.org" "DNS.2 = any.good.com" \
+ "email.1 = good@good.org" "email.2 = any@good.com" \
+ "IP = 127.0.0.1" "IP = 192.168.0.1"
+
+# all subjectAltNames allowed by chain
+
+./mkcert.sh req alt3-key "O = Good NC Test Certificate 3" \
+ "1.CN=www.ok.good.com" "2.CN=Joe Bloggs" | \
+ ./mkcert.sh geneealt alt3-key alt3-cert ncca3-key ncca3-cert \
+ "DNS.1 = www.ok.good.com" \
+ "email.1 = good@good.org" "email.2 = any@good.com" \
+ "IP = 127.0.0.1" "IP = 192.168.0.1"
+
+# www.good.net allowed by parent CA but not parent of parent
+
+./mkcert.sh req badalt8-key "O = Bad NC Test Certificate 8" \
+ "1.CN=www.good.com" "2.CN=Joe Bloggs" | \
+ ./mkcert.sh geneealt badalt8-key badalt8-cert ncca3-key ncca3-cert \
+ "DNS.1 = www.ok.good.com" "DNS.2 = www.good.net" \
+ "email.1 = good@good.org" "email.2 = any@good.com" \
+ "IP = 127.0.0.1" "IP = 192.168.0.1"
+
+# other.good.com not allowed by parent CA but allowed by parent of parent
+
+./mkcert.sh req badalt9-key "O = Bad NC Test Certificate 9" \
+ "1.CN=www.good.com" "2.CN=Joe Bloggs" | \
+ ./mkcert.sh geneealt badalt9-key badalt9-cert ncca3-key ncca3-cert \
+ "DNS.1 = www.good.com" "DNS.2 = other.good.com" \
+ "email.1 = good@good.org" "email.2 = any@good.com" \
+ "IP = 127.0.0.1" "IP = 192.168.0.1"
+
+# www.bad.net excluded by parent CA.
+
+./mkcert.sh req badalt10-key "O = Bad NC Test Certificate 10" \
+ "1.CN=www.ok.good.com" "2.CN=Joe Bloggs" | \
+ ./mkcert.sh geneealt badalt10-key badalt10-cert ncca3-key ncca3-cert \
+ "DNS.1 = www.ok.good.com" "DNS.2 = bad.ok.good.com" \
+ "email.1 = good@good.org" "email.2 = any@good.com" \
+ "IP = 127.0.0.1" "IP = 192.168.0.1"
projects / openssl.git / blobdiff