2 # Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
13 use OpenSSL::Test::Utils;
14 use OpenSSL::Test qw/:DEFAULT srctop_file/;
20 require_ok(srctop_file('test', 'recipes', 'tconversion.pl'));
22 my @certs = qw(test certs);
24 # What type of key to generate?
26 if (disabled("rsa")) {
27 @req_new = ("-newkey", "dsa:".srctop_file("apps", "dsa512.pem"));
30 note("There should be a 2 sequences of .'s and some +'s.");
31 note("There should not be more that at most 80 per line");
34 # Check for duplicate -addext parameters, and one "working" case.
35 my @addext_args = ( "openssl", "req", "-new", "-out", "testreq.pem",
36 "-config", srctop_file("test", "test.cnf"), @req_new );
37 my $val = "subjectAltName=DNS:example.com";
38 my $val2 = " " . $val;
41 ok( run(app([@addext_args, "-addext", $val])));
42 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val])));
43 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val2])));
44 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val3])));
45 ok(!run(app([@addext_args, "-addext", $val2, "-addext", $val3])));
47 subtest "generating alt certificate requests with RSA" => sub {
51 skip "RSA is not supported by this OpenSSL build", 2
54 ok(run(app(["openssl", "req",
55 "-config", srctop_file("test", "test.cnf"),
57 "-new", "-out", "testreq-rsa.pem", "-utf8",
58 "-key", srctop_file("test", "testrsa.pem")])),
59 "Generating request");
61 ok(run(app(["openssl", "req",
62 "-config", srctop_file("test", "test.cnf"),
63 "-verify", "-in", "testreq-rsa.pem", "-noout"])),
64 "Verifying signature on request");
66 ok(run(app(["openssl", "req",
67 "-config", srctop_file("test", "test.cnf"),
69 "-verify", "-in", "testreq-rsa.pem", "-noout"])),
70 "Verifying signature on request");
75 subtest "generating certificate requests with RSA" => sub {
79 skip "RSA is not supported by this OpenSSL build", 2
82 ok(run(app(["openssl", "req",
83 "-config", srctop_file("test", "test.cnf"),
84 "-new", "-out", "testreq-rsa.pem", "-utf8",
85 "-key", srctop_file("test", "testrsa.pem")])),
86 "Generating request");
88 ok(run(app(["openssl", "req",
89 "-config", srctop_file("test", "test.cnf"),
90 "-verify", "-in", "testreq-rsa.pem", "-noout"])),
91 "Verifying signature on request");
95 subtest "generating certificate requests with DSA" => sub {
99 skip "DSA is not supported by this OpenSSL build", 2
102 ok(run(app(["openssl", "req",
103 "-config", srctop_file("test", "test.cnf"),
104 "-new", "-out", "testreq-dsa.pem", "-utf8",
105 "-key", srctop_file("test", "testdsa.pem")])),
106 "Generating request");
108 ok(run(app(["openssl", "req",
109 "-config", srctop_file("test", "test.cnf"),
110 "-verify", "-in", "testreq-dsa.pem", "-noout"])),
111 "Verifying signature on request");
115 subtest "generating certificate requests with ECDSA" => sub {
119 skip "ECDSA is not supported by this OpenSSL build", 2
122 ok(run(app(["openssl", "req",
123 "-config", srctop_file("test", "test.cnf"),
124 "-new", "-out", "testreq-ec.pem", "-utf8",
125 "-key", srctop_file("test", "testec-p256.pem")])),
126 "Generating request");
128 ok(run(app(["openssl", "req",
129 "-config", srctop_file("test", "test.cnf"),
130 "-verify", "-in", "testreq-ec.pem", "-noout"])),
131 "Verifying signature on request");
135 subtest "generating certificate requests with Ed25519" => sub {
139 skip "Ed25519 is not supported by this OpenSSL build", 2
142 ok(run(app(["openssl", "req",
143 "-config", srctop_file("test", "test.cnf"),
144 "-new", "-out", "testreq-ed25519.pem", "-utf8",
145 "-key", srctop_file("test", "tested25519.pem")])),
146 "Generating request");
148 ok(run(app(["openssl", "req",
149 "-config", srctop_file("test", "test.cnf"),
150 "-verify", "-in", "testreq-ed25519.pem", "-noout"])),
151 "Verifying signature on request");
155 subtest "generating certificate requests with Ed448" => sub {
159 skip "Ed448 is not supported by this OpenSSL build", 2
162 ok(run(app(["openssl", "req",
163 "-config", srctop_file("test", "test.cnf"),
164 "-new", "-out", "testreq-ed448.pem", "-utf8",
165 "-key", srctop_file("test", "tested448.pem")])),
166 "Generating request");
168 ok(run(app(["openssl", "req",
169 "-config", srctop_file("test", "test.cnf"),
170 "-verify", "-in", "testreq-ed448.pem", "-noout"])),
171 "Verifying signature on request");
175 subtest "generating certificate requests" => sub {
178 ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
179 @req_new, "-out", "testreq.pem"])),
180 "Generating request");
182 ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
183 "-verify", "-in", "testreq.pem", "-noout"])),
184 "Verifying signature on request");
187 subtest "generating SM2 certificate requests" => sub {
191 skip "SM2 is not supported by this OpenSSL build", 4
193 ok(run(app(["openssl", "req",
194 "-config", srctop_file("test", "test.cnf"),
195 "-new", "-key", srctop_file(@certs, "sm2.key"),
196 "-sigopt", "distid:1234567812345678",
197 "-out", "testreq-sm2.pem", "-sm3"])),
198 "Generating SM2 certificate request");
200 ok(run(app(["openssl", "req",
201 "-config", srctop_file("test", "test.cnf"),
202 "-verify", "-in", "testreq-sm2.pem", "-noout",
203 "-vfyopt", "distid:1234567812345678", "-sm3"])),
204 "Verifying signature on SM2 certificate request");
206 ok(run(app(["openssl", "req",
207 "-config", srctop_file("test", "test.cnf"),
208 "-new", "-key", srctop_file(@certs, "sm2.key"),
209 "-sigopt", "hexdistid:DEADBEEF",
210 "-out", "testreq-sm2.pem", "-sm3"])),
211 "Generating SM2 certificate request with hex id");
213 ok(run(app(["openssl", "req",
214 "-config", srctop_file("test", "test.cnf"),
215 "-verify", "-in", "testreq-sm2.pem", "-noout",
216 "-vfyopt", "hexdistid:DEADBEEF", "-sm3"])),
217 "Verifying signature on SM2 certificate request");
221 my @openssl_args = ("req", "-config", srctop_file("apps", "openssl.cnf"));
223 run_conversion('req conversions',
225 run_conversion('req conversions -- testreq2',
226 srctop_file("test", "testreq2.pem"));
232 subtest $title => sub {
233 run(app(["openssl", @openssl_args,
234 "-in", $reqfile, "-inform", "p",
236 stderr => "req-check.err", stdout => undef));
237 open DATA, "req-check.err";
239 plan skip_all => "skipping req conversion test for $reqfile"
240 if grep /Unknown Public Key/, map { s/\R//; } <DATA>;
242 tconversion( -type => 'req', -in => $reqfile,
243 -args => [ @openssl_args ] );
246 unlink "req-check.err";
252 # Test both generation and verification of certs w.r.t. RFC 5280 requirements
254 my $ca_cert; # will be set below
257 my $ss = $cert =~ m/self-signed/;
258 my $is_ca = $cert =~ m/CA/;
259 my $cn = $is_ca ? "CA" : "EE";
260 my $ca_key = srctop_file(@certs, "ca-key.pem");
261 my $key = $is_ca ? $ca_key : srctop_file(@certs, "ee-key.pem");
262 my @cmd = ("openssl", "req", "-config", "\"\"", "-x509",
263 "-key", $key, "-subj", "/CN=$cn", @_, "-out", $cert);
264 push(@cmd, ("-CA", $ca_cert, "-CAkey", $ca_key)) unless $ss;
265 ok(run(app([@cmd])), "generate $cert");
269 my $expect = shift @_;
270 cert_contains($cert, "Subject Key Identifier", $expect);
274 my $expect = shift @_;
275 cert_contains($cert, "Authority Key Identifier", $expect);
279 my $expect = shift @_;
280 cert_contains($cert, "Key Usage", $expect);
284 my $expect = shift @_;
285 my $trusted = shift @_;
286 $trusted = $cert unless $trusted;
287 ok(run(app(["openssl", "verify", "-x509_strict", "-trusted", $trusted,
288 "-partial_chain", $cert])) == $expect,
289 "strict verify allow $cert");
292 my @v3_ca = ("-addext", "basicConstraints = critical,CA:true",
293 "-addext", "keyUsage = keyCertSign");
294 my $SKID_AKID = "subjectKeyIdentifier,authorityKeyIdentifier";
295 my $cert = "self-signed_v1_CA_no_KIDs.pem";
296 generate_cert($cert);
297 cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
298 #TODO strict_verify($cert, 1); # self-signed v1 root cert should be accepted as CA
300 $ca_cert = "self-signed_v3_CA_default_SKID.pem";
301 generate_cert($ca_cert, @v3_ca);
302 has_SKID($ca_cert, 1);
303 has_AKID($ca_cert, 0);
304 strict_verify($ca_cert, 1);
306 $cert = "self-signed_v3_CA_no_SKID.pem";
307 generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = none");
308 cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
309 #TODO strict_verify($cert, 0);
311 $cert = "self-signed_v3_CA_both_KIDs.pem";
312 generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = hash",
313 "-addext", "authorityKeyIdentifier = keyid");
314 cert_ext_has_n_different_lines($cert, 3, $SKID_AKID); # SKID == AKID
315 strict_verify($cert, 1);
317 $cert = "self-signed_v3_EE_wrong_keyUsage.pem";
318 generate_cert($cert, "-addext", "keyUsage = keyCertSign");
319 #TODO strict_verify($cert, 1); # should be accepted because RFC 5280 does not apply
321 $cert = "v3_EE_default_KIDs.pem";
322 generate_cert($cert, "-addext", "keyUsage = dataEncipherment");
323 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
324 strict_verify($cert, 1, $ca_cert);
326 $cert = "v3_EE_no_AKID.pem";
327 generate_cert($cert, "-addext", "authorityKeyIdentifier = none");
330 strict_verify($cert, 0, $ca_cert);
332 $cert = "self-issued_v3_EE_default_KIDs.pem";
333 generate_cert($cert, "-addext", "keyUsage = dataEncipherment",
334 "-in", srctop_file(@certs, "x509-check.csr"));
335 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
336 strict_verify($cert, 1);
338 my $cert = "self-signed_CA_no_keyUsage.pem";
339 generate_cert($cert, "-in", srctop_file(@certs, "ext-check.csr"));
340 has_keyUsage($cert, 0);
341 my $cert = "self-signed_CA_with_keyUsages.pem";
342 generate_cert($cert, "-in", srctop_file(@certs, "ext-check.csr"),
343 "-copy_extensions", "copy");
344 has_keyUsage($cert, 1);