test/recipes/25-test_req.t

   1 #! /usr/bin/env perl
   2 # Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
   3 #
   4 # Licensed under the Apache License 2.0 (the "License").  You may not use
   5 # this file except in compliance with the License.  You can obtain a copy
   6 # in the file LICENSE in the source distribution or at
   7 # https://www.openssl.org/source/license.html
   8
   9
  10 use strict;
  11 use warnings;
  12
  13 use OpenSSL::Test::Utils;
  14 use OpenSSL::Test qw/:DEFAULT srctop_file/;
  15
  16 setup("test_req");
  17
  18 plan tests => 43;
  19
  20 require_ok(srctop_file('test', 'recipes', 'tconversion.pl'));
  21
  22 my @certs = qw(test certs);
  23
  24 # What type of key to generate?
  25 my @req_new;
  26 if (disabled("rsa")) {
  27     @req_new = ("-newkey", "dsa:".srctop_file("apps", "dsa512.pem"));
  28 } else {
  29     @req_new = ("-new");
  30     note("There should be a 2 sequences of .'s and some +'s.");
  31     note("There should not be more that at most 80 per line");
  32 }
  33
  34 # Check for duplicate -addext parameters, and one "working" case.
  35 my @addext_args = ( "openssl", "req", "-new", "-out", "testreq.pem",
  36     "-config", srctop_file("test", "test.cnf"), @req_new );
  37 my $val = "subjectAltName=DNS:example.com";
  38 my $val2 = " " . $val;
  39 my $val3 = $val;
  40 $val3 =~ s/=/    =/;
  41 ok( run(app([@addext_args, "-addext", $val])));
  42 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val])));
  43 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val2])));
  44 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val3])));
  45 ok(!run(app([@addext_args, "-addext", $val2, "-addext", $val3])));
  46
  47 subtest "generating alt certificate requests with RSA" => sub {
  48     plan tests => 3;
  49
  50     SKIP: {
  51         skip "RSA is not supported by this OpenSSL build", 2
  52             if disabled("rsa");
  53
  54         ok(run(app(["openssl", "req",
  55                     "-config", srctop_file("test", "test.cnf"),
  56                     "-section", "altreq",
  57                     "-new", "-out", "testreq-rsa.pem", "-utf8",
  58                     "-key", srctop_file("test", "testrsa.pem")])),
  59            "Generating request");
  60
  61         ok(run(app(["openssl", "req",
  62                     "-config", srctop_file("test", "test.cnf"),
  63                     "-verify", "-in", "testreq-rsa.pem", "-noout"])),
  64            "Verifying signature on request");
  65
  66         ok(run(app(["openssl", "req",
  67                     "-config", srctop_file("test", "test.cnf"),
  68                     "-section", "altreq",
  69                     "-verify", "-in", "testreq-rsa.pem", "-noout"])),
  70            "Verifying signature on request");
  71     }
  72 };
  73
  74
  75 subtest "generating certificate requests with RSA" => sub {
  76     plan tests => 2;
  77
  78     SKIP: {
  79         skip "RSA is not supported by this OpenSSL build", 2
  80             if disabled("rsa");
  81
  82         ok(run(app(["openssl", "req",
  83                     "-config", srctop_file("test", "test.cnf"),
  84                     "-new", "-out", "testreq-rsa.pem", "-utf8",
  85                     "-key", srctop_file("test", "testrsa.pem")])),
  86            "Generating request");
  87
  88         ok(run(app(["openssl", "req",
  89                     "-config", srctop_file("test", "test.cnf"),
  90                     "-verify", "-in", "testreq-rsa.pem", "-noout"])),
  91            "Verifying signature on request");
  92     }
  93 };
  94
  95 subtest "generating certificate requests with RSA-PSS" => sub {
  96     plan tests => 12;
  97
  98     SKIP: {
  99         skip "RSA is not supported by this OpenSSL build", 2
 100             if disabled("rsa");
 101
 102         ok(run(app(["openssl", "req",
 103                     "-config", srctop_file("test", "test.cnf"),
 104                     "-new", "-out", "testreq-rsapss.pem", "-utf8",
 105                     "-key", srctop_file("test", "testrsapss.pem")])),
 106            "Generating request");
 107         ok(run(app(["openssl", "req",
 108                     "-config", srctop_file("test", "test.cnf"),
 109                     "-verify", "-in", "testreq-rsapss.pem", "-noout"])),
 110            "Verifying signature on request");
 111
 112         ok(run(app(["openssl", "req",
 113                     "-config", srctop_file("test", "test.cnf"),
 114                     "-new", "-out", "testreq-rsapss2.pem", "-utf8",
 115                     "-sigopt", "rsa_padding_mode:pss",
 116                     "-sigopt", "rsa_pss_saltlen:-1",
 117                     "-key", srctop_file("test", "testrsapss.pem")])),
 118            "Generating request");
 119         ok(run(app(["openssl", "req",
 120                     "-config", srctop_file("test", "test.cnf"),
 121                     "-verify", "-in", "testreq-rsapss2.pem", "-noout"])),
 122            "Verifying signature on request");
 123
 124         ok(run(app(["openssl", "req",
 125                     "-config", srctop_file("test", "test.cnf"),
 126                     "-new", "-out", "testreq-rsapssmand.pem", "-utf8",
 127                     "-sigopt", "rsa_padding_mode:pss",
 128                     "-key", srctop_file("test", "testrsapssmandatory.pem")])),
 129            "Generating request");
 130         ok(run(app(["openssl", "req",
 131                     "-config", srctop_file("test", "test.cnf"),
 132                     "-verify", "-in", "testreq-rsapssmand.pem", "-noout"])),
 133            "Verifying signature on request");
 134
 135         ok(run(app(["openssl", "req",
 136                     "-config", srctop_file("test", "test.cnf"),
 137                     "-new", "-out", "testreq-rsapssmand2.pem", "-utf8",
 138                     "-sigopt", "rsa_pss_saltlen:100",
 139                     "-key", srctop_file("test", "testrsapssmandatory.pem")])),
 140            "Generating request");
 141         ok(run(app(["openssl", "req",
 142                     "-config", srctop_file("test", "test.cnf"),
 143                     "-verify", "-in", "testreq-rsapssmand2.pem", "-noout"])),
 144            "Verifying signature on request");
 145
 146         ok(!run(app(["openssl", "req",
 147                      "-config", srctop_file("test", "test.cnf"),
 148                      "-new", "-out", "testreq-rsapss3.pem", "-utf8",
 149                      "-sigopt", "rsa_padding_mode:pkcs1",
 150                      "-key", srctop_file("test", "testrsapss.pem")])),
 151            "Generating request with expected failure");
 152
 153         ok(!run(app(["openssl", "req",
 154                      "-config", srctop_file("test", "test.cnf"),
 155                      "-new", "-out", "testreq-rsapss3.pem", "-utf8",
 156                      "-sigopt", "rsa_pss_saltlen:-4",
 157                      "-key", srctop_file("test", "testrsapss.pem")])),
 158            "Generating request with expected failure");
 159
 160         ok(!run(app(["openssl", "req",
 161                      "-config", srctop_file("test", "test.cnf"),
 162                      "-new", "-out", "testreq-rsapssmand3.pem", "-utf8",
 163                      "-sigopt", "rsa_pss_saltlen:10",
 164                      "-key", srctop_file("test", "testrsapssmandatory.pem")])),
 165            "Generating request with expected failure");
 166
 167         ok(!run(app(["openssl", "req",
 168                      "-config", srctop_file("test", "test.cnf"),
 169                      "-new", "-out", "testreq-rsapssmand3.pem", "-utf8",
 170                      "-sha256",
 171                      "-key", srctop_file("test", "testrsapssmandatory.pem")])),
 172            "Generating request with expected failure");
 173     }
 174 };
 175
 176 subtest "generating certificate requests with DSA" => sub {
 177     plan tests => 2;
 178
 179     SKIP: {
 180         skip "DSA is not supported by this OpenSSL build", 2
 181             if disabled("dsa");
 182
 183         ok(run(app(["openssl", "req",
 184                     "-config", srctop_file("test", "test.cnf"),
 185                     "-new", "-out", "testreq-dsa.pem", "-utf8",
 186                     "-key", srctop_file("test", "testdsa.pem")])),
 187            "Generating request");
 188
 189         ok(run(app(["openssl", "req",
 190                     "-config", srctop_file("test", "test.cnf"),
 191                     "-verify", "-in", "testreq-dsa.pem", "-noout"])),
 192            "Verifying signature on request");
 193     }
 194 };
 195
 196 subtest "generating certificate requests with ECDSA" => sub {
 197     plan tests => 2;
 198
 199     SKIP: {
 200         skip "ECDSA is not supported by this OpenSSL build", 2
 201             if disabled("ec");
 202
 203         ok(run(app(["openssl", "req",
 204                     "-config", srctop_file("test", "test.cnf"),
 205                     "-new", "-out", "testreq-ec.pem", "-utf8",
 206                     "-key", srctop_file("test", "testec-p256.pem")])),
 207            "Generating request");
 208
 209         ok(run(app(["openssl", "req",
 210                     "-config", srctop_file("test", "test.cnf"),
 211                     "-verify", "-in", "testreq-ec.pem", "-noout"])),
 212            "Verifying signature on request");
 213     }
 214 };
 215
 216 subtest "generating certificate requests with Ed25519" => sub {
 217     plan tests => 2;
 218
 219     SKIP: {
 220         skip "Ed25519 is not supported by this OpenSSL build", 2
 221             if disabled("ec");
 222
 223         ok(run(app(["openssl", "req",
 224                     "-config", srctop_file("test", "test.cnf"),
 225                     "-new", "-out", "testreq-ed25519.pem", "-utf8",
 226                     "-key", srctop_file("test", "tested25519.pem")])),
 227            "Generating request");
 228
 229         ok(run(app(["openssl", "req",
 230                     "-config", srctop_file("test", "test.cnf"),
 231                     "-verify", "-in", "testreq-ed25519.pem", "-noout"])),
 232            "Verifying signature on request");
 233     }
 234 };
 235
 236 subtest "generating certificate requests with Ed448" => sub {
 237     plan tests => 2;
 238
 239     SKIP: {
 240         skip "Ed448 is not supported by this OpenSSL build", 2
 241             if disabled("ec");
 242
 243         ok(run(app(["openssl", "req",
 244                     "-config", srctop_file("test", "test.cnf"),
 245                     "-new", "-out", "testreq-ed448.pem", "-utf8",
 246                     "-key", srctop_file("test", "tested448.pem")])),
 247            "Generating request");
 248
 249         ok(run(app(["openssl", "req",
 250                     "-config", srctop_file("test", "test.cnf"),
 251                     "-verify", "-in", "testreq-ed448.pem", "-noout"])),
 252            "Verifying signature on request");
 253     }
 254 };
 255
 256 subtest "generating certificate requests" => sub {
 257     plan tests => 2;
 258
 259     ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
 260                 @req_new, "-out", "testreq.pem"])),
 261        "Generating request");
 262
 263     ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
 264                 "-verify", "-in", "testreq.pem", "-noout"])),
 265        "Verifying signature on request");
 266 };
 267
 268 subtest "generating SM2 certificate requests" => sub {
 269     plan tests => 4;
 270
 271     SKIP: {
 272         skip "SM2 is not supported by this OpenSSL build", 4
 273         if disabled("sm2");
 274         ok(run(app(["openssl", "req",
 275                     "-config", srctop_file("test", "test.cnf"),
 276                     "-new", "-key", srctop_file(@certs, "sm2.key"),
 277                     "-sigopt", "distid:1234567812345678",
 278                     "-out", "testreq-sm2.pem", "-sm3"])),
 279            "Generating SM2 certificate request");
 280
 281         ok(run(app(["openssl", "req",
 282                     "-config", srctop_file("test", "test.cnf"),
 283                     "-verify", "-in", "testreq-sm2.pem", "-noout",
 284                     "-vfyopt", "distid:1234567812345678", "-sm3"])),
 285            "Verifying signature on SM2 certificate request");
 286
 287         ok(run(app(["openssl", "req",
 288                     "-config", srctop_file("test", "test.cnf"),
 289                     "-new", "-key", srctop_file(@certs, "sm2.key"),
 290                     "-sigopt", "hexdistid:DEADBEEF",
 291                     "-out", "testreq-sm2.pem", "-sm3"])),
 292            "Generating SM2 certificate request with hex id");
 293
 294         ok(run(app(["openssl", "req",
 295                     "-config", srctop_file("test", "test.cnf"),
 296                     "-verify", "-in", "testreq-sm2.pem", "-noout",
 297                     "-vfyopt", "hexdistid:DEADBEEF", "-sm3"])),
 298            "Verifying signature on SM2 certificate request");
 299     }
 300 };
 301
 302 my @openssl_args = ("req", "-config", srctop_file("apps", "openssl.cnf"));
 303
 304 run_conversion('req conversions',
 305                "testreq.pem");
 306 run_conversion('req conversions -- testreq2',
 307                srctop_file("test", "testreq2.pem"));
 308
 309 sub run_conversion {
 310     my $title = shift;
 311     my $reqfile = shift;
 312
 313     subtest $title => sub {
 314         run(app(["openssl", @openssl_args,
 315                  "-in", $reqfile, "-inform", "p",
 316                  "-noout", "-text"],
 317                 stderr => "req-check.err", stdout => undef));
 318         open DATA, "req-check.err";
 319         SKIP: {
 320             plan skip_all => "skipping req conversion test for $reqfile"
 321                 if grep /Unknown Public Key/, map { s/\R//; } <DATA>;
 322
 323             tconversion( -type => 'req', -in => $reqfile,
 324                          -args => [ @openssl_args ] );
 325         }
 326         close DATA;
 327         unlink "req-check.err";
 328
 329         done_testing();
 330     };
 331 }
 332
 333 # Test both generation and verification of certs w.r.t. RFC 5280 requirements
 334
 335 my $ca_cert; # will be set below
 336 sub generate_cert {
 337     my $cert = shift @_;
 338     my $ss = $cert =~ m/self-signed/;
 339     my $is_ca = $cert =~ m/CA/;
 340     my $cn = $is_ca ? "CA" : "EE";
 341     my $ca_key = srctop_file(@certs, "ca-key.pem");
 342     my $key = $is_ca ? $ca_key : srctop_file(@certs, "ee-key.pem");
 343     my @cmd = ("openssl", "req", "-config", "\"\"", "-x509",
 344                "-key", $key, "-subj", "/CN=$cn", @_, "-out", $cert);
 345     push(@cmd, ("-CA", $ca_cert, "-CAkey", $ca_key)) unless $ss;
 346     ok(run(app([@cmd])), "generate $cert");
 347 }
 348 sub has_SKID {
 349     my $cert = shift @_;
 350     my $expect = shift @_;
 351     cert_contains($cert, "Subject Key Identifier", $expect);
 352 }
 353 sub has_AKID {
 354     my $cert = shift @_;
 355     my $expect = shift @_;
 356     cert_contains($cert, "Authority Key Identifier", $expect);
 357 }
 358 sub has_keyUsage {
 359     my $cert = shift @_;
 360     my $expect = shift @_;
 361     cert_contains($cert, "Key Usage", $expect);
 362 }
 363 sub strict_verify {
 364     my $cert = shift @_;
 365     my $expect = shift @_;
 366     my $trusted = shift @_;
 367     $trusted = $cert unless $trusted;
 368     ok(run(app(["openssl", "verify", "-x509_strict", "-trusted", $trusted,
 369                 "-partial_chain", $cert])) == $expect,
 370        "strict verify allow $cert");
 371 }
 372
 373 my @v3_ca = ("-addext", "basicConstraints = critical,CA:true",
 374              "-addext", "keyUsage = keyCertSign");
 375 my $SKID_AKID = "subjectKeyIdentifier,authorityKeyIdentifier";
 376 my $cert = "self-signed_v1_CA_no_KIDs.pem";
 377 generate_cert($cert);
 378 cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
 379 #TODO strict_verify($cert, 1); # self-signed v1 root cert should be accepted as CA
 380
 381 $ca_cert = "self-signed_v3_CA_default_SKID.pem";
 382 generate_cert($ca_cert, @v3_ca);
 383 has_SKID($ca_cert, 1);
 384 has_AKID($ca_cert, 0);
 385 strict_verify($ca_cert, 1);
 386
 387 $cert = "self-signed_v3_CA_no_SKID.pem";
 388 generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = none");
 389 cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
 390 #TODO strict_verify($cert, 0);
 391
 392 $cert = "self-signed_v3_CA_both_KIDs.pem";
 393 generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = hash",
 394             "-addext", "authorityKeyIdentifier = keyid");
 395 cert_ext_has_n_different_lines($cert, 3, $SKID_AKID); # SKID == AKID
 396 strict_verify($cert, 1);
 397
 398 $cert = "self-signed_v3_EE_wrong_keyUsage.pem";
 399 generate_cert($cert, "-addext", "keyUsage = keyCertSign");
 400 #TODO strict_verify($cert, 1); # should be accepted because RFC 5280 does not apply
 401
 402 $cert = "v3_EE_default_KIDs.pem";
 403 generate_cert($cert, "-addext", "keyUsage = dataEncipherment");
 404 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
 405 strict_verify($cert, 1, $ca_cert);
 406
 407 $cert = "v3_EE_no_AKID.pem";
 408 generate_cert($cert, "-addext", "authorityKeyIdentifier = none");
 409 has_SKID($cert, 1);
 410 has_AKID($cert, 0);
 411 strict_verify($cert, 0, $ca_cert);
 412
 413 $cert = "self-issued_v3_EE_default_KIDs.pem";
 414 generate_cert($cert, "-addext", "keyUsage = dataEncipherment",
 415     "-in", srctop_file(@certs, "x509-check.csr"));
 416 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
 417 strict_verify($cert, 1);
 418
 419 my $cert = "self-signed_CA_no_keyUsage.pem";
 420 generate_cert($cert, "-in", srctop_file(@certs, "ext-check.csr"));
 421 has_keyUsage($cert, 0);
 422 my $cert = "self-signed_CA_with_keyUsages.pem";
 423 generate_cert($cert, "-in", srctop_file(@certs, "ext-check.csr"),
 424     "-copy_extensions", "copy");
 425 has_keyUsage($cert, 1);