103a7aea0eafd19ec742c32d7b80de975a8e5dca
[openssl.git] / test / recipes / 80-test_ocsp.t
1 #! /usr/bin/env perl
2 # Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
3 #
4 # Licensed under the OpenSSL license (the "License").  You may not use
5 # this file except in compliance with the License.  You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
8
9
10 use strict;
11 use warnings;
12
13 use POSIX;
14 use File::Spec::Functions qw/devnull catfile/;
15 use File::Copy;
16 use OpenSSL::Test qw/:DEFAULT with pipe srctop_dir/;
17 use OpenSSL::Test::Utils;
18
19 setup("test_ocsp");
20
21 plan skip_all => "OCSP is not supported by this OpenSSL build"
22     if disabled("ocsp");
23
24 my $ocspdir=srctop_dir("test", "ocsp-tests");
25 # 17 December 2012 so we don't get certificate expiry errors.
26 my @check_time=("-attime", "1355875200");
27
28 sub test_ocsp {
29     my $title = shift;
30     my $inputfile = shift;
31     my $CAfile = shift;
32     my $expected_exit = shift;
33
34     run(app(["openssl", "base64", "-d",
35              "-in", catfile($ocspdir,$inputfile),
36              "-out", "ocsp-resp-fff.dat"]));
37     with({ exit_checker => sub { return shift == $expected_exit; } },
38          sub { ok(run(app(["openssl", "ocsp", "-respin", "ocsp-resp-fff.dat",
39                            "-partial_chain", @check_time,
40                            "-CAfile", catfile($ocspdir, $CAfile),
41                            "-verify_other", catfile($ocspdir, $CAfile),
42                            "-no-CApath"])),
43                   $title); });
44     unlink "ocsp-resp-fff.dat";
45 }
46
47 plan tests => 10;
48
49 subtest "=== VALID OCSP RESPONSES ===" => sub {
50     plan tests => 6;
51
52     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
53               "ND1.ors", "ND1_Issuer_ICA.pem", 0);
54     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
55               "ND2.ors", "ND2_Issuer_Root.pem", 0);
56     test_ocsp("NON-DELEGATED; Root CA -> EE",
57               "ND3.ors", "ND3_Issuer_Root.pem", 0);
58     test_ocsp("DELEGATED; Intermediate CA -> EE",
59               "D1.ors", "D1_Issuer_ICA.pem", 0);
60     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
61               "D2.ors", "D2_Issuer_Root.pem", 0);
62     test_ocsp("DELEGATED; Root CA -> EE",
63               "D3.ors", "D3_Issuer_Root.pem", 0);
64 };
65
66 subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
67     plan tests => 6;
68
69     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
70               "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", 1);
71     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
72               "ISOP_ND2.ors", "ND2_Issuer_Root.pem", 1);
73     test_ocsp("NON-DELEGATED; Root CA -> EE",
74               "ISOP_ND3.ors", "ND3_Issuer_Root.pem", 1);
75     test_ocsp("DELEGATED; Intermediate CA -> EE",
76               "ISOP_D1.ors", "D1_Issuer_ICA.pem", 1);
77     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
78               "ISOP_D2.ors", "D2_Issuer_Root.pem", 1);
79     test_ocsp("DELEGATED; Root CA -> EE",
80               "ISOP_D3.ors", "D3_Issuer_Root.pem", 1);
81 };
82
83 subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
84     plan tests => 6;
85
86     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
87               "WRID_ND1.ors", "ND1_Issuer_ICA.pem", 1);
88     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
89               "WRID_ND2.ors", "ND2_Issuer_Root.pem", 1);
90     test_ocsp("NON-DELEGATED; Root CA -> EE",
91               "WRID_ND3.ors", "ND3_Issuer_Root.pem", 1);
92     test_ocsp("DELEGATED; Intermediate CA -> EE",
93               "WRID_D1.ors", "D1_Issuer_ICA.pem", 1);
94     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
95               "WRID_D2.ors", "D2_Issuer_Root.pem", 1);
96     test_ocsp("DELEGATED; Root CA -> EE",
97               "WRID_D3.ors", "D3_Issuer_Root.pem", 1);
98 };
99
100 subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
101     plan tests => 6;
102
103     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
104               "WINH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
105     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
106               "WINH_ND2.ors", "ND2_Issuer_Root.pem", 1);
107     test_ocsp("NON-DELEGATED; Root CA -> EE",
108               "WINH_ND3.ors", "ND3_Issuer_Root.pem", 1);
109     test_ocsp("DELEGATED; Intermediate CA -> EE",
110               "WINH_D1.ors", "D1_Issuer_ICA.pem", 1);
111     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
112               "WINH_D2.ors", "D2_Issuer_Root.pem", 1);
113     test_ocsp("DELEGATED; Root CA -> EE",
114               "WINH_D3.ors", "D3_Issuer_Root.pem", 1);
115 };
116
117 subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
118     plan tests => 6;
119
120     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
121               "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
122     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
123               "WIKH_ND2.ors", "ND2_Issuer_Root.pem", 1);
124     test_ocsp("NON-DELEGATED; Root CA -> EE",
125               "WIKH_ND3.ors", "ND3_Issuer_Root.pem", 1);
126     test_ocsp("DELEGATED; Intermediate CA -> EE",
127               "WIKH_D1.ors", "D1_Issuer_ICA.pem", 1);
128     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
129               "WIKH_D2.ors", "D2_Issuer_Root.pem", 1);
130     test_ocsp("DELEGATED; Root CA -> EE",
131               "WIKH_D3.ors", "D3_Issuer_Root.pem", 1);
132 };
133
134 subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
135     plan tests => 3;
136
137     test_ocsp("DELEGATED; Intermediate CA -> EE",
138               "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
139     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
140               "WKDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
141     test_ocsp("DELEGATED; Root CA -> EE",
142               "WKDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
143 };
144
145 subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
146     plan tests => 3;
147
148     test_ocsp("DELEGATED; Intermediate CA -> EE",
149               "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
150     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
151               "ISDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
152     test_ocsp("DELEGATED; Root CA -> EE",
153               "ISDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
154 };
155
156 subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
157     plan tests => 6;
158
159     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
160               "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", 1);
161     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
162               "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", 1);
163     test_ocsp("NON-DELEGATED; Root CA -> EE",
164               "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", 1);
165     test_ocsp("DELEGATED; Intermediate CA -> EE",
166               "D1.ors", "WSNIC_D1_Issuer_ICA.pem", 1);
167     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
168               "D2.ors", "WSNIC_D2_Issuer_Root.pem", 1);
169     test_ocsp("DELEGATED; Root CA -> EE",
170               "D3.ors", "WSNIC_D3_Issuer_Root.pem", 1);
171 };
172
173 subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
174     plan tests => 6;
175
176     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
177               "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", 1);
178     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
179               "ND2.ors", "WKIC_ND2_Issuer_Root.pem", 1);
180     test_ocsp("NON-DELEGATED; Root CA -> EE",
181               "ND3.ors", "WKIC_ND3_Issuer_Root.pem", 1);
182     test_ocsp("DELEGATED; Intermediate CA -> EE",
183               "D1.ors", "WKIC_D1_Issuer_ICA.pem", 1);
184     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
185               "D2.ors", "WKIC_D2_Issuer_Root.pem", 1);
186     test_ocsp("DELEGATED; Root CA -> EE",
187               "D3.ors", "WKIC_D3_Issuer_Root.pem", 1);
188 };
189
190 subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
191     plan tests => 6;
192
193     # Expect success, because we're explicitly trusting the issuer certificate.
194     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
195               "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", 0);
196     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
197               "ND2.ors", "ISIC_ND2_Issuer_Root.pem", 0);
198     test_ocsp("NON-DELEGATED; Root CA -> EE",
199               "ND3.ors", "ISIC_ND3_Issuer_Root.pem", 0);
200     test_ocsp("DELEGATED; Intermediate CA -> EE",
201               "D1.ors", "ISIC_D1_Issuer_ICA.pem", 0);
202     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
203               "D2.ors", "ISIC_D2_Issuer_Root.pem", 0);
204     test_ocsp("DELEGATED; Root CA -> EE",
205               "D3.ors", "ISIC_D3_Issuer_Root.pem", 0);
206 };