2 # Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
12 use OpenSSL::Test qw/:DEFAULT srctop_file with/;
13 use OpenSSL::Test::Utils;
19 my $pass = "σύνθημα γνώρισμα";
22 if (eval { require Win32::API; 1; }) {
23 # Trouble is that Win32 perl uses CreateProcessA, which
24 # makes it problematic to pass non-ASCII arguments, from perl[!]
25 # that is. This is because CreateProcessA is just a wrapper for
26 # CreateProcessW and will call MultiByteToWideChar and use
27 # system default locale. Since we attempt Greek pass-phrase
28 # conversion can be done only with Greek locale.
30 Win32::API->Import("kernel32","UINT GetSystemDefaultLCID()");
31 if (GetSystemDefaultLCID() != 0x408) {
32 plan skip_all => "Non-Greek system locale";
34 # Ensure correct code page so that VERBOSE output is right.
35 Win32::API->Import("kernel32","UINT GetConsoleOutputCP()");
36 Win32::API->Import("kernel32","BOOL SetConsoleOutputCP(UINT cp)");
37 $savedcp = GetConsoleOutputCP();
38 SetConsoleOutputCP(1253);
39 $pass = Encode::encode("cp1253",Encode::decode("utf-8",$pass));
41 } elsif ($^O eq "MSWin32") {
42 plan skip_all => "Win32::API unavailable";
43 } elsif ($^O ne "VMS") {
44 # Running MinGW tests transparently under Wine apparently requires
47 foreach(`locale -a`) {
49 if ($_ =~ m/^C\.UTF\-?8/i) {
55 $ENV{OPENSSL_WIN32_UTF8}=1;
59 # Test different PKCS#12 formats
60 ok(run(test(["pkcs12_format_test"])), "test pkcs12 formats");
61 # Test with legacy APIs
62 ok(run(test(["pkcs12_format_test", "-legacy"])), "test pkcs12 formats using legacy APIs");
63 # Test with a non-default library context (and no loaded providers in the default context)
64 ok(run(test(["pkcs12_format_test", "-context"])), "test pkcs12 formats using a non-default library context");
67 skip "VMS doesn't have command line UTF-8 support yet in DCL", 1
70 # just see that we can read shibboleth.pfx protected with $pass
71 ok(run(app(["openssl", "pkcs12", "-noout",
72 "-password", "pass:$pass",
73 "-in", srctop_file("test", "shibboleth.pfx")])),
74 "test_load_cert_pkcs12");
77 my @path = qw(test certs);
78 my $outfile1 = "out1.p12";
79 my $outfile2 = "out2.p12";
80 my $outfile3 = "out3.p12";
81 my $outfile4 = "out4.p12";
82 my $outfile5 = "out5.p12";
83 my $outfile6 = "out6.p12";
84 my $outfile7 = "out7.p12";
86 # Test the -chain option with -untrusted
87 ok(run(app(["openssl", "pkcs12", "-export", "-chain",
88 "-CAfile", srctop_file(@path, "sroot-cert.pem"),
89 "-untrusted", srctop_file(@path, "ca-cert.pem"),
90 "-in", srctop_file(@path, "ee-cert.pem"),
91 "-nokeys", "-passout", "pass:", "-out", $outfile1])),
92 "test_pkcs12_chain_untrusted");
94 # Test the -passcerts option
96 skip "Skipping PKCS#12 test because DES is disabled in this build", 1
98 ok(run(app(["openssl", "pkcs12", "-export",
99 "-in", srctop_file(@path, "ee-cert.pem"),
100 "-certfile", srctop_file(@path, "v3-certs-TDES.p12"),
101 "-passcerts", "pass:v3-certs",
102 "-nokeys", "-passout", "pass:v3-certs", "-descert",
103 "-out", $outfile2])),
104 "test_pkcs12_passcerts");
108 skip "Skipping legacy PKCS#12 test because the required algorithms are disabled", 1
109 if disabled("des") || disabled("rc2") || disabled("legacy");
110 # Test reading legacy PKCS#12 file
111 ok(run(app(["openssl", "pkcs12", "-export",
112 "-in", srctop_file(@path, "v3-certs-RC2.p12"),
113 "-passin", "pass:v3-certs",
114 "-provider", "default", "-provider", "legacy",
115 "-nokeys", "-passout", "pass:v3-certs", "-descert",
116 "-out", $outfile3])),
117 "test_pkcs12_passcerts_legacy");
120 # Test export of PEM file with both cert and key
121 # -nomac necessary to avoid legacy provider requirement
122 ok(run(app(["openssl", "pkcs12", "-export",
123 "-inkey", srctop_file(@path, "cert-key-cert.pem"),
124 "-in", srctop_file(@path, "cert-key-cert.pem"),
125 "-passout", "pass:v3-certs",
126 "-nomac", "-out", $outfile4], stderr => "outerr.txt")),
127 "test_export_pkcs12_cert_key_cert");
128 open DATA, "outerr.txt";
129 my @match = grep /:error:/, <DATA>;
131 ok(scalar @match > 0 ? 0 : 1, "test_export_pkcs12_outerr_empty");
133 ok(run(app(["openssl", "pkcs12",
135 "-passin", "pass:v3-certs",
136 "-nomacver", "-nodes"])),
137 "test_import_pkcs12_cert_key_cert");
139 ok(run(app(["openssl", "pkcs12", "-export", "-out", $outfile5,
140 "-in", srctop_file(@path, "ee-cert.pem"), "-caname", "testname",
141 "-nokeys", "-passout", "pass:", "-certpbe", "NONE"])),
142 "test nokeys single cert");
144 my @pkcs12info = run(app(["openssl", "pkcs12", "-info", "-in", $outfile5,
145 "-passin", "pass:"]), capture => 1);
147 # Test that with one input certificate, we get one output certificate
148 ok(grep(/subject=CN\s*=\s*server.example/, @pkcs12info) == 1,
149 "test one cert in output");
151 # Test that the expected friendly name is present in the output
152 ok(grep(/testname/, @pkcs12info) == 1, "test friendly name in output");
154 # Test there's no Oracle Trusted Key Usage bag attribute
155 ok(grep(/Trusted key usage (Oracle)/, @pkcs12info) == 0,
156 "test no oracle trusted key usage");
158 # Test export of PEM file with both cert and key, without password.
159 # -nomac necessary to avoid legacy provider requirement
161 ok(run(app(["openssl", "pkcs12", "-export",
162 "-inkey", srctop_file(@path, "cert-key-cert.pem"),
163 "-in", srctop_file(@path, "cert-key-cert.pem"),
165 "-nomac", "-out", $outfile6], stderr => "outerr6.txt")),
166 "test_export_pkcs12_cert_key_cert_no_pass");
167 open DATA, "outerr6.txt";
168 my @match = grep /:error:/, <DATA>;
170 ok(scalar @match > 0 ? 0 : 1, "test_export_pkcs12_outerr6_empty");
173 # Test some bad pkcs12 files
174 my $bad1 = srctop_file("test", "recipes", "80-test_pkcs12_data", "bad1.p12");
175 my $bad2 = srctop_file("test", "recipes", "80-test_pkcs12_data", "bad2.p12");
176 my $bad3 = srctop_file("test", "recipes", "80-test_pkcs12_data", "bad3.p12");
178 with({ exit_checker => sub { return shift == 1; } },
180 ok(run(app(["openssl", "pkcs12", "-in", $bad1, "-password", "pass:"])),
181 "test bad pkcs12 file 1");
183 ok(run(app(["openssl", "pkcs12", "-in", $bad1, "-password", "pass:",
185 "test bad pkcs12 file 1 (nomacver)");
187 ok(run(app(["openssl", "pkcs12", "-in", $bad1, "-password", "pass:",
189 "test bad pkcs12 file 1 (info)");
191 ok(run(app(["openssl", "pkcs12", "-in", $bad2, "-password", "pass:"])),
192 "test bad pkcs12 file 2");
194 ok(run(app(["openssl", "pkcs12", "-in", $bad2, "-password", "pass:",
196 "test bad pkcs12 file 2 (info)");
198 ok(run(app(["openssl", "pkcs12", "-in", $bad3, "-password", "pass:"])),
199 "test bad pkcs12 file 3");
201 ok(run(app(["openssl", "pkcs12", "-in", $bad3, "-password", "pass:",
203 "test bad pkcs12 file 3 (info)");
206 # Test with Oracle Trusted Key Usage specified in openssl.cnf
208 ok(run(app(["openssl", "pkcs12", "-export", "-out", $outfile7,
209 "-jdktrust", "anyExtendedKeyUsage", "-in", srctop_file(@path, "ee-cert.pem"),
210 "-nokeys", "-passout", "pass:", "-certpbe", "NONE"])),
211 "test nokeys single cert");
213 my @pkcs12info = run(app(["openssl", "pkcs12", "-info", "-in", $outfile7,
214 "-passin", "pass:"]), capture => 1);
215 ok(grep(/Trusted key usage \(Oracle\): Any Extended Key Usage \(2.5.29.37.0\)/, @pkcs12info) == 1,
216 "test oracle trusted key usage is set");
218 delete $ENV{OPENSSL_CONF}
221 # Tests for pkcs12_parse
222 ok(run(test(["pkcs12_api_test",
225 ])), "Test pkcs12_parse()");
228 skip "Skipping PKCS#12 parse test because DES is disabled in this build", 1
230 ok(run(test(["pkcs12_api_test",
234 ])), "Test pkcs12_parse()");
238 skip "Skipping PKCS#12 parse test because the required algorithms are disabled", 1
239 if disabled("des") || disabled("rc2") || disabled("legacy");
240 ok(run(test(["pkcs12_api_test",
244 ])), "Test pkcs12_parse()");
247 ok(run(test(["pkcs12_api_test",
253 ])), "Test pkcs12_parse()");
255 ok(run(test(["pkcs12_api_test",
258 ])), "Test pkcs12_parse()");
260 ok(run(test(["pkcs12_api_test",
266 ])), "Test pkcs12_parse()");
268 SetConsoleOutputCP($savedcp) if (defined($savedcp));