Home | History | Annotate | Line # | Download | only in recipes
25-test_x509.t revision 1.1.1.3 
      1 #! /usr/bin/env perl
      2 # Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved.
      3 #
      4 # Licensed under the OpenSSL license (the "License").  You may not use
      5 # this file except in compliance with the License.  You can obtain a copy
      6 # in the file LICENSE in the source distribution or at
      7 # https://www.openssl.org/source/license.html
      8 
      9 
     10 use strict;
     11 use warnings;
     12 
     13 use File::Spec;
     14 use OpenSSL::Test qw/:DEFAULT srctop_file/;
     15 
     16 setup("test_x509");
     17 
     18 plan tests => 16;
     19 
     20 # Prevent MSys2 filename munging for arguments that look like file paths but
     21 # aren't
     22 $ENV{MSYS2_ARG_CONV_EXCL} = "/CN=";
     23 
     24 require_ok(srctop_file('test','recipes','tconversion.pl'));
     25 
     26 my $pem = srctop_file("test/certs", "cyrillic.pem");
     27 my $out = "cyrillic.out";
     28 my $msb = srctop_file("test/certs", "cyrillic.msb");
     29 my $utf = srctop_file("test/certs", "cyrillic.utf8");
     30 
     31 ok(run(app(["openssl", "x509", "-text", "-in", $pem, "-out", $out,
     32             "-nameopt", "esc_msb"])));
     33 is(cmp_text($out, srctop_file("test/certs", "cyrillic.msb")),
     34    0, 'Comparing esc_msb output');
     35 ok(run(app(["openssl", "x509", "-text", "-in", $pem, "-out", $out,
     36             "-nameopt", "utf8"])));
     37 is(cmp_text($out, srctop_file("test/certs", "cyrillic.utf8")),
     38    0, 'Comparing utf8 output');
     39 unlink $out;
     40 
     41 subtest 'x509 -- x.509 v1 certificate' => sub {
     42     tconversion("x509", srctop_file("test","testx509.pem"));
     43 };
     44 subtest 'x509 -- first x.509 v3 certificate' => sub {
     45     tconversion("x509", srctop_file("test","v3-cert1.pem"));
     46 };
     47 subtest 'x509 -- second x.509 v3 certificate' => sub {
     48     tconversion("x509", srctop_file("test","v3-cert2.pem"));
     49 };
     50 
     51 subtest 'x509 -- pathlen' => sub {
     52     ok(run(test(["v3ext", srctop_file("test/certs", "pathlen.pem")])));
     53 };
     54 
     55 # extracts issuer from a -text formatted-output
     56 sub get_issuer {
     57     my $f = shift(@_);
     58     my $issuer = "";
     59     open my $fh, $f or die;
     60     while (my $line = <$fh>) {
     61         if ($line =~ /Issuer:/) {
     62             $issuer = $line;
     63         }
     64     }
     65     close $fh;
     66     return $issuer;
     67 }
     68 
     69 # Tests for signing certs (broken in 1.1.1o)
     70 my $a_key = "a-key.pem";
     71 my $a_cert = "a-cert.pem";
     72 my $a2_cert = "a2-cert.pem";
     73 my $ca_key = "ca-key.pem";
     74 my $ca_cert = "ca-cert.pem";
     75 my $cnf = srctop_file('apps', 'openssl.cnf');
     76 
     77 # Create cert A
     78 ok(run(app(["openssl", "req", "-x509", "-newkey", "rsa:2048",
     79             "-config", $cnf,
     80             "-keyout", $a_key, "-out", $a_cert, "-days", "365",
     81             "-nodes", "-subj", "/CN=test.example.com"])));
     82 # Create cert CA - note key size
     83 ok(run(app(["openssl", "req", "-x509", "-newkey", "rsa:4096",
     84             "-config", $cnf,
     85             "-keyout", $ca_key, "-out", $ca_cert, "-days", "3650",
     86             "-nodes", "-subj", "/CN=ca.example.com"])));
     87 # Sign cert A with CA (errors on 1.1.1o)
     88 ok(run(app(["openssl", "x509", "-in", $a_cert, "-CA", $ca_cert,
     89             "-CAkey", $ca_key, "-set_serial", "1234567890",
     90             "-preserve_dates", "-sha256", "-text", "-out", $a2_cert])));
     91 # verify issuer is CA
     92 ok (get_issuer($a2_cert) =~ /CN = ca.example.com/);
     93 
     94 # Tests for issue #16080 (fixed in 1.1.1o)
     95 my $b_key = "b-key.pem";
     96 my $b_csr = "b-cert.csr";
     97 my $b_cert = "b-cert.pem";
     98 # Create the CSR
     99 ok(run(app(["openssl", "req", "-new", "-newkey", "rsa:4096",
    100             "-keyout", $b_key, "-out", $b_csr, "-nodes",
    101             "-config", $cnf,
    102             "-subj", "/CN=b.example.com"])));
    103 # Sign it - position of "-text" matters!
    104 ok(run(app(["openssl", "x509", "-req", "-text", "-CAcreateserial",
    105             "-CA", $ca_cert, "-CAkey", $ca_key,
    106             "-in", $b_csr, "-out", $b_cert])));
    107 # Verify issuer is CA
    108 ok(get_issuer($b_cert) =~ /CN = ca.example.com/);
    109