blob: 5fc291ca6eeb72a97eb9b274f7750b2dc2d2a279 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
|
#!/bin/sh
cmd='../util/shlib_wrap.sh ../apps/openssl'
ocspdir="ocsp-tests"
# 17 December 2012 so we don't get certificate expiry errors.
check_time="-attime 1355875200"
test_ocsp () {
$cmd base64 -d -in $ocspdir/$1 | \
$cmd ocsp -respin - -partial_chain $check_time \
-CAfile $ocspdir/$2 -verify_other $ocspdir/$2 -CApath /dev/null
[ $? != $3 ] && exit 1
}
echo "=== VALID OCSP RESPONSES ==="
echo "NON-DELEGATED; Intermediate CA -> EE"
test_ocsp ND1.ors ND1_Issuer_ICA.pem 0
echo "NON-DELEGATED; Root CA -> Intermediate CA"
test_ocsp ND2.ors ND2_Issuer_Root.pem 0
echo "NON-DELEGATED; Root CA -> EE"
test_ocsp ND3.ors ND3_Issuer_Root.pem 0
echo "DELEGATED; Intermediate CA -> EE"
test_ocsp D1.ors D1_Issuer_ICA.pem 0
echo "DELEGATED; Root CA -> Intermediate CA"
test_ocsp D2.ors D2_Issuer_Root.pem 0
echo "DELEGATED; Root CA -> EE"
test_ocsp D3.ors D3_Issuer_Root.pem 0
echo "=== INVALID SIGNATURE on the OCSP RESPONSE ==="
echo "NON-DELEGATED; Intermediate CA -> EE"
test_ocsp ISOP_ND1.ors ND1_Issuer_ICA.pem 1
echo "NON-DELEGATED; Root CA -> Intermediate CA"
test_ocsp ISOP_ND2.ors ND2_Issuer_Root.pem 1
echo "NON-DELEGATED; Root CA -> EE"
test_ocsp ISOP_ND3.ors ND3_Issuer_Root.pem 1
echo "DELEGATED; Intermediate CA -> EE"
test_ocsp ISOP_D1.ors D1_Issuer_ICA.pem 1
echo "DELEGATED; Root CA -> Intermediate CA"
test_ocsp ISOP_D2.ors D2_Issuer_Root.pem 1
echo "DELEGATED; Root CA -> EE"
test_ocsp ISOP_D3.ors D3_Issuer_Root.pem 1
echo "=== WRONG RESPONDERID in the OCSP RESPONSE ==="
echo "NON-DELEGATED; Intermediate CA -> EE"
test_ocsp WRID_ND1.ors ND1_Issuer_ICA.pem 1
echo "NON-DELEGATED; Root CA -> Intermediate CA"
test_ocsp WRID_ND2.ors ND2_Issuer_Root.pem 1
echo "NON-DELEGATED; Root CA -> EE"
test_ocsp WRID_ND3.ors ND3_Issuer_Root.pem 1
echo "DELEGATED; Intermediate CA -> EE"
test_ocsp WRID_D1.ors D1_Issuer_ICA.pem 1
echo "DELEGATED; Root CA -> Intermediate CA"
test_ocsp WRID_D2.ors D2_Issuer_Root.pem 1
echo "DELEGATED; Root CA -> EE"
test_ocsp WRID_D3.ors D3_Issuer_Root.pem 1
echo "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ==="
echo "NON-DELEGATED; Intermediate CA -> EE"
test_ocsp WINH_ND1.ors ND1_Issuer_ICA.pem 1
echo "NON-DELEGATED; Root CA -> Intermediate CA"
test_ocsp WINH_ND2.ors ND2_Issuer_Root.pem 1
echo "NON-DELEGATED; Root CA -> EE"
test_ocsp WINH_ND3.ors ND3_Issuer_Root.pem 1
echo "DELEGATED; Intermediate CA -> EE"
test_ocsp WINH_D1.ors D1_Issuer_ICA.pem 1
echo "DELEGATED; Root CA -> Intermediate CA"
test_ocsp WINH_D2.ors D2_Issuer_Root.pem 1
echo "DELEGATED; Root CA -> EE"
test_ocsp WINH_D3.ors D3_Issuer_Root.pem 1
echo "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ==="
echo "NON-DELEGATED; Intermediate CA -> EE"
test_ocsp WIKH_ND1.ors ND1_Issuer_ICA.pem 1
echo "NON-DELEGATED; Root CA -> Intermediate CA"
test_ocsp WIKH_ND2.ors ND2_Issuer_Root.pem 1
echo "NON-DELEGATED; Root CA -> EE"
test_ocsp WIKH_ND3.ors ND3_Issuer_Root.pem 1
echo "DELEGATED; Intermediate CA -> EE"
test_ocsp WIKH_D1.ors D1_Issuer_ICA.pem 1
echo "DELEGATED; Root CA -> Intermediate CA"
test_ocsp WIKH_D2.ors D2_Issuer_Root.pem 1
echo "DELEGATED; Root CA -> EE"
test_ocsp WIKH_D3.ors D3_Issuer_Root.pem 1
echo "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ==="
echo "DELEGATED; Intermediate CA -> EE"
test_ocsp WKDOSC_D1.ors D1_Issuer_ICA.pem 1
echo "DELEGATED; Root CA -> Intermediate CA"
test_ocsp WKDOSC_D2.ors D2_Issuer_Root.pem 1
echo "DELEGATED; Root CA -> EE"
test_ocsp WKDOSC_D3.ors D3_Issuer_Root.pem 1
echo "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ==="
echo "DELEGATED; Intermediate CA -> EE"
test_ocsp ISDOSC_D1.ors D1_Issuer_ICA.pem 1
echo "DELEGATED; Root CA -> Intermediate CA"
test_ocsp ISDOSC_D2.ors D2_Issuer_Root.pem 1
echo "DELEGATED; Root CA -> EE"
test_ocsp ISDOSC_D3.ors D3_Issuer_Root.pem 1
echo "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ==="
echo "NON-DELEGATED; Intermediate CA -> EE"
test_ocsp ND1.ors WSNIC_ND1_Issuer_ICA.pem 1
echo "NON-DELEGATED; Root CA -> Intermediate CA"
test_ocsp ND2.ors WSNIC_ND2_Issuer_Root.pem 1
echo "NON-DELEGATED; Root CA -> EE"
test_ocsp ND3.ors WSNIC_ND3_Issuer_Root.pem 1
echo "DELEGATED; Intermediate CA -> EE"
test_ocsp D1.ors WSNIC_D1_Issuer_ICA.pem 1
echo "DELEGATED; Root CA -> Intermediate CA"
test_ocsp D2.ors WSNIC_D2_Issuer_Root.pem 1
echo "DELEGATED; Root CA -> EE"
test_ocsp D3.ors WSNIC_D3_Issuer_Root.pem 1
echo "=== WRONG KEY in the ISSUER CERTIFICATE ==="
echo "NON-DELEGATED; Intermediate CA -> EE"
test_ocsp ND1.ors WKIC_ND1_Issuer_ICA.pem 1
echo "NON-DELEGATED; Root CA -> Intermediate CA"
test_ocsp ND2.ors WKIC_ND2_Issuer_Root.pem 1
echo "NON-DELEGATED; Root CA -> EE"
test_ocsp ND3.ors WKIC_ND3_Issuer_Root.pem 1
echo "DELEGATED; Intermediate CA -> EE"
test_ocsp D1.ors WKIC_D1_Issuer_ICA.pem 1
echo "DELEGATED; Root CA -> Intermediate CA"
test_ocsp D2.ors WKIC_D2_Issuer_Root.pem 1
echo "DELEGATED; Root CA -> EE"
test_ocsp D3.ors WKIC_D3_Issuer_Root.pem 1
echo "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ==="
# Expect success, because we're explicitly trusting the issuer certificate.
echo "NON-DELEGATED; Intermediate CA -> EE"
test_ocsp ND1.ors ISIC_ND1_Issuer_ICA.pem 0
echo "NON-DELEGATED; Root CA -> Intermediate CA"
test_ocsp ND2.ors ISIC_ND2_Issuer_Root.pem 0
echo "NON-DELEGATED; Root CA -> EE"
test_ocsp ND3.ors ISIC_ND3_Issuer_Root.pem 0
echo "DELEGATED; Intermediate CA -> EE"
test_ocsp D1.ors ISIC_D1_Issuer_ICA.pem 0
echo "DELEGATED; Root CA -> Intermediate CA"
test_ocsp D2.ors ISIC_D2_Issuer_Root.pem 0
echo "DELEGATED; Root CA -> EE"
test_ocsp D3.ors ISIC_D3_Issuer_Root.pem 0
echo "ALL OCSP TESTS SUCCESSFUL"
exit 0
|
