7 use File::Spec::Functions qw/devnull catfile/;
10 use OpenSSL::Test qw/:DEFAULT with pipe top_dir/;
14 my $ocspdir=top_dir("test", "ocsp-tests");
15 # 17 December 2012 so we don't get certificate expiry errors.
16 my @check_time=("-attime", "1355875200");
20 my $inputfile = shift;
22 my $expected_exit = shift;
24 with({ exit_checker => sub { return shift == $expected_exit; } },
25 sub { ok(run(pipe(app(["openssl", "base64", "-d",
26 "-in", catfile($ocspdir,$inputfile)]),
27 app(["openssl", "ocsp", "-respin", "-",
28 "-partial_chain", @check_time,
29 "-CAfile", catfile($ocspdir, $CAfile),
30 "-verify_other", catfile($ocspdir, $CAfile),
31 "-CApath", devnull()]))),
37 subtest "=== VALID OCSP RESPONSES ===" => sub {
40 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
41 "ND1.ors", "ND1_Issuer_ICA.pem", 0);
42 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
43 "ND2.ors", "ND2_Issuer_Root.pem", 0);
44 test_ocsp("NON-DELEGATED; Root CA -> EE",
45 "ND3.ors", "ND3_Issuer_Root.pem", 0);
46 test_ocsp("DELEGATED; Intermediate CA -> EE",
47 "D1.ors", "D1_Issuer_ICA.pem", 0);
48 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
49 "D2.ors", "D2_Issuer_Root.pem", 0);
50 test_ocsp("DELEGATED; Root CA -> EE",
51 "D3.ors", "D3_Issuer_Root.pem", 0);
54 subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
57 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
58 "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", 1);
59 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
60 "ISOP_ND2.ors", "ND2_Issuer_Root.pem", 1);
61 test_ocsp("NON-DELEGATED; Root CA -> EE",
62 "ISOP_ND3.ors", "ND3_Issuer_Root.pem", 1);
63 test_ocsp("DELEGATED; Intermediate CA -> EE",
64 "ISOP_D1.ors", "D1_Issuer_ICA.pem", 1);
65 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
66 "ISOP_D2.ors", "D2_Issuer_Root.pem", 1);
67 test_ocsp("DELEGATED; Root CA -> EE",
68 "ISOP_D3.ors", "D3_Issuer_Root.pem", 1);
71 subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
74 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
75 "WRID_ND1.ors", "ND1_Issuer_ICA.pem", 1);
76 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
77 "WRID_ND2.ors", "ND2_Issuer_Root.pem", 1);
78 test_ocsp("NON-DELEGATED; Root CA -> EE",
79 "WRID_ND3.ors", "ND3_Issuer_Root.pem", 1);
80 test_ocsp("DELEGATED; Intermediate CA -> EE",
81 "WRID_D1.ors", "D1_Issuer_ICA.pem", 1);
82 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
83 "WRID_D2.ors", "D2_Issuer_Root.pem", 1);
84 test_ocsp("DELEGATED; Root CA -> EE",
85 "WRID_D3.ors", "D3_Issuer_Root.pem", 1);
88 subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
91 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
92 "WINH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
93 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
94 "WINH_ND2.ors", "ND2_Issuer_Root.pem", 1);
95 test_ocsp("NON-DELEGATED; Root CA -> EE",
96 "WINH_ND3.ors", "ND3_Issuer_Root.pem", 1);
97 test_ocsp("DELEGATED; Intermediate CA -> EE",
98 "WINH_D1.ors", "D1_Issuer_ICA.pem", 1);
99 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
100 "WINH_D2.ors", "D2_Issuer_Root.pem", 1);
101 test_ocsp("DELEGATED; Root CA -> EE",
102 "WINH_D3.ors", "D3_Issuer_Root.pem", 1);
105 subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
108 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
109 "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
110 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
111 "WIKH_ND2.ors", "ND2_Issuer_Root.pem", 1);
112 test_ocsp("NON-DELEGATED; Root CA -> EE",
113 "WIKH_ND3.ors", "ND3_Issuer_Root.pem", 1);
114 test_ocsp("DELEGATED; Intermediate CA -> EE",
115 "WIKH_D1.ors", "D1_Issuer_ICA.pem", 1);
116 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
117 "WIKH_D2.ors", "D2_Issuer_Root.pem", 1);
118 test_ocsp("DELEGATED; Root CA -> EE",
119 "WIKH_D3.ors", "D3_Issuer_Root.pem", 1);
122 subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
125 test_ocsp("DELEGATED; Intermediate CA -> EE",
126 "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
127 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
128 "WKDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
129 test_ocsp("DELEGATED; Root CA -> EE",
130 "WKDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
133 subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
136 test_ocsp("DELEGATED; Intermediate CA -> EE",
137 "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
138 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
139 "ISDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
140 test_ocsp("DELEGATED; Root CA -> EE",
141 "ISDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
144 subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
147 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
148 "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", 1);
149 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
150 "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", 1);
151 test_ocsp("NON-DELEGATED; Root CA -> EE",
152 "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", 1);
153 test_ocsp("DELEGATED; Intermediate CA -> EE",
154 "D1.ors", "WSNIC_D1_Issuer_ICA.pem", 1);
155 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
156 "D2.ors", "WSNIC_D2_Issuer_Root.pem", 1);
157 test_ocsp("DELEGATED; Root CA -> EE",
158 "D3.ors", "WSNIC_D3_Issuer_Root.pem", 1);
161 subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
164 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
165 "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", 1);
166 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
167 "ND2.ors", "WKIC_ND2_Issuer_Root.pem", 1);
168 test_ocsp("NON-DELEGATED; Root CA -> EE",
169 "ND3.ors", "WKIC_ND3_Issuer_Root.pem", 1);
170 test_ocsp("DELEGATED; Intermediate CA -> EE",
171 "D1.ors", "WKIC_D1_Issuer_ICA.pem", 1);
172 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
173 "D2.ors", "WKIC_D2_Issuer_Root.pem", 1);
174 test_ocsp("DELEGATED; Root CA -> EE",
175 "D3.ors", "WKIC_D3_Issuer_Root.pem", 1);
178 subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
181 # Expect success, because we're explicitly trusting the issuer certificate.
182 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
183 "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", 0);
184 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
185 "ND2.ors", "ISIC_ND2_Issuer_Root.pem", 0);
186 test_ocsp("NON-DELEGATED; Root CA -> EE",
187 "ND3.ors", "ISIC_ND3_Issuer_Root.pem", 0);
188 test_ocsp("DELEGATED; Intermediate CA -> EE",
189 "D1.ors", "ISIC_D1_Issuer_ICA.pem", 0);
190 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
191 "D2.ors", "ISIC_D2_Issuer_Root.pem", 0);
192 test_ocsp("DELEGATED; Root CA -> EE",
193 "D3.ors", "ISIC_D3_Issuer_Root.pem", 0);