2 # Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the OpenSSL license (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
14 use File::Spec::Functions qw/devnull catfile/;
16 use OpenSSL::Test qw/:DEFAULT with pipe srctop_dir/;
17 use OpenSSL::Test::Utils;
21 plan skip_all => "OCSP is not supported by this OpenSSL build"
24 my $ocspdir=srctop_dir("test", "ocsp-tests");
25 # 17 December 2012 so we don't get certificate expiry errors.
26 my @check_time=("-attime", "1355875200");
30 my $inputfile = shift;
32 my $expected_exit = shift;
34 run(app(["openssl", "base64", "-d",
35 "-in", catfile($ocspdir,$inputfile),
36 "-out", "ocsp-resp-fff.dat"]));
37 with({ exit_checker => sub { return shift == $expected_exit; } },
38 sub { ok(run(app(["openssl", "ocsp", "-respin", "ocsp-resp-fff.dat",
39 "-partial_chain", @check_time,
40 "-CAfile", catfile($ocspdir, $CAfile),
41 "-verify_other", catfile($ocspdir, $CAfile),
44 unlink "ocsp-resp-fff.dat";
49 subtest "=== VALID OCSP RESPONSES ===" => sub {
52 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
53 "ND1.ors", "ND1_Issuer_ICA.pem", 0);
54 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
55 "ND2.ors", "ND2_Issuer_Root.pem", 0);
56 test_ocsp("NON-DELEGATED; Root CA -> EE",
57 "ND3.ors", "ND3_Issuer_Root.pem", 0);
58 test_ocsp("DELEGATED; Intermediate CA -> EE",
59 "D1.ors", "D1_Issuer_ICA.pem", 0);
60 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
61 "D2.ors", "D2_Issuer_Root.pem", 0);
62 test_ocsp("DELEGATED; Root CA -> EE",
63 "D3.ors", "D3_Issuer_Root.pem", 0);
66 subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
69 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
70 "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", 1);
71 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
72 "ISOP_ND2.ors", "ND2_Issuer_Root.pem", 1);
73 test_ocsp("NON-DELEGATED; Root CA -> EE",
74 "ISOP_ND3.ors", "ND3_Issuer_Root.pem", 1);
75 test_ocsp("DELEGATED; Intermediate CA -> EE",
76 "ISOP_D1.ors", "D1_Issuer_ICA.pem", 1);
77 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
78 "ISOP_D2.ors", "D2_Issuer_Root.pem", 1);
79 test_ocsp("DELEGATED; Root CA -> EE",
80 "ISOP_D3.ors", "D3_Issuer_Root.pem", 1);
83 subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
86 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
87 "WRID_ND1.ors", "ND1_Issuer_ICA.pem", 1);
88 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
89 "WRID_ND2.ors", "ND2_Issuer_Root.pem", 1);
90 test_ocsp("NON-DELEGATED; Root CA -> EE",
91 "WRID_ND3.ors", "ND3_Issuer_Root.pem", 1);
92 test_ocsp("DELEGATED; Intermediate CA -> EE",
93 "WRID_D1.ors", "D1_Issuer_ICA.pem", 1);
94 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
95 "WRID_D2.ors", "D2_Issuer_Root.pem", 1);
96 test_ocsp("DELEGATED; Root CA -> EE",
97 "WRID_D3.ors", "D3_Issuer_Root.pem", 1);
100 subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
103 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
104 "WINH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
105 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
106 "WINH_ND2.ors", "ND2_Issuer_Root.pem", 1);
107 test_ocsp("NON-DELEGATED; Root CA -> EE",
108 "WINH_ND3.ors", "ND3_Issuer_Root.pem", 1);
109 test_ocsp("DELEGATED; Intermediate CA -> EE",
110 "WINH_D1.ors", "D1_Issuer_ICA.pem", 1);
111 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
112 "WINH_D2.ors", "D2_Issuer_Root.pem", 1);
113 test_ocsp("DELEGATED; Root CA -> EE",
114 "WINH_D3.ors", "D3_Issuer_Root.pem", 1);
117 subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
120 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
121 "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
122 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
123 "WIKH_ND2.ors", "ND2_Issuer_Root.pem", 1);
124 test_ocsp("NON-DELEGATED; Root CA -> EE",
125 "WIKH_ND3.ors", "ND3_Issuer_Root.pem", 1);
126 test_ocsp("DELEGATED; Intermediate CA -> EE",
127 "WIKH_D1.ors", "D1_Issuer_ICA.pem", 1);
128 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
129 "WIKH_D2.ors", "D2_Issuer_Root.pem", 1);
130 test_ocsp("DELEGATED; Root CA -> EE",
131 "WIKH_D3.ors", "D3_Issuer_Root.pem", 1);
134 subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
137 test_ocsp("DELEGATED; Intermediate CA -> EE",
138 "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
139 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
140 "WKDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
141 test_ocsp("DELEGATED; Root CA -> EE",
142 "WKDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
145 subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
148 test_ocsp("DELEGATED; Intermediate CA -> EE",
149 "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
150 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
151 "ISDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
152 test_ocsp("DELEGATED; Root CA -> EE",
153 "ISDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
156 subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
159 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
160 "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", 1);
161 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
162 "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", 1);
163 test_ocsp("NON-DELEGATED; Root CA -> EE",
164 "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", 1);
165 test_ocsp("DELEGATED; Intermediate CA -> EE",
166 "D1.ors", "WSNIC_D1_Issuer_ICA.pem", 1);
167 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
168 "D2.ors", "WSNIC_D2_Issuer_Root.pem", 1);
169 test_ocsp("DELEGATED; Root CA -> EE",
170 "D3.ors", "WSNIC_D3_Issuer_Root.pem", 1);
173 subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
176 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
177 "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", 1);
178 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
179 "ND2.ors", "WKIC_ND2_Issuer_Root.pem", 1);
180 test_ocsp("NON-DELEGATED; Root CA -> EE",
181 "ND3.ors", "WKIC_ND3_Issuer_Root.pem", 1);
182 test_ocsp("DELEGATED; Intermediate CA -> EE",
183 "D1.ors", "WKIC_D1_Issuer_ICA.pem", 1);
184 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
185 "D2.ors", "WKIC_D2_Issuer_Root.pem", 1);
186 test_ocsp("DELEGATED; Root CA -> EE",
187 "D3.ors", "WKIC_D3_Issuer_Root.pem", 1);
190 subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
193 # Expect success, because we're explicitly trusting the issuer certificate.
194 test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
195 "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", 0);
196 test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
197 "ND2.ors", "ISIC_ND2_Issuer_Root.pem", 0);
198 test_ocsp("NON-DELEGATED; Root CA -> EE",
199 "ND3.ors", "ISIC_ND3_Issuer_Root.pem", 0);
200 test_ocsp("DELEGATED; Intermediate CA -> EE",
201 "D1.ors", "ISIC_D1_Issuer_ICA.pem", 0);
202 test_ocsp("DELEGATED; Root CA -> Intermediate CA",
203 "D2.ors", "ISIC_D2_Issuer_Root.pem", 0);
204 test_ocsp("DELEGATED; Root CA -> EE",
205 "D3.ors", "ISIC_D3_Issuer_Root.pem", 0);