1 $! TOCSP.COM -- Test ocsp
4 $ if f$getsyi("cpu") .ge. 128 then -
5 __arch = f$edit( f$getsyi( "ARCH_NAME"), "UPCASE")
6 $ if __arch .eqs. "" then __arch = "UNK"
8 $ if (p2 .eqs. "64") then __arch = __arch+ "_64"
10 $ exe_dir = "sys$disk:[-.''__arch'.exe.apps]"
12 $ cmd = "mcr ''f$parse(exe_dir+"openssl.exe")'"
13 $ ocspdir = "ocsp-tests"
15 $! 17 December 2012 so we don't get certificate expiry errors.
16 $ check_time="-attime 1355875200"
20 $ 'cmd' base64 -d -in [.'ocspdir']'p1' -out ocsp-test.test-bin
21 $ 'cmd' ocsp -respin ocsp-test.test-bin -partial_chain 'check_time' -
22 "-CAfile" [.'ocspdir']'p2' -verify_other [.'ocspdir']'p2' "-CApath" NLA0:
23 $ if $severity .ne. p3+1
25 $ write sys$error "OCSP test failed!"
32 $ write sys$output "=== VALID OCSP RESPONSES ==="
33 $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
34 $ call test_ocsp "ND1.ors" "ND1_Issuer_ICA.pem" 0
35 $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
36 $ call test_ocsp "ND2.ors" "ND2_Issuer_Root.pem" 0
37 $ write sys$output "NON-DELEGATED; Root CA -> EE"
38 $ call test_ocsp "ND3.ors" "ND3_Issuer_Root.pem" 0
39 $ write sys$output "DELEGATED; Intermediate CA -> EE"
40 $ call test_ocsp "D1.ors" "D1_Issuer_ICA.pem" 0
41 $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
42 $ call test_ocsp "D2.ors" "D2_Issuer_Root.pem" 0
43 $ write sys$output "DELEGATED; Root CA -> EE"
44 $ call test_ocsp "D3.ors" "D3_Issuer_Root.pem" 0
46 $ write sys$output "=== INVALID SIGNATURE on the OCSP RESPONSE ==="
47 $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
48 $ call test_ocsp "ISOP_ND1.ors" "ND1_Issuer_ICA.pem" 1
49 $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
50 $ call test_ocsp "ISOP_ND2.ors" "ND2_Issuer_Root.pem" 1
51 $ write sys$output "NON-DELEGATED; Root CA -> EE"
52 $ call test_ocsp "ISOP_ND3.ors" "ND3_Issuer_Root.pem" 1
53 $ write sys$output "DELEGATED; Intermediate CA -> EE"
54 $ call test_ocsp "ISOP_D1.ors" "D1_Issuer_ICA.pem" 1
55 $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
56 $ call test_ocsp "ISOP_D2.ors" "D2_Issuer_Root.pem" 1
57 $ write sys$output "DELEGATED; Root CA -> EE"
58 $ call test_ocsp "ISOP_D3.ors" "D3_Issuer_Root.pem" 1
60 $ write sys$output "=== WRONG RESPONDERID in the OCSP RESPONSE ==="
61 $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
62 $ call test_ocsp "WRID_ND1.ors" "ND1_Issuer_ICA.pem" 1
63 $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
64 $ call test_ocsp "WRID_ND2.ors" "ND2_Issuer_Root.pem" 1
65 $ write sys$output "NON-DELEGATED; Root CA -> EE"
66 $ call test_ocsp "WRID_ND3.ors" "ND3_Issuer_Root.pem" 1
67 $ write sys$output "DELEGATED; Intermediate CA -> EE"
68 $ call test_ocsp "WRID_D1.ors" "D1_Issuer_ICA.pem" 1
69 $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
70 $ call test_ocsp "WRID_D2.ors" "D2_Issuer_Root.pem" 1
71 $ write sys$output "DELEGATED; Root CA -> EE"
72 $ call test_ocsp "WRID_D3.ors" "D3_Issuer_Root.pem" 1
74 $ write sys$output "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ==="
75 $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
76 $ call test_ocsp "WINH_ND1.ors" "ND1_Issuer_ICA.pem" 1
77 $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
78 $ call test_ocsp "WINH_ND2.ors" "ND2_Issuer_Root.pem" 1
79 $ write sys$output "NON-DELEGATED; Root CA -> EE"
80 $ call test_ocsp "WINH_ND3.ors" "ND3_Issuer_Root.pem" 1
81 $ write sys$output "DELEGATED; Intermediate CA -> EE"
82 $ call test_ocsp "WINH_D1.ors" "D1_Issuer_ICA.pem" 1
83 $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
84 $ call test_ocsp "WINH_D2.ors" "D2_Issuer_Root.pem" 1
85 $ write sys$output "DELEGATED; Root CA -> EE"
86 $ call test_ocsp "WINH_D3.ors" "D3_Issuer_Root.pem" 1
88 $ write sys$output "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ==="
89 $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
90 $ call test_ocsp "WIKH_ND1.ors" "ND1_Issuer_ICA.pem" 1
91 $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
92 $ call test_ocsp "WIKH_ND2.ors" "ND2_Issuer_Root.pem" 1
93 $ write sys$output "NON-DELEGATED; Root CA -> EE"
94 $ call test_ocsp "WIKH_ND3.ors" "ND3_Issuer_Root.pem" 1
95 $ write sys$output "DELEGATED; Intermediate CA -> EE"
96 $ call test_ocsp "WIKH_D1.ors" "D1_Issuer_ICA.pem" 1
97 $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
98 $ call test_ocsp "WIKH_D2.ors" "D2_Issuer_Root.pem" 1
99 $ write sys$output "DELEGATED; Root CA -> EE"
100 $ call test_ocsp "WIKH_D3.ors" "D3_Issuer_Root.pem" 1
102 $ write sys$output "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ==="
103 $ write sys$output "DELEGATED; Intermediate CA -> EE"
104 $ call test_ocsp "WKDOSC_D1.ors" "D1_Issuer_ICA.pem" 1
105 $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
106 $ call test_ocsp "WKDOSC_D2.ors" "D2_Issuer_Root.pem" 1
107 $ write sys$output "DELEGATED; Root CA -> EE"
108 $ call test_ocsp "WKDOSC_D3.ors" "D3_Issuer_Root.pem" 1
110 $ write sys$output "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ==="
111 $ write sys$output "DELEGATED; Intermediate CA -> EE"
112 $ call test_ocsp "ISDOSC_D1.ors" "D1_Issuer_ICA.pem" 1
113 $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
114 $ call test_ocsp "ISDOSC_D2.ors" "D2_Issuer_Root.pem" 1
115 $ write sys$output "DELEGATED; Root CA -> EE"
116 $ call test_ocsp "ISDOSC_D3.ors" "D3_Issuer_Root.pem" 1
118 $ write sys$output "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ==="
119 $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
120 $ call test_ocsp "ND1.ors" "WSNIC_ND1_Issuer_ICA.pem" 1
121 $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
122 $ call test_ocsp "ND2.ors" "WSNIC_ND2_Issuer_Root.pem" 1
123 $ write sys$output "NON-DELEGATED; Root CA -> EE"
124 $ call test_ocsp "ND3.ors" "WSNIC_ND3_Issuer_Root.pem" 1
125 $ write sys$output "DELEGATED; Intermediate CA -> EE"
126 $ call test_ocsp "D1.ors" "WSNIC_D1_Issuer_ICA.pem" 1
127 $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
128 $ call test_ocsp "D2.ors" "WSNIC_D2_Issuer_Root.pem" 1
129 $ write sys$output "DELEGATED; Root CA -> EE"
130 $ call test_ocsp "D3.ors" "WSNIC_D3_Issuer_Root.pem" 1
132 $ write sys$output "=== WRONG KEY in the ISSUER CERTIFICATE ==="
133 $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
134 $ call test_ocsp "ND1.ors" "WKIC_ND1_Issuer_ICA.pem" 1
135 $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
136 $ call test_ocsp "ND2.ors" "WKIC_ND2_Issuer_Root.pem" 1
137 $ write sys$output "NON-DELEGATED; Root CA -> EE"
138 $ call test_ocsp "ND3.ors" "WKIC_ND3_Issuer_Root.pem" 1
139 $ write sys$output "DELEGATED; Intermediate CA -> EE"
140 $ call test_ocsp "D1.ors" "WKIC_D1_Issuer_ICA.pem" 1
141 $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
142 $ call test_ocsp "D2.ors" "WKIC_D2_Issuer_Root.pem" 1
143 $ write sys$output "DELEGATED; Root CA -> EE"
144 $ call test_ocsp "D3.ors" "WKIC_D3_Issuer_Root.pem" 1
146 $ write sys$output "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ==="
147 $! Expect success, because we're explicitly trusting the issuer certificate.
148 $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
149 $ call test_ocsp "ND1.ors" "ISIC_ND1_Issuer_ICA.pem" 0
150 $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
151 $ call test_ocsp "ND2.ors" "ISIC_ND2_Issuer_Root.pem" 0
152 $ write sys$output "NON-DELEGATED; Root CA -> EE"
153 $ call test_ocsp "ND3.ors" "ISIC_ND3_Issuer_Root.pem" 0
154 $ write sys$output "DELEGATED; Intermediate CA -> EE"
155 $ call test_ocsp "D1.ors" "ISIC_D1_Issuer_ICA.pem" 0
156 $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
157 $ call test_ocsp "D2.ors" "ISIC_D2_Issuer_Root.pem" 0
158 $ write sys$output "DELEGATED; Root CA -> EE"
159 $ call test_ocsp "D3.ors" "ISIC_D3_Issuer_Root.pem" 0
161 $ write sys$output "ALL OCSP TESTS SUCCESSFUL"