1require_relative "utils" 2 3if defined?(OpenSSL) 4 5class OpenSSL::TestX509Certificate < Test::Unit::TestCase 6 def setup 7 @rsa1024 = OpenSSL::TestUtils::TEST_KEY_RSA1024 8 @rsa2048 = OpenSSL::TestUtils::TEST_KEY_RSA2048 9 @dsa256 = OpenSSL::TestUtils::TEST_KEY_DSA256 10 @dsa512 = OpenSSL::TestUtils::TEST_KEY_DSA512 11 @ca = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=CA") 12 @ee1 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=EE1") 13 @ee2 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=EE2") 14 end 15 16 def teardown 17 end 18 19 def issue_cert(*args) 20 OpenSSL::TestUtils.issue_cert(*args) 21 end 22 23 def test_serial 24 [1, 2**32, 2**100].each{|s| 25 cert = issue_cert(@ca, @rsa2048, s, Time.now, Time.now+3600, [], 26 nil, nil, OpenSSL::Digest::SHA1.new) 27 assert_equal(s, cert.serial) 28 cert = OpenSSL::X509::Certificate.new(cert.to_der) 29 assert_equal(s, cert.serial) 30 } 31 end 32 33 def test_public_key 34 exts = [ 35 ["basicConstraints","CA:TRUE",true], 36 ["subjectKeyIdentifier","hash",false], 37 ["authorityKeyIdentifier","keyid:always",false], 38 ] 39 40 sha1 = OpenSSL::Digest::SHA1.new 41 dsa_digest = OpenSSL::TestUtils::DSA_SIGNATURE_DIGEST.new 42 43 [ 44 [@rsa1024, sha1], [@rsa2048, sha1], [@dsa256, dsa_digest], [@dsa512, dsa_digest] 45 ].each{|pk, digest| 46 cert = issue_cert(@ca, pk, 1, Time.now, Time.now+3600, exts, 47 nil, nil, digest) 48 assert_equal(cert.extensions[1].value, 49 OpenSSL::TestUtils.get_subject_key_id(cert)) 50 cert = OpenSSL::X509::Certificate.new(cert.to_der) 51 assert_equal(cert.extensions[1].value, 52 OpenSSL::TestUtils.get_subject_key_id(cert)) 53 } 54 end 55 56 def test_validity 57 now = Time.now until now && now.usec != 0 58 cert = issue_cert(@ca, @rsa2048, 1, now, now+3600, [], 59 nil, nil, OpenSSL::Digest::SHA1.new) 60 assert_not_equal(now, cert.not_before) 61 assert_not_equal(now+3600, cert.not_after) 62 63 now = Time.at(now.to_i) 64 cert = issue_cert(@ca, @rsa2048, 1, now, now+3600, [], 65 nil, nil, OpenSSL::Digest::SHA1.new) 66 assert_equal(now.getutc, cert.not_before) 67 assert_equal((now+3600).getutc, cert.not_after) 68 69 now = Time.at(0) 70 cert = issue_cert(@ca, @rsa2048, 1, now, now, [], 71 nil, nil, OpenSSL::Digest::SHA1.new) 72 assert_equal(now.getutc, cert.not_before) 73 assert_equal(now.getutc, cert.not_after) 74 75 now = Time.at(0x7fffffff) 76 cert = issue_cert(@ca, @rsa2048, 1, now, now, [], 77 nil, nil, OpenSSL::Digest::SHA1.new) 78 assert_equal(now.getutc, cert.not_before) 79 assert_equal(now.getutc, cert.not_after) 80 end 81 82 def test_extension 83 ca_exts = [ 84 ["basicConstraints","CA:TRUE",true], 85 ["keyUsage","keyCertSign, cRLSign",true], 86 ["subjectKeyIdentifier","hash",false], 87 ["authorityKeyIdentifier","keyid:always",false], 88 ] 89 ca_cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, ca_exts, 90 nil, nil, OpenSSL::Digest::SHA1.new) 91 ca_cert.extensions.each_with_index{|ext, i| 92 assert_equal(ca_exts[i].first, ext.oid) 93 assert_equal(ca_exts[i].last, ext.critical?) 94 } 95 96 ee1_exts = [ 97 ["keyUsage","Non Repudiation, Digital Signature, Key Encipherment",true], 98 ["subjectKeyIdentifier","hash",false], 99 ["authorityKeyIdentifier","keyid:always",false], 100 ["extendedKeyUsage","clientAuth, emailProtection, codeSigning",false], 101 ["subjectAltName","email:ee1@ruby-lang.org",false], 102 ] 103 ee1_cert = issue_cert(@ee1, @rsa1024, 2, Time.now, Time.now+1800, ee1_exts, 104 ca_cert, @rsa2048, OpenSSL::Digest::SHA1.new) 105 assert_equal(ca_cert.subject.to_der, ee1_cert.issuer.to_der) 106 ee1_cert.extensions.each_with_index{|ext, i| 107 assert_equal(ee1_exts[i].first, ext.oid) 108 assert_equal(ee1_exts[i].last, ext.critical?) 109 } 110 111 ee2_exts = [ 112 ["keyUsage","Non Repudiation, Digital Signature, Key Encipherment",true], 113 ["subjectKeyIdentifier","hash",false], 114 ["authorityKeyIdentifier","issuer:always",false], 115 ["extendedKeyUsage","clientAuth, emailProtection, codeSigning",false], 116 ["subjectAltName","email:ee2@ruby-lang.org",false], 117 ] 118 ee2_cert = issue_cert(@ee2, @rsa1024, 3, Time.now, Time.now+1800, ee2_exts, 119 ca_cert, @rsa2048, OpenSSL::Digest::MD5.new) 120 assert_equal(ca_cert.subject.to_der, ee2_cert.issuer.to_der) 121 ee2_cert.extensions.each_with_index{|ext, i| 122 assert_equal(ee2_exts[i].first, ext.oid) 123 assert_equal(ee2_exts[i].last, ext.critical?) 124 } 125 126 end 127 128 def test_sign_and_verify 129 cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [], 130 nil, nil, OpenSSL::Digest::SHA1.new) 131 assert_equal(false, cert.verify(@rsa1024)) 132 assert_equal(true, cert.verify(@rsa2048)) 133 assert_equal(false, certificate_error_returns_false { cert.verify(@dsa256) }) 134 assert_equal(false, certificate_error_returns_false { cert.verify(@dsa512) }) 135 cert.serial = 2 136 assert_equal(false, cert.verify(@rsa2048)) 137 138 cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [], 139 nil, nil, OpenSSL::Digest::MD5.new) 140 assert_equal(false, cert.verify(@rsa1024)) 141 assert_equal(true, cert.verify(@rsa2048)) 142 143 assert_equal(false, certificate_error_returns_false { cert.verify(@dsa256) }) 144 assert_equal(false, certificate_error_returns_false { cert.verify(@dsa512) }) 145 cert.subject = @ee1 146 assert_equal(false, cert.verify(@rsa2048)) 147 148 cert = issue_cert(@ca, @dsa512, 1, Time.now, Time.now+3600, [], 149 nil, nil, OpenSSL::TestUtils::DSA_SIGNATURE_DIGEST.new) 150 assert_equal(false, certificate_error_returns_false { cert.verify(@rsa1024) }) 151 assert_equal(false, certificate_error_returns_false { cert.verify(@rsa2048) }) 152 assert_equal(false, cert.verify(@dsa256)) 153 assert_equal(true, cert.verify(@dsa512)) 154 cert.not_after = Time.now 155 assert_equal(false, cert.verify(@dsa512)) 156 157 begin 158 cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [], 159 nil, nil, OpenSSL::Digest::DSS1.new) 160 assert_equal(false, cert.verify(@rsa1024)) 161 assert_equal(true, cert.verify(@rsa2048)) 162 assert_equal(false, certificate_error_returns_false { cert.verify(@dsa256) }) 163 assert_equal(false, certificate_error_returns_false { cert.verify(@dsa512) }) 164 cert.subject = @ee1 165 assert_equal(false, cert.verify(@rsa2048)) 166 rescue OpenSSL::X509::CertificateError 167 end 168 169 assert_raise(OpenSSL::X509::CertificateError){ 170 issue_cert(@ca, @dsa512, 1, Time.now, Time.now+3600, [], 171 nil, nil, OpenSSL::Digest::MD5.new) 172 } 173 end 174 175 def test_dsig_algorithm_mismatch 176 assert_raise(OpenSSL::X509::CertificateError) do 177 issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [], 178 nil, nil, OpenSSL::Digest::DSS1.new) 179 end if OpenSSL::OPENSSL_VERSION_NUMBER < 0x10001000 # [ruby-core:42949] 180 181 assert_raise(OpenSSL::X509::CertificateError) do 182 issue_cert(@ca, @dsa512, 1, Time.now, Time.now+3600, [], 183 nil, nil, OpenSSL::Digest::MD5.new) 184 end 185 end 186 187 def test_dsa_with_sha2 188 begin 189 cert = issue_cert(@ca, @dsa256, 1, Time.now, Time.now+3600, [], 190 nil, nil, OpenSSL::Digest::SHA256.new) 191 assert_equal("dsa_with_SHA256", cert.signature_algorithm) 192 rescue OpenSSL::X509::CertificateError 193 # dsa_with_sha2 not supported. skip following test. 194 return 195 end 196 # TODO: need more tests for dsa + sha2 197 198 # SHA1 is allowed from OpenSSL 1.0.0 (0.9.8 requires DSS1) 199 cert = issue_cert(@ca, @dsa256, 1, Time.now, Time.now+3600, [], 200 nil, nil, OpenSSL::Digest::SHA1.new) 201 assert_equal("dsaWithSHA1", cert.signature_algorithm) 202 end if defined?(OpenSSL::Digest::SHA256) 203 204 def test_check_private_key 205 cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [], 206 nil, nil, OpenSSL::Digest::SHA1.new) 207 assert_equal(true, cert.check_private_key(@rsa2048)) 208 end 209 210 private 211 212 def certificate_error_returns_false 213 yield 214 rescue OpenSSL::X509::CertificateError 215 false 216 end 217end 218 219end 220