appstest.sh revision 1.39
1#!/bin/sh 2# 3# $OpenBSD: appstest.sh,v 1.39 2020/05/17 04:43:16 inoguchi Exp $ 4# 5# Copyright (c) 2016 Kinichiro Inoguchi <inoguchi@openbsd.org> 6# 7# Permission to use, copy, modify, and distribute this software for any 8# purpose with or without fee is hereby granted, provided that the above 9# copyright notice and this permission notice appear in all copies. 10# 11# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 19# 20# appstest.sh - test script for openssl command according to man OPENSSL(1) 21# 22# input : none 23# output : all files generated by this script go under $ssldir 24# 25 26function section_message { 27 echo "" 28 echo "#---------#---------#---------#---------#---------#---------#---------#--------" 29 echo "===" 30 echo "=== (Section) $1 `date +'%Y/%m/%d %H:%M:%S'`" 31 echo "===" 32} 33 34function start_message { 35 echo "" 36 echo "[TEST] $1" 37} 38 39function stop_s_server { 40 if [ ! -z "$s_server_pid" ] ; then 41 echo ":-| stop s_server [ $s_server_pid ]" 42 sleep 1 43 kill -TERM $s_server_pid 44 wait $s_server_pid 45 s_server_pid= 46 fi 47} 48 49function check_exit_status { 50 status=$1 51 if [ $status -ne 0 ] ; then 52 stop_s_server 53 echo ":-< error occurs, exit status = [ $status ]" 54 exit $status 55 else 56 echo ":-) success. " 57 fi 58} 59 60function usage { 61 echo "usage: appstest.sh [-iq]" 62} 63 64function test_usage_lists_others { 65 # === COMMAND USAGE === 66 section_message "COMMAND USAGE" 67 68 start_message "output usages of all commands." 69 70 cmds=`$openssl_bin list-standard-commands` 71 $openssl_bin -help 2>> $user1_dir/usages.out 72 for c in $cmds ; do 73 $openssl_bin $c -help 2>> $user1_dir/usages.out 74 done 75 76 start_message "check all list-* commands." 77 78 lists="" 79 lists="$lists list-standard-commands" 80 lists="$lists list-message-digest-commands list-message-digest-algorithms" 81 lists="$lists list-cipher-commands list-cipher-algorithms" 82 lists="$lists list-public-key-algorithms" 83 84 listsfile=$user1_dir/lists.out 85 86 for l in $lists ; do 87 echo "" >> $listsfile 88 echo "$l" >> $listsfile 89 $openssl_bin $l >> $listsfile 90 done 91 92 start_message "check interactive mode" 93 $openssl_bin <<__EOF__ 94help 95quit 96__EOF__ 97 check_exit_status $? 98 99 #---------#---------#---------#---------#---------#---------#--------- 100 101 # --- listing operations --- 102 section_message "listing operations" 103 104 start_message "ciphers" 105 $openssl_bin ciphers -V > $user1_dir/ciphers-V.out 106 check_exit_status $? 107 108 start_message "errstr" 109 $openssl_bin errstr 2606A074 110 check_exit_status $? 111 $openssl_bin errstr -stats 2606A074 > $user1_dir/errstr-stats.out 112 check_exit_status $? 113 114 #---------#---------#---------#---------#---------#---------#--------- 115 116 # --- random number etc. operations --- 117 section_message "random number etc. operations" 118 119 start_message "passwd" 120 121 pass="test-pass-1234" 122 123 echo $pass | $openssl_bin passwd -stdin -1 124 check_exit_status $? 125 126 echo $pass | $openssl_bin passwd -stdin -apr1 127 check_exit_status $? 128 129 echo $pass | $openssl_bin passwd -stdin -crypt 130 check_exit_status $? 131 132 start_message "prime" 133 134 $openssl_bin prime 1 135 check_exit_status $? 136 137 $openssl_bin prime 2 138 check_exit_status $? 139 140 $openssl_bin prime -bits 64 -checks 3 -generate -hex -safe 5 141 check_exit_status $? 142 143 start_message "rand" 144 145 $openssl_bin rand -base64 100 146 check_exit_status $? 147 148 $openssl_bin rand -hex 100 149 check_exit_status $? 150} 151 152function test_md { 153 # === MESSAGE DIGEST COMMANDS === 154 section_message "MESSAGE DIGEST COMMANDS" 155 156 start_message "dgst - See [MESSAGE DIGEST COMMANDS] section." 157 158 text="1234567890abcdefghijklmnopqrstuvwxyz" 159 dgstdat=$user1_dir/dgst.dat 160 echo $text > $dgstdat 161 hmac_key="test-hmac-key" 162 cmac_key="1234567890abcde1234567890abcde12" 163 dgstkey=$user1_dir/dgstkey.pem 164 dgstpass=test-dgst-pass 165 dgstpub=$user1_dir/dgstpub.pem 166 dgstsig=$user1_dir/dgst.sig 167 168 $openssl_bin genrsa -aes256 -passout pass:$dgstpass -out $dgstkey 169 check_exit_status $? 170 171 $openssl_bin pkey -in $dgstkey -passin pass:$dgstpass -pubout \ 172 -out $dgstpub 173 check_exit_status $? 174 175 digests=`$openssl_bin list-message-digest-commands` 176 177 for d in $digests ; do 178 179 echo -n "$d ... " 180 $openssl_bin dgst -$d -hex -out $dgstdat.$d $dgstdat 181 check_exit_status $? 182 183 echo -n "$d HMAC ... " 184 $openssl_bin dgst -$d -c -hmac $hmac_key -out $dgstdat.$d.hmac \ 185 $dgstdat 186 check_exit_status $? 187 188 echo -n "$d CMAC ... " 189 $openssl_bin dgst -$d -r -mac cmac -macopt cipher:aes-128-cbc \ 190 -macopt hexkey:$cmac_key -out $dgstdat.$d.cmac $dgstdat 191 check_exit_status $? 192 193 echo -n "$d sign ... " 194 $openssl_bin dgst -sign $dgstkey -keyform pem \ 195 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 196 -passin pass:$dgstpass -binary -out $dgstsig.$d $dgstdat 197 check_exit_status $? 198 199 echo -n "$d verify ... " 200 $openssl_bin dgst -verify $dgstpub \ 201 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 202 -signature $dgstsig.$d $dgstdat 203 check_exit_status $? 204 205 echo -n "$d prverify ... " 206 $openssl_bin dgst -prverify $dgstkey -passin pass:$dgstpass \ 207 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 208 -signature $dgstsig.$d $dgstdat 209 check_exit_status $? 210 done 211} 212 213function test_encoding_cipher { 214 # === ENCODING AND CIPHER COMMANDS === 215 section_message "ENCODING AND CIPHER COMMANDS" 216 217 start_message "enc - See [ENCODING AND CIPHER COMMANDS] section." 218 219 text="1234567890abcdefghijklmnopqrstuvwxyz" 220 encfile=$user1_dir/encfile.dat 221 echo $text > $encfile 222 pass="test-pass-1234" 223 224 ciphers=`$openssl_bin list-cipher-commands` 225 226 for c in $ciphers ; do 227 echo -n "$c ... encoding ... " 228 $openssl_bin enc -$c -e -base64 -pass pass:$pass \ 229 -in $encfile -out $encfile-$c.enc 230 check_exit_status $? 231 232 echo -n "decoding ... " 233 $openssl_bin enc -$c -d -base64 -pass pass:$pass \ 234 -in $encfile-$c.enc -out $encfile-$c.dec 235 check_exit_status $? 236 237 echo -n "cmp ... " 238 cmp $encfile $encfile-$c.dec 239 check_exit_status $? 240 done 241} 242 243function test_key { 244 # === various KEY operations === 245 section_message "various KEY operations" 246 247 key_pass=test-key-pass 248 249 # DH 250 251 start_message "gendh - Obsoleted by dhparam." 252 gendh2=$key_dir/gendh2.pem 253 $openssl_bin gendh -2 -out $gendh2 > $gendh2.log 2>&1 254 check_exit_status $? 255 256 start_message "dh - Obsoleted by dhparam." 257 $openssl_bin dh -in $gendh2 -check -text -out $gendh2.out 258 check_exit_status $? 259 260 if [ $no_long_tests = 0 ] ; then 261 start_message "dhparam - Superseded by genpkey and pkeyparam." 262 dhparam2=$key_dir/dhparam2.pem 263 $openssl_bin dhparam -2 -out $dhparam2 > $dhparam2.log 2>&1 264 check_exit_status $? 265 $openssl_bin dhparam -in $dhparam2 -check -text \ 266 -out $dhparam2.out 267 check_exit_status $? 268 else 269 start_message "SKIPPING dhparam - Superseded by genpkey and pkeyparam. (quick mode)" 270 fi 271 272 # DSA 273 274 start_message "dsaparam - Superseded by genpkey and pkeyparam." 275 dsaparam512=$key_dir/dsaparam512.pem 276 $openssl_bin dsaparam -genkey -out $dsaparam512 512 \ 277 > $dsaparam512.log 2>&1 278 check_exit_status $? 279 280 start_message "dsa" 281 $openssl_bin dsa -in $dsaparam512 -text -modulus -out $dsaparam512.out 282 check_exit_status $? 283 284 start_message "gendsa - Superseded by genpkey and pkey." 285 gendsa_des3=$key_dir/gendsa_des3.pem 286 $openssl_bin gendsa -des3 -out $gendsa_des3 \ 287 -passout pass:$key_pass $dsaparam512 288 check_exit_status $? 289 290 # RSA 291 292 start_message "genrsa - Superseded by genpkey." 293 genrsa_aes256=$key_dir/genrsa_aes256.pem 294 $openssl_bin genrsa -f4 -aes256 -out $genrsa_aes256 \ 295 -passout pass:$key_pass 2048 > $genrsa_aes256.log 2>&1 296 check_exit_status $? 297 298 start_message "rsa" 299 $openssl_bin rsa -in $genrsa_aes256 -passin pass:$key_pass \ 300 -check -text -out $genrsa_aes256.out 301 check_exit_status $? 302 303 start_message "rsautl - Superseded by pkeyutl." 304 rsautldat=$key_dir/rsautl.dat 305 rsautlsig=$key_dir/rsautl.sig 306 echo "abcdefghijklmnopqrstuvwxyz1234567890" > $rsautldat 307 308 $openssl_bin rsautl -sign -in $rsautldat -inkey $genrsa_aes256 \ 309 -passin pass:$key_pass -out $rsautlsig 310 check_exit_status $? 311 312 $openssl_bin rsautl -verify -in $rsautlsig -inkey $genrsa_aes256 \ 313 -passin pass:$key_pass 314 check_exit_status $? 315 316 # EC 317 318 start_message "ecparam -list-curves" 319 $openssl_bin ecparam -list_curves -out $key_dir/ecparam-list_curves.out 320 check_exit_status $? 321 322 # get all EC curves 323 ec_curves=`$openssl_bin ecparam -list_curves | grep ':' | cut -d ':' -f 1` 324 325 start_message "ecparam and ec" 326 327 for curve in $ec_curves ; 328 do 329 ecparam=$key_dir/ecparam_$curve.pem 330 331 echo -n "ec - $curve ... ecparam ... " 332 $openssl_bin ecparam -out $ecparam -name $curve -genkey \ 333 -param_enc explicit -conv_form compressed -C 334 check_exit_status $? 335 336 echo -n "ec ... " 337 $openssl_bin ec -in $ecparam -text \ 338 -out $ecparam.out 2> /dev/null 339 check_exit_status $? 340 done 341 342 # PKEY 343 344 start_message "genpkey" 345 346 # DH by GENPKEY 347 348 genpkey_dh_param=$key_dir/genpkey_dh_param.pem 349 $openssl_bin genpkey -genparam -algorithm DH -out $genpkey_dh_param \ 350 -pkeyopt dh_paramgen_prime_len:1024 > $genpkey_dh_param.log 2>&1 351 check_exit_status $? 352 353 genpkey_dh=$key_dir/genpkey_dh.pem 354 $openssl_bin genpkey -paramfile $genpkey_dh_param -out $genpkey_dh 355 check_exit_status $? 356 357 # DSA by GENPKEY 358 359 genpkey_dsa_param=$key_dir/genpkey_dsa_param.pem 360 $openssl_bin genpkey -genparam -algorithm DSA -out $genpkey_dsa_param \ 361 -pkeyopt dsa_paramgen_bits:1024 > $genpkey_dsa_param.log 2>&1 362 check_exit_status $? 363 364 genpkey_dsa=$key_dir/genpkey_dsa.pem 365 $openssl_bin genpkey -paramfile $genpkey_dsa_param -out $genpkey_dsa 366 check_exit_status $? 367 368 # RSA by GENPKEY 369 370 genpkey_rsa=$key_dir/genpkey_rsa.pem 371 $openssl_bin genpkey -algorithm RSA -out $genpkey_rsa \ 372 -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3 \ 373 > $genpkey_rsa.log 2>&1 374 check_exit_status $? 375 376 genpkey_rsa_pss=$key_dir/genpkey_rsa_pss.pem 377 $openssl_bin genpkey -algorithm RSA-PSS -out $genpkey_rsa_pss \ 378 -pkeyopt rsa_keygen_bits:2048 \ 379 -pkeyopt rsa_pss_keygen_mgf1_md:sha256 \ 380 -pkeyopt rsa_pss_keygen_md:sha256 \ 381 -pkeyopt rsa_pss_keygen_saltlen:32 \ 382 > $genpkey_rsa_pss.log 2>&1 383 check_exit_status $? 384 385 # EC by GENPKEY 386 387 genpkey_ec_param=$key_dir/genpkey_ec_param.pem 388 $openssl_bin genpkey -genparam -algorithm EC -out $genpkey_ec_param \ 389 -pkeyopt ec_paramgen_curve:secp384r1 390 check_exit_status $? 391 392 genpkey_ec=$key_dir/genpkey_ec.pem 393 $openssl_bin genpkey -paramfile $genpkey_ec_param -out $genpkey_ec 394 check_exit_status $? 395 396 genpkey_ec_2=$key_dir/genpkey_ec_2.pem 397 $openssl_bin genpkey -paramfile $genpkey_ec_param -out $genpkey_ec_2 398 check_exit_status $? 399 400 start_message "pkeyparam" 401 402 $openssl_bin pkeyparam -in $genpkey_dh_param -text \ 403 -out $genpkey_dh_param.out 404 check_exit_status $? 405 406 $openssl_bin pkeyparam -in $genpkey_dsa_param -text \ 407 -out $genpkey_dsa_param.out 408 check_exit_status $? 409 410 $openssl_bin pkeyparam -in $genpkey_ec_param -text \ 411 -out $genpkey_ec_param.out 412 check_exit_status $? 413 414 start_message "pkey" 415 416 $openssl_bin pkey -in $genpkey_dh -pubout -out $genpkey_dh.pub \ 417 -text_pub 418 check_exit_status $? 419 420 $openssl_bin pkey -in $genpkey_dsa -pubout -out $genpkey_dsa.pub \ 421 -text_pub 422 check_exit_status $? 423 424 $openssl_bin pkey -in $genpkey_rsa -pubout -out $genpkey_rsa.pub \ 425 -text_pub 426 check_exit_status $? 427 428 $openssl_bin pkey -in $genpkey_ec -pubout -out $genpkey_ec.pub \ 429 -text_pub 430 check_exit_status $? 431 432 $openssl_bin pkey -in $genpkey_ec_2 -pubout -out $genpkey_ec_2.pub \ 433 -text_pub 434 check_exit_status $? 435 436 start_message "pkeyutl" 437 438 pkeyutldat=$key_dir/pkeyutl.dat 439 pkeyutlsig=$key_dir/pkeyutl.sig 440 echo "abcdefghijklmnopqrstuvwxyz1234567890" > $pkeyutldat 441 442 $openssl_bin pkeyutl -sign -in $pkeyutldat -inkey $genpkey_rsa \ 443 -out $pkeyutlsig 444 check_exit_status $? 445 446 $openssl_bin pkeyutl -verify -in $pkeyutldat -sigfile $pkeyutlsig \ 447 -inkey $genpkey_rsa 448 check_exit_status $? 449 450 $openssl_bin pkeyutl -verifyrecover -in $pkeyutlsig -inkey $genpkey_rsa 451 check_exit_status $? 452 453 pkeyutlenc=$key_dir/pkeyutl.enc 454 pkeyutldec=$key_dir/pkeyutl.dec 455 456 $openssl_bin pkeyutl -encrypt -in $pkeyutldat \ 457 -pubin -inkey $genpkey_rsa.pub -out $pkeyutlenc 458 check_exit_status $? 459 460 $openssl_bin pkeyutl -decrypt -in $pkeyutlenc \ 461 -inkey $genpkey_rsa -out $pkeyutldec 462 check_exit_status $? 463 464 diff $pkeyutldat $pkeyutldec 465 check_exit_status $? 466 467 pkeyutl_rsa_oaep_enc=$key_dir/pkeyutl_rsa_oaep.enc 468 pkeyutl_rsa_oaep_dec=$key_dir/pkeyutl_rsa_oaep.dec 469 470 $openssl_bin pkeyutl -encrypt -in $pkeyutldat \ 471 -inkey $genpkey_rsa \ 472 -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 \ 473 -pkeyopt rsa_oaep_label:0011223344556677 \ 474 -out $pkeyutl_rsa_oaep_enc 475 check_exit_status $? 476 477 $openssl_bin pkeyutl -decrypt -in $pkeyutl_rsa_oaep_enc \ 478 -inkey $genpkey_rsa \ 479 -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 \ 480 -pkeyopt rsa_oaep_label:0011223344556677 \ 481 -out $pkeyutl_rsa_oaep_dec 482 check_exit_status $? 483 484 diff $pkeyutldat $pkeyutl_rsa_oaep_dec 485 check_exit_status $? 486 487 pkeyutlsc1=$key_dir/pkeyutl.sc1 488 pkeyutlsc2=$key_dir/pkeyutl.sc2 489 490 $openssl_bin pkeyutl -derive -inkey $genpkey_ec \ 491 -peerkey $genpkey_ec_2.pub -out $pkeyutlsc1 -hexdump 492 check_exit_status $? 493 494 $openssl_bin pkeyutl -derive -inkey $genpkey_ec_2 \ 495 -peerkey $genpkey_ec.pub -out $pkeyutlsc2 -hexdump 496 check_exit_status $? 497 498 diff $pkeyutlsc1 $pkeyutlsc2 499 check_exit_status $? 500} 501 502function test_pki { 503 section_message "setup local CA" 504 505 # 506 # prepare test openssl.cnf 507 # 508 509 cat << __EOF__ > $ssldir/openssl.cnf 510oid_section = new_oids 511[ new_oids ] 512tsa_policy1 = 1.2.3.4.1 513tsa_policy2 = 1.2.3.4.5.6 514tsa_policy3 = 1.2.3.4.5.7 515[ ca ] 516default_ca = CA_default 517[ CA_default ] 518dir = ./$ca_dir 519crl_dir = \$dir/crl 520database = \$dir/index.txt 521new_certs_dir = \$dir/newcerts 522serial = \$dir/serial 523crlnumber = \$dir/crlnumber 524default_days = 1 525default_md = default 526policy = policy_match 527[ policy_match ] 528countryName = match 529stateOrProvinceName = match 530organizationName = match 531organizationalUnitName = optional 532commonName = supplied 533emailAddress = optional 534[ req ] 535distinguished_name = req_distinguished_name 536[ req_distinguished_name ] 537countryName = Country Name 538countryName_default = JP 539countryName_min = 2 540countryName_max = 2 541stateOrProvinceName = State or Province Name 542stateOrProvinceName_default = Tokyo 543organizationName = Organization Name 544organizationName_default = TEST_DUMMY_COMPANY 545commonName = Common Name 546[ tsa ] 547default_tsa = tsa_config1 548[ tsa_config1 ] 549dir = ./$tsa_dir 550serial = \$dir/serial 551crypto_device = builtin 552digests = sha1, sha256, sha384, sha512 553default_policy = tsa_policy1 554other_policies = tsa_policy2, tsa_policy3 555[ tsa_ext ] 556keyUsage = critical,nonRepudiation 557extendedKeyUsage = critical,timeStamping 558[ ocsp_ext ] 559basicConstraints = CA:FALSE 560keyUsage = nonRepudiation,digitalSignature,keyEncipherment 561extendedKeyUsage = OCSPSigning 562__EOF__ 563 564 #---------#---------#---------#---------#---------#---------#--------- 565 566 # 567 # setup test CA 568 # 569 570 mkdir -p $ca_dir 571 mkdir -p $tsa_dir 572 mkdir -p $ocsp_dir 573 mkdir -p $server_dir 574 575 mkdir -p $ca_dir/certs 576 mkdir -p $ca_dir/private 577 mkdir -p $ca_dir/crl 578 mkdir -p $ca_dir/newcerts 579 chmod 700 $ca_dir/private 580 echo "01" > $ca_dir/serial 581 touch $ca_dir/index.txt 582 touch $ca_dir/crlnumber 583 echo "01" > $ca_dir/crlnumber 584 585 # 586 # setup test TSA 587 # 588 mkdir -p $tsa_dir/private 589 chmod 700 $tsa_dir/private 590 echo "01" > $tsa_dir/serial 591 touch $tsa_dir/index.txt 592 593 # 594 # setup test OCSP 595 # 596 mkdir -p $ocsp_dir/private 597 chmod 700 $ocsp_dir/private 598 599 #---------#---------#---------#---------#---------#---------#--------- 600 601 # --- CA initiate (generate CA key and cert) --- 602 603 start_message "req ... generate CA key and self signed cert" 604 605 ca_cert=$ca_dir/ca_cert.pem 606 ca_key=$ca_dir/private/ca_key.pem ca_pass=test-ca-pass 607 608 if [ $mingw = 0 ] ; then 609 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testCA.test_dummy.com/' 610 else 611 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testCA.test_dummy.com\' 612 fi 613 614 $openssl_bin req -new -x509 -batch -newkey rsa:2048 \ 615 -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3 \ 616 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 617 -config $ssldir/openssl.cnf -verbose \ 618 -subj $subj -days 1 -set_serial 1 -multivalue-rdn \ 619 -keyout $ca_key -passout pass:$ca_pass \ 620 -out $ca_cert -outform pem 621 check_exit_status $? 622 623 #---------#---------#---------#---------#---------#---------#--------- 624 625 # --- TSA initiate (generate TSA key and cert) --- 626 627 start_message "req ... generate TSA key and cert" 628 629 # generate CSR for TSA 630 631 tsa_csr=$tsa_dir/tsa_csr.pem 632 tsa_key=$tsa_dir/private/tsa_key.pem 633 tsa_pass=test-tsa-pass 634 635 if [ $mingw = 0 ] ; then 636 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testTSA.test_dummy.com/' 637 else 638 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testTSA.test_dummy.com\' 639 fi 640 641 $openssl_bin req -new -keyout $tsa_key -out $tsa_csr \ 642 -passout pass:$tsa_pass -subj $subj -asn1-kludge 643 check_exit_status $? 644 645 start_message "ca ... sign by CA with TSA extensions" 646 647 tsa_cert=$tsa_dir/tsa_cert.pem 648 649 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -keyform pem \ 650 -key $ca_pass -config $ssldir/openssl.cnf -create_serial \ 651 -policy policy_match -days 1 -md sha256 -extensions tsa_ext \ 652 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:32 \ 653 -multivalue-rdn -preserveDN -noemailDN \ 654 -in $tsa_csr -outdir $tsa_dir -out $tsa_cert -verbose -notext \ 655 > $tsa_cert.log 2>&1 656 check_exit_status $? 657 658 #---------#---------#---------#---------#---------#---------#--------- 659 660 # --- OCSP initiate (generate OCSP key and cert) --- 661 662 start_message "req ... generate OCSP key and cert" 663 664 # generate CSR for OCSP 665 666 ocsp_csr=$ocsp_dir/ocsp_csr.pem 667 ocsp_key=$ocsp_dir/private/ocsp_key.pem 668 669 if [ $mingw = 0 ] ; then 670 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testOCSP.test_dummy.com/' 671 else 672 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testOCSP.test_dummy.com\' 673 fi 674 675 $openssl_bin req -new -keyout $ocsp_key -nodes -out $ocsp_csr \ 676 -subj $subj -no-asn1-kludge 677 check_exit_status $? 678 679 start_message "ca ... sign by CA with OCSP extensions" 680 681 ocsp_cert=$ocsp_dir/ocsp_cert.pem 682 683 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -keyform pem \ 684 -key $ca_pass -out $ocsp_cert -extensions ocsp_ext \ 685 -startdate `date -u '+%y%m%d%H%M%SZ'` -enddate 491223235959Z \ 686 -subj $subj -infiles $ocsp_csr > $ocsp_cert.log 2>&1 687 check_exit_status $? 688 689 #---------#---------#---------#---------#---------#---------#--------- 690 691 # --- server-admin operations (generate server key and csr) --- 692 section_message "server-admin operations (generate server key and csr)" 693 694 server_key=$server_dir/server_key.pem 695 server_csr=$server_dir/server_csr.pem 696 server_pass=test-server-pass 697 698 if [ $mingw = 0 ] ; then 699 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=localhost.test_dummy.com/' 700 else 701 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=localhost.test_dummy.com\' 702 fi 703 704 start_message "genrsa ... generate server key#1" 705 706 $openssl_bin genrsa -aes256 -passout pass:$server_pass -out $server_key 707 check_exit_status $? 708 709 start_message "req ... generate server csr#1" 710 711 $openssl_bin req -new -subj $subj -sha256 \ 712 -key $server_key -keyform pem -passin pass:$server_pass \ 713 -addext 'subjectAltName = DNS:localhost.test_dummy.com' \ 714 -out $server_csr -outform pem 715 check_exit_status $? 716 717 start_message "req ... verify server csr#1" 718 719 $openssl_bin req -verify -in $server_csr -inform pem \ 720 -newhdr -noout -pubkey -subject -modulus -text \ 721 -nameopt multiline -reqopt compatible \ 722 -out $server_csr.verify.out 723 check_exit_status $? 724 725 start_message "req ... generate server csr#2 (interactive mode)" 726 727 revoke_key=$server_dir/revoke_key.pem 728 revoke_csr=$server_dir/revoke_csr.pem 729 revoke_pass=test-revoke-pass 730 731 $openssl_bin req -new -keyout $revoke_key -out $revoke_csr \ 732 -passout pass:$revoke_pass <<__EOF__ 733JP 734Tokyo 735TEST_DUMMY_COMPANY 736revoke.test_dummy.com 737__EOF__ 738 check_exit_status $? 739 740 ecdsa_key=$server_dir/ecdsa_key.pem 741 ecdsa_csr=$server_dir/ecdsa_csr.pem 742 ecdsa_pass=test-ecdsa-pass 743 744 if [ $mingw = 0 ] ; then 745 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=ecdsa.test_dummy.com/' 746 else 747 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=ecdsa.test_dummy.com\' 748 fi 749 750 start_message "ecparam ... generate server key#3" 751 752 $openssl_bin ecparam -name prime256v1 -genkey -out $ecdsa_key 753 check_exit_status $? 754 755 start_message "req ... generate server csr#3" 756 757 $openssl_bin req -new -subj $subj -sha256 \ 758 -key $ecdsa_key -keyform pem -passin pass:$ecdsa_pass \ 759 -addext 'subjectAltName = DNS:ecdsa.test_dummy.com' \ 760 -out $ecdsa_csr -outform pem 761 check_exit_status $? 762 763 start_message "req ... verify server csr#3" 764 765 $openssl_bin req -verify -in $ecdsa_csr -inform pem \ 766 -newhdr -noout -pubkey -subject -modulus -text \ 767 -nameopt multiline -reqopt compatible \ 768 -out $ecdsa_csr.verify.out 769 check_exit_status $? 770 771 #---------#---------#---------#---------#---------#---------#--------- 772 773 # --- CA operations (issue cert for server) --- 774 section_message "CA operations (issue cert for server)" 775 776 start_message "ca ... issue cert for server csr#1" 777 778 server_cert=$server_dir/server_cert.pem 779 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ 780 -in $server_csr -out $server_cert > $server_cert.log 2>&1 781 check_exit_status $? 782 783 start_message "x509 ... issue cert for server csr#2" 784 785 revoke_cert=$server_dir/revoke_cert.pem 786 $openssl_bin x509 -req -in $revoke_csr -CA $ca_cert -CAform pem \ 787 -CAkey $ca_key -CAkeyform pem \ 788 -CAserial $ca_dir/serial -set_serial 10 \ 789 -passin pass:$ca_pass -CAcreateserial -out $revoke_cert \ 790 > $revoke_cert.log 2>&1 791 check_exit_status $? 792 793 start_message "ca ... issue cert for server csr#3" 794 795 ecdsa_cert=$server_dir/ecdsa_cert.pem 796 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ 797 -in $ecdsa_csr -out $ecdsa_cert > $ecdsa_cert 2>&1 798 check_exit_status $? 799 800 #---------#---------#---------#---------#---------#---------#--------- 801 802 # --- CA operations (revoke cert and generate crl) --- 803 section_message "CA operations (revoke cert and generate crl)" 804 805 start_message "ca ... revoke server cert#2" 806 crl_file=$ca_dir/crl.pem 807 $openssl_bin ca -gencrl -out $crl_file -revoke $revoke_cert \ 808 -config $ssldir/openssl.cnf -name CA_default \ 809 -crldays 30 -crlhours 12 -crlsec 30 -updatedb \ 810 -crl_reason unspecified -crl_hold 1.2.840.10040.2.2 \ 811 -crl_compromise `date -u '+%Y%m%d%H%M%SZ'` \ 812 -crl_CA_compromise `date -u '+%Y%m%d%H%M%SZ'` \ 813 -keyfile $ca_key -passin pass:$ca_pass -cert $ca_cert \ 814 > $crl_file.log 2>&1 815 check_exit_status $? 816 817 start_message "ca ... show certificate status by serial number" 818 $openssl_bin ca -config $ssldir/openssl.cnf -status 1 819 820 start_message "crl ... CA generates CRL" 821 $openssl_bin crl -in $crl_file -fingerprint >> $crl_file.log 2>&1 822 check_exit_status $? 823 824 crl_p7=$ca_dir/crl.p7 825 start_message "crl2pkcs7 ... convert CRL to pkcs7" 826 $openssl_bin crl2pkcs7 -in $crl_file -certfile $ca_cert -out $crl_p7 827 check_exit_status $? 828 829 #---------#---------#---------#---------#---------#---------#--------- 830 831 # --- server-admin operations (check csr, verify cert, certhash) --- 832 section_message "server-admin operations (check csr, verify cert, certhash)" 833 834 start_message "asn1parse ... parse server csr#1" 835 $openssl_bin asn1parse -in $server_csr -i -dlimit 100 -length 1000 \ 836 -strparse 01 > $server_csr.asn1parse.out 837 check_exit_status $? 838 839 start_message "verify ... server cert#1" 840 $openssl_bin verify -verbose -CAfile $ca_cert -CRLfile $crl_file \ 841 -crl_check -issuer_checks -purpose sslserver $server_cert 842 check_exit_status $? 843 844 start_message "x509 ... get detail info about server cert#1" 845 $openssl_bin x509 -in $server_cert -text -C -dates -startdate -enddate \ 846 -fingerprint -issuer -issuer_hash -issuer_hash_old \ 847 -subject -hash -subject_hash -subject_hash_old -ocsp_uri \ 848 -ocspid -modulus -pubkey -serial -email -noout -trustout \ 849 -alias -clrtrust -clrreject -next_serial -checkend 3600 \ 850 -nameopt multiline -certopt compatible > $server_cert.x509.out 851 check_exit_status $? 852 853 if [ $mingw = 0 ] ; then 854 start_message "certhash" 855 $openssl_bin certhash -v $server_dir \ 856 > $server_dir/certhash.log 2>&1 857 check_exit_status $? 858 fi 859 860 # self signed 861 start_message "x509 ... generate self signed server cert" 862 server_self_cert=$server_dir/server_self_cert.pem 863 $openssl_bin x509 -in $server_cert -signkey $server_key -keyform pem \ 864 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 865 -passin pass:$server_pass -out $server_self_cert -days 1 866 check_exit_status $? 867 868 #---------#---------#---------#---------#---------#---------#--------- 869 870 # --- Netscape SPKAC operations --- 871 section_message "Netscape SPKAC operations" 872 873 # server-admin generates SPKAC 874 875 start_message "spkac" 876 spkacfile=$server_dir/spkac.file 877 878 $openssl_bin spkac -key $genpkey_rsa -challenge hello -out $spkacfile 879 check_exit_status $? 880 881 $openssl_bin spkac -in $spkacfile -verify -out $spkacfile.out 882 check_exit_status $? 883 884 spkacreq=$server_dir/spkac.req 885 cat << __EOF__ > $spkacreq 886countryName = JP 887stateOrProvinceName = Tokyo 888organizationName = TEST_DUMMY_COMPANY 889commonName = spkac.test_dummy.com 890__EOF__ 891 cat $spkacfile >> $spkacreq 892 893 # CA signs SPKAC 894 start_message "ca ... CA signs SPKAC csr" 895 spkaccert=$server_dir/spkac.cert 896 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ 897 -spkac $spkacreq -out $spkaccert > $spkaccert.log 2>&1 898 check_exit_status $? 899 900 start_message "x509 ... convert DER format SPKAC cert to PEM" 901 spkacpem=$server_dir/spkac.pem 902 $openssl_bin x509 -in $spkaccert -inform DER -out $spkacpem -outform PEM 903 check_exit_status $? 904 905 # server-admin cert verify 906 907 start_message "nseq" 908 $openssl_bin nseq -in $spkacpem -toseq -out $spkacpem.nseq 909 check_exit_status $? 910 911 #---------#---------#---------#---------#---------#---------#--------- 912 913 # --- user1 operations (generate user1 key and csr) --- 914 section_message "user1 operations (generate user1 key and csr)" 915 916 # trust 917 start_message "x509 ... trust testCA cert" 918 user1_trust=$user1_dir/user1_trust_ca.pem 919 $openssl_bin x509 -in $ca_cert -addtrust clientAuth \ 920 -setalias "trusted testCA" -purpose -out $user1_trust \ 921 > $user1_trust.log 2>&1 922 check_exit_status $? 923 924 start_message "req ... generate private key and csr for user1" 925 926 user1_key=$user1_dir/user1_key.pem 927 user1_csr=$user1_dir/user1_csr.pem 928 user1_pass=test-user1-pass 929 930 if [ $mingw = 0 ] ; then 931 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=user1.test_dummy.com/' 932 else 933 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=user1.test_dummy.com\' 934 fi 935 936 $openssl_bin req -new -keyout $user1_key -out $user1_csr \ 937 -passout pass:$user1_pass -subj $subj > $user1_csr.log 2>&1 938 check_exit_status $? 939 940 #---------#---------#---------#---------#---------#---------#--------- 941 942 # --- CA operations (issue cert for user1) --- 943 section_message "CA operations (issue cert for user1)" 944 945 start_message "ca ... issue cert for user1" 946 947 user1_cert=$user1_dir/user1_cert.pem 948 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ 949 -in $user1_csr -out $user1_cert > $user1_cert.log 2>&1 950 check_exit_status $? 951} 952 953function test_tsa { 954 # --- TSA operations --- 955 section_message "TSA operations" 956 957 tsa_dat=$user1_dir/tsa.dat 958 cat << __EOF__ > $tsa_dat 959Hello Bob, 960Sincerely yours 961Alice 962__EOF__ 963 964 # Query 965 start_message "ts ... create time stamp request" 966 967 tsa_tsq=$user1_dir/tsa.tsq 968 969 $openssl_bin ts -query -sha1 -data $tsa_dat -no_nonce -out $tsa_tsq 970 check_exit_status $? 971 972 start_message "ts ... print time stamp request" 973 974 $openssl_bin ts -query -in $tsa_tsq -text -out $tsa_tsq.log 975 check_exit_status $? 976 977 # Reply 978 start_message "ts ... create time stamp response for a request" 979 980 tsa_tsr=$user1_dir/tsa.tsr 981 982 $openssl_bin ts -reply -queryfile $tsa_tsq -inkey $tsa_key \ 983 -passin pass:$tsa_pass -signer $tsa_cert -chain $ca_cert \ 984 -config $ssldir/openssl.cnf -section tsa_config1 -cert \ 985 -policy 1.3.6.1.4.1.4146.2.3 -out $tsa_tsr 986 check_exit_status $? 987 988 # Verify 989 start_message "ts ... verify time stamp response" 990 991 $openssl_bin ts -verify -queryfile $tsa_tsq -in $tsa_tsr \ 992 -CAfile $ca_cert -untrusted $tsa_cert 993 check_exit_status $? 994} 995 996function test_cms { 997 # --- CMS operations --- 998 section_message "CMS operations" 999 1000 cms_txt=$user1_dir/cms.txt 1001 cms_sig=$user1_dir/cms.sig 1002 cms_enc=$user1_dir/cms.enc 1003 cms_dec=$user1_dir/cms.dec 1004 cms_sgr=$user1_dir/cms.sgr 1005 cms_ver=$user1_dir/cms.ver 1006 cms_out=$user1_dir/cms.out 1007 cms_dct=$user1_dir/cms.dct 1008 cms_dot=$user1_dir/cms.dot 1009 cms_dgc=$user1_dir/cms.dgc 1010 cms_dgv=$user1_dir/cms.dgv 1011 cms_ede=$user1_dir/cms.ede 1012 cms_edd=$user1_dir/cms.edd 1013 cms_srp=$user1_dir/cms.srp 1014 cms_pwe=$user1_dir/cms.pwe 1015 cms_pwd=$user1_dir/cms.pwd 1016 1017 cat << __EOF__ > $cms_txt 1018Hello Bob, 1019Sincerely yours 1020Alice 1021__EOF__ 1022 1023 # sign 1024 start_message "cms ... sign to message" 1025 1026 $openssl_bin cms -sign -in $cms_txt -text \ 1027 -out $cms_sig -outform smime \ 1028 -signer $user1_cert -inkey $user1_key -keyform pem \ 1029 -keyopt rsa_padding_mode:pss \ 1030 -passin pass:$user1_pass -md sha256 \ 1031 -from user1@test_dummy.com -to server@test_dummy.com \ 1032 -subject "test openssl cms" \ 1033 -receipt_request_from server@test_dummy.com \ 1034 -receipt_request_to user1@test_dummy.com 1035 check_exit_status $? 1036 1037 # encrypt 1038 start_message "cms ... encrypt message" 1039 1040 $openssl_bin cms -encrypt -aes256 -binary -in $cms_sig -inform smime \ 1041 -recip $server_cert -keyopt rsa_padding_mode:oaep \ 1042 -out $cms_enc 1043 check_exit_status $? 1044 1045 # decrypt 1046 start_message "cms ... decrypt message" 1047 1048 $openssl_bin cms -decrypt -in $cms_enc -out $cms_dec \ 1049 -recip $server_cert -inkey $server_key -passin pass:$server_pass 1050 check_exit_status $? 1051 1052 # verify 1053 start_message "cms ... verify message" 1054 1055 $openssl_bin cms -verify -in $cms_dec \ 1056 -CAfile $ca_cert -certfile $user1_cert -nointern \ 1057 -check_ss_sig -issuer_checks -policy_check -x509_strict \ 1058 -signer $cms_sgr -text -out $cms_ver -receipt_request_print \ 1059 > $cms_ver.log 2>&1 1060 check_exit_status $? 1061 1062 diff -b $cms_ver $cms_txt 1063 check_exit_status $? 1064 1065 # cmsout 1066 start_message "cms ... cmsout" 1067 1068 $openssl_bin cms -cmsout -in $cms_enc -print -out $cms_out 1069 check_exit_status $? 1070 1071 # data_create 1072 start_message "cms ... data_create" 1073 1074 $openssl_bin cms -data_create -in $cms_enc -out $cms_dct 1075 check_exit_status $? 1076 1077 # data_out 1078 start_message "cms ... data_out" 1079 1080 $openssl_bin cms -data_out -in $cms_dct -out $cms_dot 1081 check_exit_status $? 1082 1083 # digest_create 1084 start_message "cms ... digest_create" 1085 1086 $openssl_bin cms -digest_create -in $cms_txt -md sha256 -out $cms_dgc 1087 check_exit_status $? 1088 1089 # digest_verify 1090 start_message "cms ... digest_verify" 1091 1092 $openssl_bin cms -digest_verify -in $cms_dgc -md sha256 -out $cms_dgv 1093 check_exit_status $? 1094 1095 diff -b $cms_dgv $cms_txt 1096 check_exit_status $? 1097 1098 # compress 1099 1100 # uncompress 1101 1102 # EncryptedData_encrypt 1103 start_message "cms ... EncryptedData_encrypt" 1104 1105 $openssl_bin cms -EncryptedData_encrypt -in $cms_sig -out $cms_ede \ 1106 -aes128 -secretkey 00112233445566778899aabbccddeeff 1107 check_exit_status $? 1108 1109 # EncryptedData_decrypt 1110 start_message "cms ... EncryptedData_decrypt" 1111 1112 $openssl_bin cms -EncryptedData_decrypt -in $cms_ede -out $cms_edd \ 1113 -aes128 -secretkey 00112233445566778899aabbccddeeff 1114 check_exit_status $? 1115 1116 diff -b $cms_edd $cms_sig 1117 check_exit_status $? 1118 1119 # sign_receipt 1120 start_message "cms ... sign to receipt" 1121 1122 $openssl_bin cms -sign_receipt -in $cms_sig -out $cms_srp \ 1123 -signer $server_cert -inkey $server_key \ 1124 -passin pass:$server_pass -md sha256 1125 check_exit_status $? 1126 1127 # verify_receipt 1128 start_message "cms ... verify receipt" 1129 1130 $openssl_bin cms -verify_receipt $cms_srp -rctform smime -in $cms_sig \ 1131 -CAfile $ca_cert -certfile $server_cert 1132 check_exit_status $? 1133 1134 # encrypt with pwri 1135 start_message "cms ... encrypt with pwri" 1136 1137 $openssl_bin cms -encrypt -camellia256 -in $cms_txt -out $cms_pwe \ 1138 -pwri_password abcdefg 1139 check_exit_status $? 1140 1141 # decrypt with pwri 1142 start_message "cms ... decrypt with pwri" 1143 1144 $openssl_bin cms -decrypt -camellia256 -in $cms_pwe -out $cms_pwd \ 1145 -pwri_password abcdefg 1146 check_exit_status $? 1147 1148 diff -b $cms_pwd $cms_txt 1149 check_exit_status $? 1150} 1151 1152function test_smime { 1153 # --- S/MIME operations --- 1154 section_message "S/MIME operations" 1155 1156 smime_txt=$user1_dir/smime.txt 1157 smime_enc=$user1_dir/smime.enc 1158 smime_sig=$user1_dir/smime.sig 1159 smime_p7o=$user1_dir/smime.p7o 1160 smime_sgr=$user1_dir/smime.sgr 1161 smime_ver=$user1_dir/smime.ver 1162 smime_dec=$user1_dir/smime.dec 1163 1164 cat << __EOF__ > $smime_txt 1165Hello Bob, 1166Sincerely yours 1167Alice 1168__EOF__ 1169 1170 # encrypt 1171 start_message "smime ... encrypt message" 1172 1173 $openssl_bin smime -encrypt -aes256 -binary -in $smime_txt \ 1174 -out $smime_enc $server_cert 1175 check_exit_status $? 1176 1177 # sign 1178 start_message "smime ... sign to message" 1179 1180 $openssl_bin smime -sign -in $smime_enc -text -inform smime \ 1181 -out $smime_sig -outform smime \ 1182 -signer $user1_cert -inkey $user1_key -keyform pem \ 1183 -passin pass:$user1_pass -md sha256 \ 1184 -from user1@test_dummy.com -to server@test_dummy.com \ 1185 -subject "test openssl smime" 1186 check_exit_status $? 1187 1188 # pk7out 1189 start_message "smime ... pk7out from message" 1190 1191 $openssl_bin smime -pk7out -in $smime_sig -out $smime_p7o 1192 check_exit_status $? 1193 1194 # verify 1195 start_message "smime ... verify message" 1196 1197 $openssl_bin smime -verify -in $smime_sig \ 1198 -CAfile $ca_cert -certfile $user1_cert -nointern \ 1199 -check_ss_sig -issuer_checks -policy_check -x509_strict \ 1200 -signer $smime_sgr -text -out $smime_ver 1201 check_exit_status $? 1202 1203 # decrypt 1204 start_message "smime ... decrypt message" 1205 1206 $openssl_bin smime -decrypt -in $smime_ver -out $smime_dec \ 1207 -recip $server_cert -inkey $server_key -passin pass:$server_pass 1208 check_exit_status $? 1209 1210 diff $smime_dec $smime_txt 1211 check_exit_status $? 1212} 1213 1214function test_ocsp { 1215 # --- OCSP operations --- 1216 section_message "OCSP operations" 1217 1218 # get key without pass 1219 user1_key_nopass=$user1_dir/user1_key_nopass.pem 1220 $openssl_bin pkey -in $user1_key -passin pass:$user1_pass \ 1221 -out $user1_key_nopass 1222 check_exit_status $? 1223 1224 # request 1225 start_message "ocsp ... create OCSP request" 1226 1227 ocsp_req=$user1_dir/ocsp_req.der 1228 $openssl_bin ocsp -issuer $ca_cert -cert $server_cert \ 1229 -cert $revoke_cert -serial 1 -nonce -no_certs -CAfile $ca_cert \ 1230 -signer $user1_cert -signkey $user1_key_nopass \ 1231 -sign_other $user1_cert -sha256 \ 1232 -reqout $ocsp_req -req_text -out $ocsp_req.out 1233 check_exit_status $? 1234 1235 # response 1236 start_message "ocsp ... create OCPS response for a request" 1237 1238 ocsp_res=$user1_dir/ocsp_res.der 1239 $openssl_bin ocsp -index $ca_dir/index.txt -CA $ca_cert \ 1240 -CAfile $ca_cert -rsigner $ocsp_cert -rkey $ocsp_key \ 1241 -reqin $ocsp_req -rother $ocsp_cert -resp_no_certs -noverify \ 1242 -nmin 60 -validity_period 300 -status_age 300 \ 1243 -respout $ocsp_res -resp_text -out $ocsp_res.out 1244 check_exit_status $? 1245 1246 # ocsp server 1247 start_message "ocsp ... start OCSP server in background" 1248 1249 ocsp_port=8888 1250 1251 ocsp_svr_log=$user1_dir/ocsp_svr.log 1252 $openssl_bin ocsp -index $ca_dir/index.txt -CA $ca_cert \ 1253 -CAfile $ca_cert -rsigner $ocsp_cert -rkey $ocsp_key \ 1254 -host localhost -port $ocsp_port -path / -ndays 1 -nrequest 1 \ 1255 -resp_key_id -text -out $ocsp_svr_log & 1256 check_exit_status $? 1257 ocsp_svr_pid=$! 1258 echo "ocsp server pid = [ $ocsp_svr_pid ]" 1259 sleep 1 1260 1261 # send query to ocsp server 1262 start_message "ocsp ... send OCSP request to server" 1263 1264 ocsp_qry=$user1_dir/ocsp_qry.der 1265 $openssl_bin ocsp -issuer $ca_cert -cert $server_cert \ 1266 -cert $revoke_cert -CAfile $ca_cert -no_nonce \ 1267 -url http://localhost:$ocsp_port -timeout 10 -text \ 1268 -header Host localhost \ 1269 -respout $ocsp_qry -out $ocsp_qry.out 1270 check_exit_status $? 1271 1272 # verify response from server 1273 start_message "ocsp ... verify OCSP response from server" 1274 1275 $openssl_bin ocsp -respin $ocsp_qry -CAfile $ca_cert \ 1276 -ignore_err -no_signature_verify -no_cert_verify -no_chain \ 1277 -no_cert_checks -no_explicit -trust_other -no_intern \ 1278 -verify_other $ocsp_cert -VAfile $ocsp_cert 1279 check_exit_status $? 1280} 1281 1282function test_pkcs { 1283 # --- PKCS operations --- 1284 section_message "PKCS operations" 1285 1286 pkcs_pass=test-pkcs-pass 1287 1288 start_message "pkcs7 ... output certs in crl(pkcs7)" 1289 $openssl_bin pkcs7 -in $crl_p7 -print_certs -text -out $crl_p7.out 1290 check_exit_status $? 1291 1292 start_message "pkcs8 ... convert key to pkcs8" 1293 $openssl_bin pkcs8 -in $user1_key -topk8 -out $user1_key.p8 \ 1294 -passin pass:$user1_pass -passout pass:$user1_pass \ 1295 -v1 pbeWithSHA1AndDES-CBC -v2 des3 1296 check_exit_status $? 1297 1298 start_message "pkcs8 ... convert pkcs8 to key in DER format" 1299 $openssl_bin pkcs8 -in $user1_key.p8 -passin pass:$user1_pass \ 1300 -outform DER -out $user1_key.p8.der 1301 check_exit_status $? 1302 1303 start_message "pkcs12 ... create" 1304 $openssl_bin pkcs12 -export -in $server_cert -inkey $server_key \ 1305 -passin pass:$server_pass -certfile $ca_cert -CAfile $ca_cert \ 1306 -caname "caname_server_p12" \ 1307 -certpbe AES-256-CBC -keypbe AES-256-CBC -chain \ 1308 -name "name_server_p12" -des3 -maciter -macalg sha256 \ 1309 -CSP "csp_server_p12" -LMK -keyex \ 1310 -passout pass:$pkcs_pass -out $server_cert.p12 1311 check_exit_status $? 1312 1313 start_message "pkcs12 ... verify" 1314 $openssl_bin pkcs12 -in $server_cert.p12 -passin pass:$pkcs_pass -info \ 1315 -noout > $server_cert.p12.log 2>&1 1316 check_exit_status $? 1317 1318 start_message "pkcs12 ... private key to PEM without encryption" 1319 $openssl_bin pkcs12 -in $server_cert.p12 -password pass:$pkcs_pass \ 1320 -nocerts -nomacver -nodes -out $server_cert.p12.pem 1321 check_exit_status $? 1322} 1323 1324function test_sc_by_protocol_version { 1325 cid=$1 1326 ver=$2 1327 msg=$3 1328 1329 s_client_out=$user1_dir/s_client_${sc}_${ver}.out 1330 1331 start_message "s_client ... connect to TLS/SSL test server by $ver" 1332 sleep $test_pause_sec 1333 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1334 -$ver -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1335 check_exit_status $? 1336 1337 # OpenSSL1.1.1 with TLSv1.3 does not call SSL_SESSION_print() until 1338 # NewSessionTicket arrival 1339 if ! [ $cid = "1" -a $ver = "tls1_3" ] ; then 1340 grep "$msg" $s_client_out > /dev/null 1341 check_exit_status $? 1342 fi 1343 1344 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1345 check_exit_status $? 1346} 1347 1348function test_sc_all_cipher { 1349 sc=$1 1350 ver=$2 1351 1352 copt=cipher 1353 ciphers=$user1_dir/ciphers_${sc}_${ver} 1354 1355 if [ $ver = "tls1_3" ] ; then 1356 if [ $c_id = "0" ] ; then 1357 echo "AEAD-AES256-GCM-SHA384" > $ciphers 1358 echo "AEAD-CHACHA20-POLY1305-SHA256" >> $ciphers 1359 echo "AEAD-AES128-GCM-SHA256" >> $ciphers 1360 else 1361 echo "TLS_AES_256_GCM_SHA384" > $ciphers 1362 echo "TLS_CHACHA20_POLY1305_SHA256" >> $ciphers 1363 echo "TLS_AES_128_GCM_SHA256" >> $ciphers 1364 copt=ciphersuites 1365 fi 1366 else 1367 s_ciph=$server_dir/s_ciph_${sc}_${ver} 1368 cipher_string="" 1369 if [ $s_id = "0" ] ; then 1370 if [ $ecdsa_tests = 0 ] ; then 1371 cipher_string="ALL:!ECDSA:!kGOST:!TLSv1.3" 1372 else 1373 cipher_string="ECDSA+TLSv1.2:!TLSv1.3" 1374 fi 1375 fi 1376 $s_bin ciphers -v $cipher_string | awk '{print $1}' > $s_ciph 1377 1378 c_ciph=$user1_dir/c_ciph_${sc}_${ver} 1379 cipher_string="" 1380 if [ $c_id = "0" ] ; then 1381 if [ $ecdsa_tests = 0 ] ; then 1382 cipher_string="ALL:!ECDSA:!kGOST:!TLSv1.3" 1383 else 1384 cipher_string="ECDSA+TLSv1.2:!TLSv1.3" 1385 fi 1386 fi 1387 $c_bin ciphers -v $cipher_string | awk '{print $1}' > $c_ciph 1388 1389 grep -x -f $s_ciph $c_ciph | sort -R > $ciphers 1390 fi 1391 1392 cnum=0 1393 for c in `cat $ciphers` ; do 1394 cnum=`expr $cnum + 1` 1395 cnstr=`printf %03d $cnum` 1396 s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_${cnstr}_${c}.out 1397 1398 start_message "s_client ... connect to TLS/SSL test server with [ $cnstr ] $ver $c" 1399 sleep $test_pause_sec 1400 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1401 -$ver -$copt $c \ 1402 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1403 check_exit_status $? 1404 1405 grep "Cipher is $c" $s_client_out > /dev/null 1406 check_exit_status $? 1407 1408 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1409 check_exit_status $? 1410 done 1411} 1412 1413function test_sc_session_reuse { 1414 sc=$1 1415 ver=$2 1416 sess_dat=$user1_dir/s_client_${sc}_${ver}_sess.dat 1417 1418 # Get session ticket to reuse 1419 1420 s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_reuse_1.out 1421 1422 start_message "s_client ... connect to TLS/SSL test server to get session id $ver" 1423 sleep $test_pause_sec 1424 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1425 -$ver -alpn "spdy/3,http/1.1" -sess_out $sess_dat \ 1426 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1427 check_exit_status $? 1428 1429 grep '^New, TLS.*$' $s_client_out > /dev/null 1430 check_exit_status $? 1431 1432 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1433 check_exit_status $? 1434 1435 # Reuse session ticket 1436 1437 s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_reuse_2.out 1438 1439 start_message "s_client ... connect to TLS/SSL test server reusing session id $ver" 1440 sleep $test_pause_sec 1441 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1442 -$ver -sess_in $sess_dat \ 1443 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1444 check_exit_status $? 1445 1446 grep '^Reused, TLS.*$' $s_client_out > /dev/null 1447 check_exit_status $? 1448 1449 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1450 check_exit_status $? 1451 1452 # sess_id 1453 1454 start_message "sess_id" 1455 $c_bin sess_id -in $sess_dat -text -out $sess_dat.out 1456 check_exit_status $? 1457} 1458 1459function test_sc_verify { 1460 sc=$1 1461 ver=$2 1462 1463 # invalid verification pattern 1464 1465 s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_invalid.out 1466 1467 start_message "s_client ... connect to tls/ssl test server but verify error $ver" 1468 sleep $test_pause_sec 1469 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1470 -$ver -showcerts -crl_check -issuer_checks -policy_check \ 1471 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1472 check_exit_status $? 1473 1474 grep 'verify return code: 0 (ok)' $s_client_out > /dev/null 1475 if [ $? -eq 0 ] ; then 1476 check_exit_status 1 1477 else 1478 check_exit_status 0 1479 fi 1480} 1481 1482function test_server_client { 1483 # --- client/server operations (TLS) --- 1484 section_message "client/server operations (TLS)" 1485 1486 s_id="$1" 1487 c_id="$2" 1488 sc="$1$2" 1489 1490 test_pause_sec=0.2 1491 1492 if [ $s_id = "0" ] ; then 1493 s_bin=$openssl_bin 1494 else 1495 s_bin=$other_openssl_bin 1496 fi 1497 1498 if [ $c_id = "0" ] ; then 1499 c_bin=$openssl_bin 1500 else 1501 c_bin=$other_openssl_bin 1502 fi 1503 1504 echo "s_server is [`$s_bin version`]" 1505 echo "s_client is [`$c_bin version`]" 1506 1507 host="localhost" 1508 port=4433 1509 s_server_out=$server_dir/s_server_${sc}_tls.out 1510 1511 if [ $ecdsa_tests = 0 ] ; then 1512 echo "Using RSA certificate" 1513 crt=$server_cert 1514 key=$server_key 1515 pwd=$server_pass 1516 else 1517 echo "Using ECDSA certificate" 1518 crt=$ecdsa_cert 1519 key=$ecdsa_key 1520 pwd=$ecdsa_pass 1521 fi 1522 1523 $s_bin version | grep 'OpenSSL 1.1.1' > /dev/null 1524 if [ $? -eq 0 ] ; then 1525 extra_opts="-4" 1526 else 1527 extra_opts="" 1528 fi 1529 1530 start_message "s_server ... start TLS/SSL test server" 1531 $s_bin s_server -accept $port -CAfile $ca_cert \ 1532 -cert $crt -key $key -pass pass:$pwd \ 1533 -context "appstest.sh" -id_prefix "APPSTEST.SH" -crl_check \ 1534 -alpn "http/1.1,spdy/3" -www -cipher ALL $extra_opts \ 1535 -msg -tlsextdebug > $s_server_out 2>&1 & 1536 check_exit_status $? 1537 s_server_pid=$! 1538 echo "s_server pid = [ $s_server_pid ]" 1539 sleep 1 1540 1541 # test by protocol version 1542 test_sc_by_protocol_version $c_id tls1 'Protocol : TLSv1$' 1543 test_sc_by_protocol_version $c_id tls1_1 'Protocol : TLSv1\.1$' 1544 test_sc_by_protocol_version $c_id tls1_2 'Protocol : TLSv1\.2$' 1545 test_sc_by_protocol_version $c_id tls1_3 'Protocol : TLSv1\.3$' 1546 1547 # all available ciphers with random order 1548 test_sc_all_cipher $sc tls1_2 1549 test_sc_all_cipher $sc tls1_3 1550 1551 # session resumption 1552 test_sc_session_reuse $sc tls1_2 1553 1554 # invalid verification pattern 1555 test_sc_verify $sc tls1_2 1556 test_sc_verify $sc tls1_3 1557 1558 # s_time 1559 start_message "s_time ... connect to TLS/SSL test server" 1560 $c_bin s_time -connect $host:$port -CApath $ca_dir -time 1 \ 1561 > $server_dir/s_time_${sc}.log 1562 check_exit_status $? 1563 1564 stop_s_server 1565} 1566 1567function test_speed { 1568 # === PERFORMANCE === 1569 section_message "PERFORMANCE" 1570 1571 if [ $no_long_tests = 0 ] ; then 1572 start_message "speed" 1573 $openssl_bin speed sha512 rsa2048 -multi 2 -elapsed 1574 check_exit_status $? 1575 else 1576 start_message "SKIPPING speed (quick mode)" 1577 fi 1578} 1579 1580function test_version { 1581 # --- VERSION INFORMATION --- 1582 section_message "VERSION INFORMATION" 1583 1584 start_message "version" 1585 $openssl_bin version -a 1586 check_exit_status $? 1587} 1588 1589#---------#---------#---------#---------#---------#---------#---------#--------- 1590 1591openssl_bin=${OPENSSL:-/usr/bin/openssl} 1592other_openssl_bin=${OTHER_OPENSSL:-/usr/local/bin/eopenssl11} 1593 1594ecdsa_tests=0 1595interop_tests=0 1596no_long_tests=0 1597 1598while [ "$1" != "" ]; do 1599 case $1 in 1600 -e | --ecdsa) 1601 shift 1602 ecdsa_tests=1 1603 ;; 1604 -i | --interop) shift 1605 interop_tests=1 1606 ;; 1607 -q | --quick ) shift 1608 no_long_tests=1 1609 ;; 1610 * ) usage 1611 exit 1 1612 esac 1613done 1614 1615if [ ! -x $openssl_bin ] ; then 1616 echo ":-< \$OPENSSL [$openssl_bin] is not executable." 1617 exit 1 1618fi 1619 1620if [ $interop_tests = 1 -a ! -x $other_openssl_bin ] ; then 1621 echo ":-< \$OTHER_OPENSSL [$other_openssl_bin] is not executable." 1622 exit 1 1623fi 1624 1625# 1626# create ssldir, and all files generated by this script goes under this dir. 1627# 1628ssldir="appstest_dir" 1629 1630if [ -d $ssldir ] ; then 1631 echo "directory [ $ssldir ] exists, this script deletes this directory ..." 1632 /bin/rm -rf $ssldir 1633fi 1634 1635mkdir -p $ssldir 1636 1637ca_dir=$ssldir/testCA 1638tsa_dir=$ssldir/testTSA 1639ocsp_dir=$ssldir/testOCSP 1640server_dir=$ssldir/server 1641user1_dir=$ssldir/user1 1642mkdir -p $user1_dir 1643key_dir=$ssldir/key 1644mkdir -p $key_dir 1645 1646export OPENSSL_CONF=$ssldir/openssl.cnf 1647touch $OPENSSL_CONF 1648 1649uname_s=`uname -s | grep 'MINGW'` 1650if [ "$uname_s" = "" ] ; then 1651 mingw=0 1652else 1653 mingw=1 1654fi 1655 1656# 1657# process tests 1658# 1659test_usage_lists_others 1660test_md 1661test_encoding_cipher 1662test_key 1663test_pki 1664test_tsa 1665test_cms 1666test_smime 1667test_ocsp 1668test_pkcs 1669test_server_client 0 0 1670if [ $interop_tests = 1 ] ; then 1671 test_server_client 0 1 1672 test_server_client 1 0 1673fi 1674test_speed 1675test_version 1676 1677section_message "END" 1678 1679exit 0 1680 1681