3 # Copyright (c) 2005 - 2007 Kungliga Tekniska Högskolan
4 # (Royal Institute of Technology, Stockholm, Sweden).
7 # Redistribution and use in source and binary forms, with or without
8 # modification, are permitted provided that the following conditions
11 # 1. Redistributions of source code must retain the above copyright
12 # notice, this list of conditions and the following disclaimer.
14 # 2. Redistributions in binary form must reproduce the above copyright
15 # notice, this list of conditions and the following disclaimer in the
16 # documentation and/or other materials provided with the distribution.
18 # 3. Neither the name of the Institute nor the names of its contributors
19 # may be used to endorse or promote products derived from this software
20 # without specific prior written permission.
22 # THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
23 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 # ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
26 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
40 stat
="--statistic-file=${objdir}/statfile"
42 hxtool
="${TESTS_ENVIRONMENT} ./hxtool ${stat}"
44 if ${hxtool} info |
grep 'rsa: hcrypto null RSA' > /dev
/null
; then
47 if ${hxtool} info |
grep 'rand: not available' > /dev
/null
; then
51 ${hxtool} request-create \
52 --subject="CN=Love,DC=it,DC=su,DC=se" \
53 --key="FILE:$srcdir/data/key.der" \
54 "${objdir}/request.out" ||
exit 1
56 ${hxtool} request-print \
57 PKCS10
:request.out
> /dev
/null ||
exit 1
59 ${hxtool} request-create \
60 --subject="CN=Love,DC=it,DC=su,DC=se" \
61 --eku=1.2.3.4.5.6.7 --eku=1.2.3.4.5.6.8 \
62 --registered=1.2.3.4.5.6.9 --eku=1.2.3.4.5.6.10 \
63 --dnsname=nutcracker.
test.h5l.se \
64 --dnsname=foo.nutcracker.
test.h5l.se \
65 --kerberos=HTTP
/foo.nutcracker.it.su.se@TEST.H5L.SE \
66 --kerberos=host
/foo.nutcracker.it.su.se@TEST.H5L.SE \
67 --email=foo@
test.h5l.se \
68 --key="FILE:$srcdir/data/key.der" \
69 "${objdir}/request.out" ||
exit 1
71 cat > "$objdir/expected" <<EOF
73 PKCS#10 CertificationRequest:
74 name: CN=Love,DC=it,DC=su,DC=se
75 eku: {1.2.3.4.5.6.7}, {1.2.3.4.5.6.8}, {1.2.3.4.5.6.10}
76 san: rfc822Name: foo@test.h5l.se
77 san: dNSName: nutcracker.test.h5l.se
78 san: dNSName: foo.nutcracker.test.h5l.se
79 san: pkinit: HTTP/foo.nutcracker.it.su.se@TEST.H5L.SE
80 san: pkinit: host/foo.nutcracker.it.su.se@TEST.H5L.SE
81 san: registeredID: 1.2.3.4.5.6.9
84 # Check that we got what we wanted:
85 ${hxtool} request-print \
86 PKCS10
:request.out
> "${objdir}/actual" ||
exit 1
88 diff "$objdir/expected" "${objdir}/actual" ||
exit 1
90 # Check that OpenSSL can parse our request:
91 if openssl version
> /dev
/null
; then
92 openssl req
-inform DER
-in "${objdir}/request.out" -text |
head -25 > "${objdir}/actual"
94 # Various versions of openssl differ slightly in their text output for our
95 # CSR. Figure out what to expect:
96 if grep "Version: 0" "${objdir}/actual" > /dev
/null
; then
101 if grep "RSA Public-Key:" "${objdir}/actual" > /dev
/null
; then
106 # Note interpolation of $v and $k in the here doc below:
107 cat > "$objdir/expected" <<EOF
111 Subject: DC = se, DC = su, DC = it, CN = Love
112 Subject Public Key Info:
113 Public Key Algorithm: rsaEncryption
114 ${k}Public-Key: (1024 bit)
116 00:c2:aa:a2:42:b7:5b:99:a3:fd:ba:f0:9b:75:db:
117 ef:3c:9b:8c:cf:63:5f:46:d8:95:be:09:4a:a7:76:
118 79:77:61:30:ef:0b:98:d2:47:ea:9c:09:b9:b9:b7:
119 15:ac:4b:9c:2d:3f:f0:d9:99:9d:4d:5a:68:67:24:
120 58:5e:65:60:13:9f:4d:dc:2f:03:1d:cd:e9:b6:33:
121 c2:5c:c6:de:c9:93:6c:ec:8d:9a:67:0e:dd:31:20:
122 ac:91:39:7a:c1:8f:39:65:ff:b3:1f:cf:7a:aa:79:
123 8b:ed:eb:ad:a0:be:01:10:4c:5a:a7:47:1d:c6:ee:
124 79:39:5c:c7:11:6c:b9:e7:2b
125 Exponent: 65537 (0x10001)
127 Requested Extensions:
128 X509v3 Extended Key Usage: critical
129 1.2.3.4.5.6.7, 1.2.3.4.5.6.8, 1.2.3.4.5.6.10
130 X509v3 Subject Alternative Name:
131 email:foo@test.h5l.se, DNS:nutcracker.test.h5l.se, DNS:foo.nutcracker.test.h5l.se, othername:<unsupported>, othername:<unsupported>, Registered ID:1.2.3.4.5.6.9
132 Signature Algorithm: sha256WithRSAEncryption
134 if ! diff -u -w "${objdir}/expected" "${objdir}/actual"; then
135 cat > "$objdir/expected" <<EOF
139 Subject: DC = se, DC = su, DC = it, CN = Love
140 Subject Public Key Info:
141 Public Key Algorithm: rsaEncryption
142 ${k}Public-Key: (1024 bit)
144 00:c2:aa:a2:42:b7:5b:99:a3:fd:ba:f0:9b:75:db:
145 ef:3c:9b:8c:cf:63:5f:46:d8:95:be:09:4a:a7:76:
146 79:77:61:30:ef:0b:98:d2:47:ea:9c:09:b9:b9:b7:
147 15:ac:4b:9c:2d:3f:f0:d9:99:9d:4d:5a:68:67:24:
148 58:5e:65:60:13:9f:4d:dc:2f:03:1d:cd:e9:b6:33:
149 c2:5c:c6:de:c9:93:6c:ec:8d:9a:67:0e:dd:31:20:
150 ac:91:39:7a:c1:8f:39:65:ff:b3:1f:cf:7a:aa:79:
151 8b:ed:eb:ad:a0:be:01:10:4c:5a:a7:47:1d:c6:ee:
152 79:39:5c:c7:11:6c:b9:e7:2b
153 Exponent: 65537 (0x10001)
155 Requested Extensions:
156 X509v3 Extended Key Usage: critical
157 1.2.3.4.5.6.7, 1.2.3.4.5.6.8, 1.2.3.4.5.6.10
158 X509v3 Subject Alternative Name:
159 email:foo@test.h5l.se, DNS:nutcracker.test.h5l.se, DNS:foo.nutcracker.test.h5l.se, othername: 1.3.6.1.5.2.2::<unsupported>, othername: 1.3.6.1.5.2.2::<unsupported>, Registered ID:1.2.3.4.5.6.9
160 Signature Algorithm: sha256WithRSAEncryption
165 ${hxtool} request-create \
168 --subject="cn=ca-cert" \
169 --key=FILE
:$srcdir/data
/key.der \
170 pkcs10-request.der ||
exit 1
171 ${hxtool} request-print PKCS10
:pkcs10-request.der
> "${objdir}/actual"||
exit 1
172 cat > "$objdir/expected" <<EOF
174 PKCS#10 CertificationRequest:
179 diff "$objdir/expected" "${objdir}/actual" ||
exit 1
181 ${hxtool} request-create \
183 --subject="cn=ca-cert" \
184 --key=FILE
:$srcdir/data
/key.der \
185 pkcs10-request.der ||
exit 1
186 ${hxtool} request-print PKCS10
:pkcs10-request.der
> "${objdir}/actual"||
exit 1
187 cat > "$objdir/expected" <<EOF
189 PKCS#10 CertificationRequest:
191 pathLenConstraint: unspecified
194 diff "$objdir/expected" "${objdir}/actual" ||
exit 1
196 ${hxtool} request-create \
198 --subject="cn=ca-cert" \
199 --key=FILE
:$srcdir/data
/key.der \
200 pkcs10-request.der ||
exit 1
201 ${hxtool} request-print PKCS10
:pkcs10-request.der
> "${objdir}/actual" ||
exit 1
202 cat > "$objdir/expected" <<EOF
204 PKCS#10 CertificationRequest:
206 pathLenConstraint: unspecified
209 diff "$objdir/expected" "${objdir}/actual" ||
exit 1