xref: /freebsd/crypto/openssl/test/recipes/25-test_verify_store.t (revision 3f0efe05432b1633991114ca4ca330102a561959) 
1#! /usr/bin/env perl
2# Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
3#
4# Licensed under the Apache License 2.0 (the "License").  You may not use
5# this file except in compliance with the License.  You can obtain a copy
6# in the file LICENSE in the source distribution or at
7# https://www.openssl.org/source/license.html
8
9use strict;
10use warnings;
11
12use OpenSSL::Test qw/:DEFAULT with bldtop_file srctop_file cmdstr/;
13use OpenSSL::Test::Utils;
14
15setup("test_verify_store");
16
17plan tests => 10;
18
19my $dummycnf = srctop_file("apps", "openssl.cnf");
20my $cakey = srctop_file("test", "certs", "ca-key.pem");
21my $ukey = srctop_file("test", "certs", "ee-key.pem");
22
23my $cnf = srctop_file("test", "ca-and-certs.cnf");
24my $CAkey = "keyCA.ss";
25my $CAcert="certCA.ss";
26my $CAserial="certCA.srl";
27my $CAreq="reqCA.ss";
28my $CAreq2="req2CA.ss"; # temp
29my $Ukey="keyU.ss";
30my $Ureq="reqU.ss";
31my $Ucert="certU.ss";
32
33SKIP: {
34    req( 'make cert request',
35         qw(-new -section userreq),
36         -config       => $cnf,
37         -out          => $CAreq,
38         -key          => $cakey,
39         -keyout       => $CAkey );
40
41    skip 'failure', 8 unless
42        x509( 'convert request into self-signed cert',
43              qw(-req -CAcreateserial -days 30),
44              qw(-extensions v3_ca),
45              -in       => $CAreq,
46              -out      => $CAcert,
47              -signkey  => $CAkey,
48              -extfile  => $cnf );
49
50    skip 'failure', 7 unless
51        x509( 'convert cert into a cert request',
52              qw(-x509toreq),
53              -in       => $CAcert,
54              -out      => $CAreq2,
55              -signkey  => $CAkey );
56
57    skip 'failure', 6 unless
58        req( 'verify request 1',
59             qw(-verify -noout -section userreq),
60             -config    => $dummycnf,
61             -in        => $CAreq );
62
63    skip 'failure', 5 unless
64        req( 'verify request 2',
65             qw(-verify -noout -section userreq),
66             -config    => $dummycnf,
67             -in        => $CAreq2 );
68
69    skip 'failure', 4 unless
70        verify( 'verify signature',
71                -CAstore => $CAcert,
72                $CAcert );
73
74    skip 'failure', 3 unless
75        req( 'make a user cert request',
76             qw(-new -section userreq),
77             -config  => $cnf,
78             -out     => $Ureq,
79             -key     => $ukey,
80             -keyout  => $Ukey );
81
82    skip 'failure', 2 unless
83        x509( 'sign user cert request',
84              qw(-req -CAcreateserial -days 30 -extensions v3_ee),
85              -in     => $Ureq,
86              -out    => $Ucert,
87              -CA     => $CAcert,
88              -CAkey  => $CAkey,
89              -CAserial => $CAserial,
90              -extfile => $cnf )
91        && verify( undef,
92                   -CAstore => $CAcert,
93                   $Ucert );
94
95    skip 'failure', 0 unless
96        x509( 'Certificate details',
97              qw(-subject -issuer -startdate -enddate -noout),
98              -in     => $Ucert );
99}
100
101sub verify {
102    my $title = shift;
103
104    ok(run(app([qw(openssl verify), @_])), $title);
105}
106
107sub req {
108    my $title = shift;
109
110    ok(run(app([qw(openssl req), @_])), $title);
111}
112
113sub x509 {
114    my $title = shift;
115
116    ok(run(app([qw(openssl x509), @_])), $title);
117}
118