1#! /usr/bin/env perl 2# Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved. 3# 4# Licensed under the Apache License 2.0 (the "License"). You may not use 5# this file except in compliance with the License. You can obtain a copy 6# in the file LICENSE in the source distribution or at 7# https://www.openssl.org/source/license.html 8 9 10use strict; 11use warnings; 12 13use File::Spec; 14use OpenSSL::Test::Utils; 15use OpenSSL::Test qw/:DEFAULT srctop_file/; 16 17setup("test_x509"); 18 19plan tests => 29; 20 21# Prevent MSys2 filename munging for arguments that look like file paths but 22# aren't 23$ENV{MSYS2_ARG_CONV_EXCL} = "/CN="; 24 25require_ok(srctop_file("test", "recipes", "tconversion.pl")); 26 27my @certs = qw(test certs); 28my $pem = srctop_file(@certs, "cyrillic.pem"); 29my $out_msb = "out-cyrillic.msb"; 30my $out_utf8 = "out-cyrillic.utf8"; 31my $der = "cyrillic.der"; 32my $der2 = "cyrillic.der"; 33my $msb = srctop_file(@certs, "cyrillic.msb"); 34my $utf = srctop_file(@certs, "cyrillic.utf8"); 35 36ok(run(app(["openssl", "x509", "-text", "-in", $pem, "-out", $out_msb, 37 "-nameopt", "esc_msb"]))); 38is(cmp_text($out_msb, $msb), 39 0, 'Comparing esc_msb output with cyrillic.msb'); 40ok(run(app(["openssl", "x509", "-text", "-in", $pem, "-out", $out_utf8, 41 "-nameopt", "utf8"]))); 42is(cmp_text($out_utf8, $utf), 43 0, 'Comparing utf8 output with cyrillic.utf8'); 44 45SKIP: { 46 skip "DES disabled", 1 if disabled("des"); 47 skip "Platform doesn't support command line UTF-8", 1 if $^O =~ /^(VMS|msys)$/; 48 49 my $p12 = srctop_file("test", "shibboleth.pfx"); 50 my $p12pass = "σύνθημα γνώρισμα"; 51 my $out_pem = "out.pem"; 52 ok(run(app(["openssl", "x509", "-text", "-in", $p12, "-out", $out_pem, 53 "-passin", "pass:$p12pass"]))); 54 # not unlinking $out_pem 55} 56 57ok(!run(app(["openssl", "x509", "-in", $pem, "-inform", "DER", 58 "-out", $der, "-outform", "DER"])), 59 "Checking failure of mismatching -inform DER"); 60ok(run(app(["openssl", "x509", "-in", $pem, "-inform", "PEM", 61 "-out", $der, "-outform", "DER"])), 62 "Conversion to DER"); 63ok(!run(app(["openssl", "x509", "-in", $der, "-inform", "PEM", 64 "-out", $der2, "-outform", "DER"])), 65 "Checking failure of mismatching -inform PEM"); 66 67# producing and checking self-issued (but not self-signed) cert 68my $subj = "/CN=CA"; # using same DN as in issuer of ee-cert.pem 69my $extfile = srctop_file("test", "v3_ca_exts.cnf"); 70my $pkey = srctop_file(@certs, "ca-key.pem"); # issuer private key 71my $pubkey = "ca-pubkey.pem"; # the corresponding issuer public key 72# use any (different) key for signing our self-issued cert: 73my $signkey = srctop_file(@certs, "serverkey.pem"); 74my $selfout = "self-issued.out"; 75my $testcert = srctop_file(@certs, "ee-cert.pem"); 76ok(run(app(["openssl", "pkey", "-in", $pkey, "-pubout", "-out", $pubkey])) 77&& run(app(["openssl", "x509", "-new", "-force_pubkey", $pubkey, 78 "-subj", $subj, "-extfile", $extfile, 79 "-signkey", $signkey, "-out", $selfout])) 80&& run(app(["openssl", "verify", "-no_check_time", 81 "-trusted", $selfout, "-partial_chain", $testcert]))); 82# not unlinking $pubkey 83# not unlinking $selfout 84 85subtest 'x509 -- x.509 v1 certificate' => sub { 86 tconversion( -type => 'x509', -prefix => 'x509v1', 87 -in => srctop_file("test", "testx509.pem") ); 88}; 89subtest 'x509 -- first x.509 v3 certificate' => sub { 90 tconversion( -type => 'x509', -prefix => 'x509v3-1', 91 -in => srctop_file("test", "v3-cert1.pem") ); 92}; 93subtest 'x509 -- second x.509 v3 certificate' => sub { 94 tconversion( -type => 'x509', -prefix => 'x509v3-2', 95 -in => srctop_file("test", "v3-cert2.pem") ); 96}; 97 98subtest 'x509 -- pathlen' => sub { 99 ok(run(test(["v3ext", srctop_file(@certs, "pathlen.pem")]))); 100}; 101 102cert_contains(srctop_file(@certs, "fake-gp.pem"), 103 "2.16.528.1.1003.1.3.5.5.2-1-0000006666-Z-12345678-01.015-12345678", 104 1, 'x500 -- subjectAltName'); 105 106sub test_errors { # actually tests diagnostics of OSSL_STORE 107 my ($expected, $cert, @opts) = @_; 108 my $infile = srctop_file(@certs, $cert); 109 my @args = qw(openssl x509 -in); 110 push(@args, $infile, @opts); 111 my $tmpfile = 'out.txt'; 112 my $res = grep(/-text/, @opts) ? run(app([@args], stdout => $tmpfile)) 113 : !run(app([@args], stderr => $tmpfile)); 114 my $found = 0; 115 open(my $in, '<', $tmpfile) or die "Could not open file $tmpfile"; 116 while(<$in>) { 117 print; # this may help debugging 118 $res &&= !m/asn1 encoding/; # output must not include ASN.1 parse errors 119 $found = 1 if m/$expected/; # output must include $expected 120 } 121 close $in; 122 # $tmpfile is kept to help with investigation in case of failure 123 return $res && $found; 124} 125 126# 3 tests for non-existence of spurious OSSL_STORE ASN.1 parse error output. 127# This requires provoking a failure exit of the app after reading input files. 128ok(test_errors("Bad output format", "root-cert.pem", '-outform', 'http'), 129 "load root-cert errors"); 130ok(test_errors("RC2-40-CBC", "v3-certs-RC2.p12", '-passin', 'pass:v3-certs'), 131 "load v3-certs-RC2 no asn1 errors"); # error msg should mention "RC2-40-CBC" 132SKIP: { 133 skip "sm2 not disabled", 1 if !disabled("sm2"); 134 135 ok(test_errors("Unable to load Public Key", "sm2.pem", '-text'), 136 "error loading unsupported sm2 cert"); 137} 138 139# 3 tests for -dateopts formats 140ok(run(app(["openssl", "x509", "-noout", "-dates", "-dateopt", "rfc_822", 141 "-in", srctop_file("test/certs", "ca-cert.pem")])), 142 "Run with rfc_8222 -dateopt format"); 143ok(run(app(["openssl", "x509", "-noout", "-dates", "-dateopt", "iso_8601", 144 "-in", srctop_file("test/certs", "ca-cert.pem")])), 145 "Run with iso_8601 -dateopt format"); 146ok(!run(app(["openssl", "x509", "-noout", "-dates", "-dateopt", "invalid_format", 147 "-in", srctop_file("test/certs", "ca-cert.pem")])), 148 "Run with invalid -dateopt format"); 149 150# extracts issuer from a -text formatted-output 151sub get_issuer { 152 my $f = shift(@_); 153 my $issuer = ""; 154 open my $fh, $f or die; 155 while (my $line = <$fh>) { 156 if ($line =~ /Issuer:/) { 157 $issuer = $line; 158 } 159 } 160 close $fh; 161 return $issuer; 162} 163 164# Tests for signing certs (broken in 1.1.1o) 165my $a_key = "a-key.pem"; 166my $a_cert = "a-cert.pem"; 167my $a2_cert = "a2-cert.pem"; 168my $ca_key = "ca-key.pem"; 169my $ca_cert = "ca-cert.pem"; 170my $cnf = srctop_file('apps', 'openssl.cnf'); 171 172# Create cert A 173ok(run(app(["openssl", "req", "-x509", "-newkey", "rsa:2048", 174 "-config", $cnf, 175 "-keyout", $a_key, "-out", $a_cert, "-days", "365", 176 "-nodes", "-subj", "/CN=test.example.com"]))); 177# Create cert CA - note key size 178ok(run(app(["openssl", "req", "-x509", "-newkey", "rsa:4096", 179 "-config", $cnf, 180 "-keyout", $ca_key, "-out", $ca_cert, "-days", "3650", 181 "-nodes", "-subj", "/CN=ca.example.com"]))); 182# Sign cert A with CA (errors on 1.1.1o) 183ok(run(app(["openssl", "x509", "-in", $a_cert, "-CA", $ca_cert, 184 "-CAkey", $ca_key, "-set_serial", "1234567890", 185 "-preserve_dates", "-sha256", "-text", "-out", $a2_cert]))); 186# verify issuer is CA 187ok (get_issuer($a2_cert) =~ /CN = ca.example.com/); 188 189my $in_csr = srctop_file('test', 'certs', 'x509-check.csr'); 190my $in_key = srctop_file('test', 'certs', 'x509-check-key.pem'); 191my $invextfile = srctop_file('test', 'invalid-x509.cnf'); 192# Test that invalid extensions settings fail 193ok(!run(app(["openssl", "x509", "-req", "-in", $in_csr, "-signkey", $in_key, 194 "-out", "/dev/null", "-days", "3650" , "-extensions", "ext", 195 "-extfile", $invextfile]))); 196 197# Tests for issue #16080 (fixed in 1.1.1o) 198my $b_key = "b-key.pem"; 199my $b_csr = "b-cert.csr"; 200my $b_cert = "b-cert.pem"; 201# Create the CSR 202ok(run(app(["openssl", "req", "-new", "-newkey", "rsa:4096", 203 "-keyout", $b_key, "-out", $b_csr, "-nodes", 204 "-config", $cnf, 205 "-subj", "/CN=b.example.com"]))); 206# Sign it - position of "-text" matters! 207ok(run(app(["openssl", "x509", "-req", "-text", "-CAcreateserial", 208 "-CA", $ca_cert, "-CAkey", $ca_key, 209 "-in", $b_csr, "-out", $b_cert]))); 210# Verify issuer is CA 211ok(get_issuer($b_cert) =~ /CN = ca.example.com/); 212