j3d1/bearssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Added minimal support of Certificate Policies extension (ability to ignore its contents even if marked critical, in situations where it's safe to do that).

Browse source
This commit is contained in:
Thomas Pornin 2017-06-11 03:49:02 +02:00
parent 52cc1a1a18
commit 2f7a003698
8 changed files with 421 additions and 290 deletions
Download patch file Download diff file Expand all files Collapse all files

62
test/x509/alltests.txt
View file

@ -30,6 +30,12 @@ type = EC
curve = P-521
q = 040168E669615D1B20F2E753D2C86312F51094D3E5C6CF49E8D73418278CD769FE40A84AD4F34865D59D94D5685B389E0CFD0450754CAE81ED1D4A91D0773F7A002ED701DEF2DBDEFC7554E74CD600693DBDE1A7E09CD9044774C744C7CE575BF8B645FF79FCCE06116F61D44FDAE62D3046F4EB41DECB8219B279A5B8CE2A47F3DF0D463B
[key]
name = root-new
type = EC
curve = P-256
q = 0465D02336D3ACEB9A000B33A6EECA9745EFD72A0F7C0B138FAAA564E705A3269A479BB5A041DC1D244EA1D2BB9639C79187D3D63CEF79EDD1DC65E80027E75997
[key]
name = ica1-rsa2048
type = RSA
@ -94,6 +100,13 @@ DN_file = dn-root.der
key = root-p521
type = CA
; Trust anchor: another root with an ECDSA key (in P-256 curve)
[anchor]
name = root-new
DN_file = dn-root-new.der
key = root-new
type = CA
; Intermediate CA 1 as trust anchor.
[anchor]
name = ica1
@ -658,3 +671,52 @@ keytype = EC
keyusage = SIGN
eekey = ee-p256
status = 0
; EE certificate has a Certificate Policies extension, but it is not
; critical.
[chain]
name = certpol-noncrit
anchors = root-new
chain = ee-cp1.crt
servername = www.example.com
keytype = RSA
keyusage = KEYX
eekey = ee-rsa2048
status = 0
; EE certificate has a critical Certificate Policies extension, but it
; contains no policy qualifier.
[chain]
name = certpol-noqual
anchors = root-new
chain = ee-cp2.crt
servername = www.example.com
keytype = RSA
keyusage = KEYX
eekey = ee-rsa2048
status = 0
; EE certificate has a critical Certificate Policies extension, and it
; contains some qualifiers, but they are all id-qt-cps.
[chain]
name = certpol-qualcps
anchors = root-new
chain = ee-cp3.crt
servername = www.example.com
keytype = RSA
keyusage = KEYX
eekey = ee-rsa2048
status = 0
; EE certificate has a critical Certificate Policies extension, and it
; contains a qualifier distinct from id-qt-cps. This implies rejection
; of the path.
[chain]
name = certpol-qualother
anchors = root-new
chain = ee-cp4.crt
servername = www.example.com
keytype = RSA
keyusage = KEYX
eekey = ee-rsa2048
status = 57

1
test/x509/dn-root-new.der Normal file
View file

@ -0,0 +1 @@
0(1 0 UCA10UExample Root New

BIN
test/x509/ee-cp1.crt Normal file
View file

Binary file not shown.

BIN
test/x509/ee-cp2.crt Normal file
View file

Binary file not shown.

BIN
test/x509/ee-cp3.crt Normal file
View file

Binary file not shown.

BIN
test/x509/ee-cp4.crt Normal file
View file

Binary file not shown.