-
Notifications
You must be signed in to change notification settings - Fork 139
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Move CSR/cert extension tests into scripts
- Loading branch information
Showing
7 changed files
with
190 additions
and
130 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| #!/bin/bash -e | ||
|
|
||
| INPUT=$1 | ||
|
|
||
| if [ "$INPUT" = "" ]; then | ||
| INPUT=sslserver.crt | ||
| fi | ||
|
|
||
| openssl x509 -text -noout -in $INPUT | tee output | ||
|
|
||
| # verfiy SKI extension | ||
| echo "X509v3 Subject Key Identifier: " > expected | ||
| sed -En 's/^ *(X509v3 Subject Key Identifier: .*)$/\1/p' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy AKI extension | ||
| echo "X509v3 Authority Key Identifier: " > expected | ||
| sed -En 's/^ *(X509v3 Authority Key Identifier: .*)$/\1/p' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy basic constraints extension | ||
| echo "X509v3 Basic Constraints: critical" > expected | ||
| echo "CA:FALSE" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Basic Constraints: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy key usage extension | ||
| echo "X509v3 Key Usage: critical" > expected | ||
| echo "Digital Signature, Key Encipherment" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Key Usage: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy extended key usage extension | ||
| echo "X509v3 Extended Key Usage: " > expected | ||
| echo "TLS Web Server Authentication, TLS Web Client Authentication" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Extended Key Usage: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy SAN extension | ||
| echo "X509v3 Subject Alternative Name: " > expected | ||
| echo "DNS:pki.example.com" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Subject Alternative Name: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| #!/bin/bash -e | ||
|
|
||
| INPUT=$1 | ||
|
|
||
| if [ "$INPUT" = "" ]; then | ||
| INPUT=sslserver.csr | ||
| fi | ||
|
|
||
| openssl req -text -noout -in $INPUT | tee output | ||
|
|
||
| # verfiy basic constraints extension | ||
| echo "X509v3 Basic Constraints: critical" > expected | ||
| echo "CA:FALSE" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Basic Constraints: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy key usage extension | ||
| echo "X509v3 Key Usage: critical" > expected | ||
| echo "Digital Signature, Key Encipherment" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Key Usage: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy extended key usage extension | ||
| echo "X509v3 Extended Key Usage: " > expected | ||
| echo "TLS Web Server Authentication, TLS Web Client Authentication" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Extended Key Usage: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| #!/bin/bash -e | ||
|
|
||
| INPUT=$1 | ||
|
|
||
| if [ "$INPUT" = "" ]; then | ||
| INPUT=ca_signing.crt | ||
| fi | ||
|
|
||
| openssl x509 -text -noout -in $INPUT | tee output | ||
|
|
||
| # verfiy SKI extension | ||
| echo "X509v3 Subject Key Identifier: " > expected | ||
| sed -En 's/^ *(X509v3 Subject Key Identifier: .*)$/\1/p' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy basic constraints extension | ||
| echo "X509v3 Basic Constraints: critical" > expected | ||
| echo "CA:TRUE" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Basic Constraints: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy key usage extension | ||
| echo "X509v3 Key Usage: critical" > expected | ||
| echo "Digital Signature, Non Repudiation, Certificate Sign, CRL Sign" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Key Usage: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| #!/bin/bash -e | ||
|
|
||
| INPUT=$1 | ||
|
|
||
| if [ "$INPUT" = "" ]; then | ||
| INPUT=ca_signing.csr | ||
| fi | ||
|
|
||
| openssl req -text -noout -in $INPUT | tee output | ||
|
|
||
| # verfiy basic constraints extension | ||
| echo "X509v3 Basic Constraints: critical" > expected | ||
| echo "CA:TRUE" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Basic Constraints: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy key usage extension | ||
| echo "X509v3 Key Usage: critical" > expected | ||
| echo "Digital Signature, Non Repudiation, Certificate Sign, CRL Sign" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Key Usage: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| #!/bin/bash -e | ||
|
|
||
| INPUT=$1 | ||
|
|
||
| if [ "$INPUT" = "" ]; then | ||
| INPUT=subca_signing.crt | ||
| fi | ||
|
|
||
| openssl x509 -text -noout -in $INPUT | tee output | ||
|
|
||
| # verfiy SKI extension | ||
| echo "X509v3 Subject Key Identifier: " > expected | ||
| sed -En 's/^ *(X509v3 Subject Key Identifier: .*)$/\1/p' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy AKI extension | ||
| echo "X509v3 Authority Key Identifier: " > expected | ||
| sed -En 's/^ *(X509v3 Authority Key Identifier: .*)$/\1/p' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy basic constraints extension | ||
| echo "X509v3 Basic Constraints: critical" > expected | ||
| echo "CA:TRUE" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Basic Constraints: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy key usage extension | ||
| echo "X509v3 Key Usage: critical" > expected | ||
| echo "Digital Signature, Non Repudiation, Certificate Sign, CRL Sign" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Key Usage: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy subordinate CA extension | ||
| echo "1.3.6.1.4.1.311.20.2: " > expected | ||
| echo "." >> expected | ||
| echo ".S.u.b.C.A" >> expected | ||
| sed -En '1N;$!N;s/^ *(1.3.6.1.4.1.311.20.2: .*)\n *(.*)\n *(.*)/\1\n\2\n\3/p;D' output | tee actual | ||
| diff actual expected |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| #!/bin/bash -e | ||
|
|
||
| INPUT=$1 | ||
|
|
||
| if [ "$INPUT" = "" ]; then | ||
| INPUT=subca_signing.csr | ||
| fi | ||
|
|
||
| openssl req -text -noout -in $INPUT | tee output | ||
|
|
||
| # verfiy basic constraints extension | ||
| echo "X509v3 Basic Constraints: critical" > expected | ||
| echo "CA:TRUE" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Basic Constraints: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy key usage extension | ||
| echo "X509v3 Key Usage: critical" > expected | ||
| echo "Digital Signature, Non Repudiation, Certificate Sign, CRL Sign" >> expected | ||
| sed -En 'N; s/^ *(X509v3 Key Usage: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual | ||
| diff actual expected | ||
|
|
||
| # verfiy subordinate CA extension | ||
| echo "1.3.6.1.4.1.311.20.2: " > expected | ||
| echo "." >> expected | ||
| echo ".S.u.b.C.A" >> expected | ||
| sed -En '1N;$!N;s/^ *(1.3.6.1.4.1.311.20.2: .*)\n *(.*)\n *(.*)/\1\n\2\n\3/p;D' output | tee actual | ||
| diff actual expected |