Skip to content

Commit 89217d1

Browse files
shigekishigeki
committed
crypto: add cert check issued by StartCom/WoSign
When tls client connects to the server with certification issued by either StartCom or WoSign listed in StartComAndWoSignData.inc, check notBefore of the server certificate and CERT_REVOKED error returns if it is after 00:00:00 on October 21, 2016. See for details in https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/, https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html and https://support.apple.com/en-us/HT204132 Fixes: #9434 PR-URL: #9469 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
1 parent 4e259b2 commit 89217d1

24 files changed

+611
-3
lines changed

‎src/StartComAndWoSignData.inc

+89
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
// /C=CN/O=WoSign CA Limited/CN=CA \xE6\xB2\x83\xE9\x80\x9A\xE6\xA0\xB9\xE8\xAF\x81\xE4\xB9\xA6
2+
// Using a consistent naming convention, this would actually be called
3+
// 'CA沃通根证书DN', but since GCC 6.2.1 apparently can't handle UTF-8
4+
// identifiers, this will have to do.
5+
static const uint8_t CAWoSignRootDN[72] = {
6+
0x30, 0x46, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02,
7+
0x43, 0x4E, 0x31, 0x1A, 0x30, 0x18, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x13, 0x11,
8+
0x57, 0x6F, 0x53, 0x69, 0x67, 0x6E, 0x20, 0x43, 0x41, 0x20, 0x4C, 0x69, 0x6D,
9+
0x69, 0x74, 0x65, 0x64, 0x31, 0x1B, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04, 0x03,
10+
0x0C, 0x12, 0x43, 0x41, 0x20, 0xE6, 0xB2, 0x83, 0xE9, 0x80, 0x9A, 0xE6, 0xA0,
11+
0xB9, 0xE8, 0xAF, 0x81, 0xE4, 0xB9, 0xA6,
12+
};
13+
14+
// /C=CN/O=WoSign CA Limited/CN=CA WoSign ECC Root
15+
static const uint8_t CAWoSignECCRootDN[72] = {
16+
0x30, 0x46, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02,
17+
0x43, 0x4E, 0x31, 0x1A, 0x30, 0x18, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x13, 0x11,
18+
0x57, 0x6F, 0x53, 0x69, 0x67, 0x6E, 0x20, 0x43, 0x41, 0x20, 0x4C, 0x69, 0x6D,
19+
0x69, 0x74, 0x65, 0x64, 0x31, 0x1B, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04, 0x03,
20+
0x13, 0x12, 0x43, 0x41, 0x20, 0x57, 0x6F, 0x53, 0x69, 0x67, 0x6E, 0x20, 0x45,
21+
0x43, 0x43, 0x20, 0x52, 0x6F, 0x6F, 0x74,
22+
};
23+
24+
// /C=CN/O=WoSign CA Limited/CN=Certification Authority of WoSign
25+
static const uint8_t CertificationAuthorityofWoSignDN[87] = {
26+
0x30, 0x55, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02,
27+
0x43, 0x4E, 0x31, 0x1A, 0x30, 0x18, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x13, 0x11,
28+
0x57, 0x6F, 0x53, 0x69, 0x67, 0x6E, 0x20, 0x43, 0x41, 0x20, 0x4C, 0x69, 0x6D,
29+
0x69, 0x74, 0x65, 0x64, 0x31, 0x2A, 0x30, 0x28, 0x06, 0x03, 0x55, 0x04, 0x03,
30+
0x13, 0x21, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69,
31+
0x6F, 0x6E, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6F, 0x72, 0x69, 0x74, 0x79, 0x20,
32+
0x6F, 0x66, 0x20, 0x57, 0x6F, 0x53, 0x69, 0x67, 0x6E,
33+
};
34+
35+
// /C=CN/O=WoSign CA Limited/CN=Certification Authority of WoSign G2
36+
static const uint8_t CertificationAuthorityofWoSignG2DN[90] = {
37+
0x30, 0x58, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02,
38+
0x43, 0x4E, 0x31, 0x1A, 0x30, 0x18, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x13, 0x11,
39+
0x57, 0x6F, 0x53, 0x69, 0x67, 0x6E, 0x20, 0x43, 0x41, 0x20, 0x4C, 0x69, 0x6D,
40+
0x69, 0x74, 0x65, 0x64, 0x31, 0x2D, 0x30, 0x2B, 0x06, 0x03, 0x55, 0x04, 0x03,
41+
0x13, 0x24, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69,
42+
0x6F, 0x6E, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6F, 0x72, 0x69, 0x74, 0x79, 0x20,
43+
0x6F, 0x66, 0x20, 0x57, 0x6F, 0x53, 0x69, 0x67, 0x6E, 0x20, 0x47, 0x32,
44+
};
45+
46+
// /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority
47+
static const uint8_t StartComCertificationAuthorityDN[127] = {
48+
0x30, 0x7D, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02,
49+
0x49, 0x4C, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x13, 0x0D,
50+
0x53, 0x74, 0x61, 0x72, 0x74, 0x43, 0x6F, 0x6D, 0x20, 0x4C, 0x74, 0x64, 0x2E,
51+
0x31, 0x2B, 0x30, 0x29, 0x06, 0x03, 0x55, 0x04, 0x0B, 0x13, 0x22, 0x53, 0x65,
52+
0x63, 0x75, 0x72, 0x65, 0x20, 0x44, 0x69, 0x67, 0x69, 0x74, 0x61, 0x6C, 0x20,
53+
0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x53,
54+
0x69, 0x67, 0x6E, 0x69, 0x6E, 0x67, 0x31, 0x29, 0x30, 0x27, 0x06, 0x03, 0x55,
55+
0x04, 0x03, 0x13, 0x20, 0x53, 0x74, 0x61, 0x72, 0x74, 0x43, 0x6F, 0x6D, 0x20,
56+
0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6F, 0x6E,
57+
0x20, 0x41, 0x75, 0x74, 0x68, 0x6F, 0x72, 0x69, 0x74, 0x79,
58+
};
59+
60+
// /C=IL/O=StartCom Ltd./CN=StartCom Certification Authority G2
61+
static const uint8_t StartComCertificationAuthorityG2DN[85] = {
62+
0x30, 0x53, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02,
63+
0x49, 0x4C, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x13, 0x0D,
64+
0x53, 0x74, 0x61, 0x72, 0x74, 0x43, 0x6F, 0x6D, 0x20, 0x4C, 0x74, 0x64, 0x2E,
65+
0x31, 0x2C, 0x30, 0x2A, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x23, 0x53, 0x74,
66+
0x61, 0x72, 0x74, 0x43, 0x6F, 0x6D, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
67+
0x69, 0x63, 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6F,
68+
0x72, 0x69, 0x74, 0x79, 0x20, 0x47, 0x32,
69+
};
70+
71+
struct DataAndLength {
72+
const uint8_t* data;
73+
uint32_t len;
74+
};
75+
76+
static const DataAndLength StartComAndWoSignDNs[]= {
77+
{ CAWoSignRootDN,
78+
sizeof(CAWoSignRootDN) },
79+
{ CAWoSignECCRootDN,
80+
sizeof(CAWoSignECCRootDN) },
81+
{ CertificationAuthorityofWoSignDN,
82+
sizeof(CertificationAuthorityofWoSignDN) },
83+
{ CertificationAuthorityofWoSignG2DN,
84+
sizeof(CertificationAuthorityofWoSignG2DN) },
85+
{ StartComCertificationAuthorityDN,
86+
sizeof(StartComCertificationAuthorityDN) },
87+
{ StartComCertificationAuthorityG2DN,
88+
sizeof(StartComCertificationAuthorityG2DN) },
89+
};

‎src/node_crypto.cc

+41-3
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@
1717
// https://hg.mozilla.org/mozilla-central/raw-file/98820360ab66/security/
1818
// certverifier/CNNICHashWhitelist.inc
1919
#include "CNNICHashWhitelist.inc"
20+
// StartCom and WoSign root CA list is taken from
21+
// https://hg.mozilla.org/mozilla-central/file/tip/security/certverifier/
22+
// StartComAndWoSignData.inc
23+
#include "StartComAndWoSignData.inc"
2024

2125
#include <errno.h>
2226
#include <limits.h> // INT_MAX
@@ -2761,9 +2765,40 @@ inline X509* FindRoot(STACK_OF(X509)* sk) {
27612765
}
27622766

27632767

2764-
// Whitelist check for certs issued by CNNIC. See
2768+
inline bool CertIsStartComOrWoSign(X509_NAME* name) {
2769+
const unsigned char* startcom_wosign_data;
2770+
X509_NAME* startcom_wosign_name;
2771+
2772+
for (const auto& dn : StartComAndWoSignDNs) {
2773+
startcom_wosign_data = dn.data;
2774+
startcom_wosign_name = d2i_X509_NAME(nullptr, &startcom_wosign_data,
2775+
dn.len);
2776+
if (X509_NAME_cmp(name, startcom_wosign_name) == 0)
2777+
return true;
2778+
}
2779+
2780+
return false;
2781+
}
2782+
2783+
// Revoke the certificates issued by StartCom or WoSign that has
2784+
// notBefore after 00:00:00 on October 21, 2016 (1477008000 in epoch).
2785+
inline bool CheckStartComOrWoSign(X509_NAME* root_name, X509* cert) {
2786+
if (!CertIsStartComOrWoSign(root_name))
2787+
return true;
2788+
2789+
time_t october_21_2016 = static_cast<time_t>(1477008000);
2790+
if (X509_cmp_time(X509_get_notBefore(cert), &october_21_2016) < 0)
2791+
return true;
2792+
2793+
return false;
2794+
}
2795+
2796+
2797+
// Whitelist check for certs issued by CNNIC, StartCom and WoSign. See
27652798
// https://blog.mozilla.org/security/2015/04/02
2766-
// /distrusting-new-cnnic-certificates/
2799+
// /distrusting-new-cnnic-certificates/ and
2800+
// https://blog.mozilla.org/security/2016/10/24/
2801+
// distrusting-new-wosign-and-startcom-certificates
27672802
inline CheckResult CheckWhitelistedServerCert(X509_STORE_CTX* ctx) {
27682803
unsigned char hash[CNNIC_WHITELIST_HASH_LEN];
27692804
unsigned int hashlen = CNNIC_WHITELIST_HASH_LEN;
@@ -2782,11 +2817,14 @@ inline CheckResult CheckWhitelistedServerCert(X509_STORE_CTX* ctx) {
27822817
root_name = X509_get_subject_name(root_cert);
27832818
}
27842819

2820+
X509* leaf_cert = sk_X509_value(chain, 0);
2821+
if (!CheckStartComOrWoSign(root_name, leaf_cert))
2822+
return CHECK_CERT_REVOKED;
2823+
27852824
// When the cert is issued from either CNNNIC ROOT CA or CNNNIC EV
27862825
// ROOT CA, check a hash of its leaf cert if it is in the whitelist.
27872826
if (X509_NAME_cmp(root_name, cnnic_name) == 0 ||
27882827
X509_NAME_cmp(root_name, cnnic_ev_name) == 0) {
2789-
X509* leaf_cert = sk_X509_value(chain, 0);
27902828
int ret = X509_digest(leaf_cert, EVP_sha256(), hash,
27912829
&hashlen);
27922830
CHECK(ret);

‎test/fixtures/keys/Makefile

+68
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,20 @@ fake-cnnic-root-cert.pem: fake-cnnic-root.cnf fake-cnnic-root-key.pem
5757
-out fake-cnnic-root-cert.pem \
5858
-config fake-cnnic-root.cnf
5959

60+
#
61+
# Create Fake StartCom Root Certificate Authority: fake-startcom-root
62+
#
63+
fake-startcom-root-key.pem:
64+
openssl genrsa -out fake-startcom-root-key.pem 2048
65+
66+
fake-startcom-root-cert.pem: fake-startcom-root.cnf \
67+
fake-startcom-root-key.pem
68+
openssl req -new -x509 -days 9999 -config \
69+
fake-startcom-root.cnf -key fake-startcom-root-key.pem -out \
70+
fake-startcom-root-cert.pem
71+
echo '01' > fake-startcom-root-serial
72+
touch fake-startcom-root-database.txt
73+
6074
#
6175
# agent1 is signed by ca1.
6276
#
@@ -254,6 +268,60 @@ agent7-cert.pem: agent7-csr.pem fake-cnnic-root-cert.pem fake-cnnic-root-key.pem
254268
agent7-verify: agent7-cert.pem fake-cnnic-root-cert.pem
255269
openssl verify -CAfile fake-cnnic-root-cert.pem agent7-cert.pem
256270

271+
#
272+
# agent8 is signed by fake-startcom-root with notBefore
273+
# of Oct 20 23:59:59 2016 GMT
274+
#
275+
276+
agent8-key.pem:
277+
openssl genrsa -out agent8-key.pem 2048
278+
279+
agent8-csr.pem: agent8.cnf agent8-key.pem
280+
openssl req -new -config agent8.cnf -key agent8-key.pem \
281+
-out agent8-csr.pem
282+
283+
agent8-cert.pem: agent8-csr.pem
284+
openssl ca \
285+
-config fake-startcom-root.cnf \
286+
-keyfile fake-startcom-root-key.pem \
287+
-cert fake-startcom-root-cert.pem \
288+
-batch \
289+
-days 9999 \
290+
-passin "pass:password" \
291+
-in agent8-csr.pem \
292+
-startdate 20161020235959Z \
293+
-notext -out agent8-cert.pem
294+
295+
296+
agent8-verify: agent8-cert.pem fake-startcom-root-cert.pem
297+
openssl verify -CAfile fake-startcom-root-cert.pem \
298+
agent8-cert.pem
299+
300+
301+
#
302+
# agent9 is signed by fake-startcom-root with notBefore
303+
# of Oct 21 00:00:01 2016 GMT
304+
#
305+
agent9-key.pem:
306+
openssl genrsa -out agent9-key.pem 2048
307+
308+
agent9-csr.pem: agent9.cnf agent9-key.pem
309+
openssl req -new -config agent9.cnf -key agent9-key.pem \
310+
-out agent9-csr.pem
311+
312+
313+
agent9-cert.pem: agent9-csr.pem
314+
openssl ca \
315+
-config fake-startcom-root.cnf \
316+
-keyfile fake-startcom-root-key.pem \
317+
-cert fake-startcom-root-cert.pem \
318+
-batch \
319+
-days 9999 \
320+
-passin "pass:password" \
321+
-in agent9-csr.pem \
322+
-startdate 20161021000001Z \
323+
-notext -out agent9-cert.pem
324+
257325
ec-key.pem:
258326
openssl ecparam -genkey -out ec-key.pem -name prime256v1
259327

‎test/fixtures/keys/agent8-cert.pem

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDUDCCAjgCAQEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNV
3+
BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRp
4+
ZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g
5+
QXV0aG9yaXR5MCAYDzIwMTYxMDIwMjM1OTU5WhcNNDQwMzIxMTAwNjM5WjBdMQsw
6+
CQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExCzAJBgNVBAcTAlNGMQ8wDQYDVQQKEwZO
7+
T0RFSlMxDzANBgNVBAsTBmFnZW50ODESMBAGA1UEAxMJbG9jYWxob3N0MIIBIjAN
8+
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzkVSP6XxWpBlSjqqavwOhpp36aFJ
9+
qLK7fRpxR+f0PdQ9WJajDEicxwKWGFqQBE+d5BjqrAD59L2QGZQ2VOF9VLZyFz3F
10+
9TIlkd4yt9Od0qE98yIouDBNWu7UZqvNynAe5caD5i1MgyIUQqIUOnZwM21hwqYN
11+
N/OESf38A8Tfuvh3ALUn7zBEVyUPWIWTYPhFHSCWIsS2URZ/qDLk8GavphkqXdFB
12+
ii3V8Th5niPtpIsRF6Qhwh8SK+s0zh53o0qkmCNpXLd/PJQQAwC70WRq7ncL4D+U
13+
C1gnDL0j9SzojXQu31kXs8UZTa7RFnx5r+gDiA/gGrLs4IiwDJhVHMx0nQIDAQAB
14+
MA0GCSqGSIb3DQEBCwUAA4IBAQA7iMlm+rgZnlps+LFsoXG4dGNPaOhKI9t/XBrO
15+
6O64LLyx/FPIQSaYi130QNB7Zy0uw8xqrH6cGRTJ9RCfBFFP4rzgIX3wEAHnmwMr
16+
i4dGEixBUIIjhw6fAVxAhrkzmgUpUt0qIP9otGgESEYXIg7bFkXIHit0Im1VOdvf
17+
+LnUKZw9o7UEesKIDVkuAsjoKKkrsO0kdf0dgAj6Ix5xmAtBsDvkH0aOSdPfTZG6
18+
LQrnZf/quBotog3NmDzrvQaH8GNpTJcYNjKlxD2z0PvQUyp0FD8oCC+oD+EGv2zZ
19+
65scEXU/n8kTmdJkCjx4nb39HttYzOlNlTgMxAfxgL7A/PcT
20+
-----END CERTIFICATE-----

‎test/fixtures/keys/agent8-csr.pem

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
-----BEGIN CERTIFICATE REQUEST-----
2+
MIICxzCCAa8CAQAwXTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMQswCQYDVQQH
3+
EwJTRjEPMA0GA1UEChMGTk9ERUpTMQ8wDQYDVQQLEwZhZ2VudDgxEjAQBgNVBAMT
4+
CWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM5FUj+l
5+
8VqQZUo6qmr8Doaad+mhSaiyu30acUfn9D3UPViWowxInMcClhhakARPneQY6qwA
6+
+fS9kBmUNlThfVS2chc9xfUyJZHeMrfTndKhPfMiKLgwTVru1GarzcpwHuXGg+Yt
7+
TIMiFEKiFDp2cDNtYcKmDTfzhEn9/APE37r4dwC1J+8wRFclD1iFk2D4RR0gliLE
8+
tlEWf6gy5PBmr6YZKl3RQYot1fE4eZ4j7aSLERekIcIfEivrNM4ed6NKpJgjaVy3
9+
fzyUEAMAu9Fkau53C+A/lAtYJwy9I/Us6I10Lt9ZF7PFGU2u0RZ8ea/oA4gP4Bqy
10+
7OCIsAyYVRzMdJ0CAwEAAaAlMCMGCSqGSIb3DQEJBzEWExRBIGNoYWxsZW5nZSBw
11+
YXNzd29yZDANBgkqhkiG9w0BAQUFAAOCAQEAykAWr5pOZh1BMc7NZgc66J16VkjN
12+
KM2deMQNl7r3BFB336At+zmpudnjdT/tPaH34FT/Idh/DPfiSdpuDQWDA+E7xady
13+
S7KoKfNesPFjV4rR1WgNtoix0B5EaaNxdR8ljwL30N/LbsMDWxIK7rWyhvuw3DXr
14+
C90PbsOTCLbW1HGItgYCQFJnpXK1O1Vx0Bo55F//oxDGVTzkUqb0lsVGHLLCg0s2
15+
DxX3++FqFy/NjzZ5R/k1o+WIom1PzhLXJ+cqQsqYT9kBIVHTtvTAnDM70dZ8EeSW
16+
/O4w+gb+OSJjClz7p4DuX4idDG+0cISxBOYFPyTFlGrXQ0ZXULP4pihsUA==
17+
-----END CERTIFICATE REQUEST-----

‎test/fixtures/keys/agent8-key.pem

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
MIIEowIBAAKCAQEAzkVSP6XxWpBlSjqqavwOhpp36aFJqLK7fRpxR+f0PdQ9WJaj
3+
DEicxwKWGFqQBE+d5BjqrAD59L2QGZQ2VOF9VLZyFz3F9TIlkd4yt9Od0qE98yIo
4+
uDBNWu7UZqvNynAe5caD5i1MgyIUQqIUOnZwM21hwqYNN/OESf38A8Tfuvh3ALUn
5+
7zBEVyUPWIWTYPhFHSCWIsS2URZ/qDLk8GavphkqXdFBii3V8Th5niPtpIsRF6Qh
6+
wh8SK+s0zh53o0qkmCNpXLd/PJQQAwC70WRq7ncL4D+UC1gnDL0j9SzojXQu31kX
7+
s8UZTa7RFnx5r+gDiA/gGrLs4IiwDJhVHMx0nQIDAQABAoIBAHHp5KdT3Ht4XQfm
8+
aDEXLGp3qhtzQDuTIWnQjZj5Z3Ax4wMmhbsF6tcY/Y1LjldjJL5QaGE/VMstWQRX
9+
Tr4HnXCIJW/iZI2p+Qean4XXr0QgWhcI2VYHDuFWHiTpYogW7WlV/YfDooqU6n12
10+
BxfWStaL5L5bd9dbe8ZlJqVqN2iISfqGNIz9YKM04rHycTcicNmf0J0smkHlnHJE
11+
ROQR73IXjDDOmkwdG75qyGRBQ0j0KEDu//n1axcOKf48F+8BQk2PFMq+RhkGGqJD
12+
zTQK3kB33HRWeNWbykLPzYGcPtSlvaecCTc/q9wbbxh5AFlvSrPz3VzdRHECocM3
13+
v/o2vqECgYEA/uZib1ZYczuihcvLKxo8e/IBNYUKUcyosHDqAmJ5q8Y+Vg35ACfM
14+
mJAhT1SXXAmm2tHuTnztfLDMQAOGVItuf5U8nuJYuWrvhMCtBT40XPeUVPD8b2D1
15+
9y5EipiB7huH8kMb1aAPUNgQhmqT93+4qcGf6PcNTkk6uHCCXFZEc7UCgYEAzyk1
16+
/T+Ah3p9+c1s+AjqkWj3Qa9lOKclJOT2O88AG+4fGQhSdUvkLDAMX3L6ri3gVZzr
17+
wH3DJIwJx1uCW4eNJFVmh8AyP4SkfzQp1FqsIzBMQuPz6Hqtclh/UPx1yOe3NseO
18+
xVM6Z5RbOOWyDaWxxbQHZnHkqSKcTB8K1lJ/XkkCgYAaStlMcrOc70HMW0ERqRsk
19+
DcpiIt71oQ6lZIA+zrmOJly3s6lDgtdvxS4qaKdULwqu94iFQA2fFv16fOKWReuX
20+
7WTbXq2YMpeSMe2m5Mux6ze5q0HemznDzVn0kdaVIPHc418zodbyl9bchpHMrbf2
21+
iqpb9V/B+3u7Gp/Xtm5JIQKBgBFrjr2wBFfgJg3Gh35ICamWoQwl+qYL8CStGEOp
22+
QYIXwQey2nRAoHxSwgeYvJm/A9lPK8fxC2LcX8oi2NBnkqfWgpuxvsf2mHqV4VqZ
23+
EVaYLiGF17HZ9xHhfTtLL4Boc9CocUoImKWzJQSg1BsvrsZIQEMOGsNaRLhl99xT
24+
7Z/5AoGBAIxgzOGLVVrIv8vRc4YouPf0OGBmUawnEZxYVD1Mo4Tt97XjxH93B1iz
25+
hof62zDCL7WEdKuwnOs1towBmLjC7qrAbkUgNVYmI5sG9c8+1NKClTOJGsHHiMLF
26+
n8GxnsNU5FVTmJ/PZfOU+eru7uDYZHTkii0tkaHWUzg13pkhka5E
27+
-----END RSA PRIVATE KEY-----

‎test/fixtures/keys/agent8.cnf

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
[ req ]
2+
default_bits = 2048
3+
days = 999
4+
distinguished_name = req_distinguished_name
5+
attributes = req_attributes
6+
prompt = no
7+
8+
[ req_distinguished_name ]
9+
C = US
10+
ST = CA
11+
L = SF
12+
O = NODEJS
13+
OU = agent8
14+
CN = localhost
15+
16+
[ req_attributes ]
17+
challengePassword = A challenge password

‎test/fixtures/keys/agent9-cert.pem

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDUDCCAjgCAQIwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNV
3+
BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRp
4+
ZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g
5+
QXV0aG9yaXR5MCAYDzIwMTYxMDIxMDAwMDAxWhcNNDQwMzIxMTAwNzAyWjBdMQsw
6+
CQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExCzAJBgNVBAcTAlNGMQ8wDQYDVQQKEwZO
7+
T0RFSlMxDzANBgNVBAsTBmFnZW50OTESMBAGA1UEAxMJbG9jYWxob3N0MIIBIjAN
8+
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApT6nASSx9e2i/t0aHSd9BxMRD92o
9+
33/iaiXWzBOKMJp7jxCWAg6SnpjrFsyjTxaAqg+e1zlm10YBT6DholstffzQqK2x
10+
TKGVOQK4jxX23wJlrn5mDk0fagBtY49L1KFy8DxJqKgt7uxz61GGUWwKWXG7Vnga
11+
bkqDd9o3ZF7bOq7mMQvfDzPrwYI8uTjTxR8R19uxNNOGtHMTnwvDeczTmtTox8U+
12+
4N2hN2scDZvRBx5aQAtnXRyZhAokAJMYojinx9iqlVFQi3ct52LIhsca6ympfDc2
13+
0yA4aSVfoW7NlqsnvrTOV4nt3UbrxGGpiE7Em8Hdcw2EMF+jqCTLGtsqYQIDAQAB
14+
MA0GCSqGSIb3DQEBCwUAA4IBAQCMjKFycVQh7Puz/FpQh3NhJ99Ic3rzr+3nAKFD
15+
4Kcl3L8szH3zjLCw46/y2jqPiAbg2zg9miYkI/2W/G+m2VQEQvp2SwjVr/Rj2Soe
16+
iTonruUpDFF7LG01q3kpZ7nYWRGvVgn5D9BGk4/SWuzxiWRdwlzJf2e8cXLExVS0
17+
0CgRsb5nRoZ+RZmVIrGMfIi8CI7uTlcHtQzD7B7gpHtOSMlQoSSeqOy6F498duvl
18+
QhhQhJBxmjSegw/lawWQSDFArJimK/rwyb6ZFbRfBgg6o/k5W9G5l0oG5abQMp+/
19+
u8Fd+QUNwR6OovE0AqL6wNHCnqzNnihTL6/hRVer6i5Hfxmb
20+
-----END CERTIFICATE-----

‎test/fixtures/keys/agent9-csr.pem

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
-----BEGIN CERTIFICATE REQUEST-----
2+
MIICxzCCAa8CAQAwXTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMQswCQYDVQQH
3+
EwJTRjEPMA0GA1UEChMGTk9ERUpTMQ8wDQYDVQQLEwZhZ2VudDkxEjAQBgNVBAMT
4+
CWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKU+pwEk
5+
sfXtov7dGh0nfQcTEQ/dqN9/4mol1swTijCae48QlgIOkp6Y6xbMo08WgKoPntc5
6+
ZtdGAU+g4aJbLX380KitsUyhlTkCuI8V9t8CZa5+Zg5NH2oAbWOPS9ShcvA8Saio
7+
Le7sc+tRhlFsCllxu1Z4Gm5Kg3faN2Re2zqu5jEL3w8z68GCPLk408UfEdfbsTTT
8+
hrRzE58Lw3nM05rU6MfFPuDdoTdrHA2b0QceWkALZ10cmYQKJACTGKI4p8fYqpVR
9+
UIt3LediyIbHGuspqXw3NtMgOGklX6FuzZarJ760zleJ7d1G68RhqYhOxJvB3XMN
10+
hDBfo6gkyxrbKmECAwEAAaAlMCMGCSqGSIb3DQEJBzEWExRBIGNoYWxsZW5nZSBw
11+
YXNzd29yZDANBgkqhkiG9w0BAQUFAAOCAQEAKlz52i1TpqNFQQu2YCl2YlTKbu2s
12+
+92Qq+9b8wKoTweEFxDYtfq8d6rgYtetDbJDh+CDSjG3REINHtbPB0BjFdmZq/Q6
13+
7JHLjmWKacmhaZJIp6xtrAX93qXYfbqH2S/DNSAO1e1sUa/gKL+wuVcrM8My7mzo
14+
cMEgc7mHJCbSjYIcYPELas+rADoCE4mgiX8wwYQjFqxj/cdlcMzVS3ZuARAiPzA7
15+
60Zk3/NnbXd/OBOcf/FvbrYIQ45eV4JlMowtcdLtxP91N5/X3BBMFsXt4mPoXETC
16+
V78wipSWtfiKTox1Ze7PSJsYm9E9TOYYPh9kSGizIFzrgnk9H15+Iy5Ixg==
17+
-----END CERTIFICATE REQUEST-----

‎test/fixtures/keys/agent9-key.pem

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
MIIEowIBAAKCAQEApT6nASSx9e2i/t0aHSd9BxMRD92o33/iaiXWzBOKMJp7jxCW
3+
Ag6SnpjrFsyjTxaAqg+e1zlm10YBT6DholstffzQqK2xTKGVOQK4jxX23wJlrn5m
4+
Dk0fagBtY49L1KFy8DxJqKgt7uxz61GGUWwKWXG7VngabkqDd9o3ZF7bOq7mMQvf
5+
DzPrwYI8uTjTxR8R19uxNNOGtHMTnwvDeczTmtTox8U+4N2hN2scDZvRBx5aQAtn
6+
XRyZhAokAJMYojinx9iqlVFQi3ct52LIhsca6ympfDc20yA4aSVfoW7NlqsnvrTO
7+
V4nt3UbrxGGpiE7Em8Hdcw2EMF+jqCTLGtsqYQIDAQABAoIBAE7FXAUOggry2hVW
8+
PuGQ9mfN7f87MgpAwyTInukvk1tx+N6NEIUwfzI9QSvgJyVHW9Q1mAmO4nhSdcOI
9+
tKaZgkkhoDIYgoE+MY04v9Ptq35JfUE+HdZJa2UziPHB2Gsm/0yH4LEWYrcXXnbZ
10+
qQbdUt2qepxQqoDS4nLawjcFhMom24ns24eMCsFW7yrxhyvQwFKqGOKXauCpClp2
11+
oPXhd2wljutuIGJjMmeqMw7CuyfZMee6BsuXNWWr/kso0NaQwxKoFnGlyaOl6oUV
12+
ypr5ADXv0NNaSqDgyfEfJedsGQul+WWnkjz6PFbWZtbG5SIKb5PCJ2aWD7mvcHdI
13+
85BL4jUCgYEA0yPogvmlK/hSpckk/AkRtHWwjUdkgdoZzxiJV/D01y8EtB+yL46t
14+
Gzl23Y1VtLXxn+CZdj2putS5z1Rg1LA0oMZ+TwhxGskURBPP7mym83Qn1huRcnWw
15+
df9flCg4IwRLqI6QfsQ2Q6j549j5u8P+tqVi/yZQY0V2SGcXTXaqIksCgYEAyFpy
16+
24+AW33ypNxr9sOIx2YQyn0UDK2K6LQYRmjwhpCZEtBdoUqKGP/9UUycM4TN9D32
17+
p0le+3TJVk9tVqyvwFeGBkguO/3dXD6KTsqrCfMFNj/R6QRYFEaLWjkG8EI5TXOK
18+
a/CbhtyGaRY5QzwLRjLdEYIph3r1d2uedVzwGoMCgYEAvPV59R2u8LcAYFavvs/v
19+
BG3/X7DxBjVGu8zdvdJrjNkLgJiNQ3qQ+bhn5MfEWEIsyESdkvCEoiwXTrHZJv+7
20+
WdfK2rhXYP1sIbEJefvLPj5KGJf7h1BEaJXv2AxWkSAbBfLw5kJ7vfnQClX4yk4R
21+
+yvweSC0+OMFhK6ecDku8hkCgYAJPRJ6yV0z2tTrgTaBRHb0KuKvU6EvDHmRTWyp
22+
IoGk0tocIfuPSm6fxH4b15qETaVpk8nh4OI+Wh5GmpcCHihkiCSn+YAYSBaDAGdE
23+
RtgoN0qQO9UkF40wMiiO2n5VadhWl/NUEt45E8Ym5l1xmj0y2XmUKxpbIvJatV2z
24+
L7vqnQKBgCuV47rGYLaPz+gVgwIz0PvNFgp2fdSBYYQUf70XsaEU1bQtim6q5jxd
25+
+ePUiT65k42Iw7oLWyGtxdyxmmKgQ18i5aDNjT2SLr3RAC2BSR5Fs1W1PLi24nV6
26+
QW7fepI9tOBTbwbLG8ARRzx2YXrBf9PqvmDbrMiTi0WGFGlVJatX
27+
-----END RSA PRIVATE KEY-----

0 commit comments

Comments
 (0)