yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
mbedtls/tests/data_files/test-ca.opensslconf

126 lines
2.7 KiB
Text
Raw Normal View History

Added SHA256 test certificates With SHA-1 deprecation, we need a few certificates using algorithms in the default support list. Most tests still use SHA-1 though. The generation process for the new certificates is recorded in the makefile.
2017-05-05 18:56:12 +02:00
[req]
x509_extensions = v3_ca
distinguished_name = req_dn
[req_dn]
countryName = NL
organizationalUnitName = PolarSSL
commonName = PolarSSL Test CA
[v3_ca]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
basicConstraints = CA:true
Add test for CA forgery attempt As we accept EE certs that are explicitly trusted (in the list of trusted roots) and usually look for parent by subject, and in the future we might want to avoid checking the self-signature on trusted certs, there could a risk that we incorrectly accept a cert that looks like a trusted root except it doesn't have the same key. This test ensures this will never happen.
2017-06-29 09:48:08 +02:00
Add rules to generate test-int-ca{2,3}.crt Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
2023-05-25 03:24:17 +02:00
[no_subj_auth_id]
subjectKeyIdentifier=none
authorityKeyIdentifier=none
basicConstraints = CA:true
Suppport otherName of type hardware module name Add support of parsing of subject alternative name, of type otherName. Currently supports only hardware module name, as defined in rfc 4108.
2019-03-21 12:40:13 +01:00
[othername_san]
subjectAltName=otherName:1.3.6.1.5.5.7.8.4;SEQ:hw_module_name
Add a new test with a binary hwSerialNum Signed-off-by: Victor Barpp Gomes <17840319+Kabbah@users.noreply.github.com>
2022-09-29 16:40:20 +02:00
[nonprintable_othername_san]
subjectAltName=otherName:1.3.6.1.5.5.7.8.4;SEQ:nonprintable_hw_module_name
Fix typo 'unsupoported' -> 'unsupported' Signed-off-by: David Horstmann <david.horstmann@arm.com>
2022-11-25 16:50:30 +01:00
[unsupported_othername_san]
Suppport otherName of type hardware module name Add support of parsing of subject alternative name, of type otherName. Currently supports only hardware module name, as defined in rfc 4108.
2019-03-21 12:40:13 +01:00
subjectAltName=otherName:1.2.3.4;UTF8:some other identifier
Update certificates to expire in 2029 Update certificates that expire on 2021, to prolong their validity, to make tests pass three years ahead.
2019-02-12 14:03:42 +01:00
[dns_alt_names]
subjectAltName=DNS:example.com, DNS:example.net, DNS:*.example.org
Add test for parsing SAN: rfc822Name Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2023-02-09 14:47:50 +01:00
[rfc822name_names]
subjectAltName=email:my@other.address,email:second@other.address
Suppport otherName of type hardware module name Add support of parsing of subject alternative name, of type otherName. Currently supports only hardware module name, as defined in rfc 4108.
2019-03-21 12:40:13 +01:00
[alt_names]
DNS.1=example.com
otherName.1=1.3.6.1.5.5.7.8.4;SEQ:hw_module_name
DNS.2=example.net
DNS.3=*.example.org
[multiple_san]
subjectAltName=@alt_names
Add rules to generate cert_example_multi_nocn.crt Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
2023-05-18 04:10:39 +02:00
[ext_multi_nocn]
basicConstraints = CA:false
keyUsage = digitalSignature, nonRepudiation, keyEncipherment
subjectAltName = DNS:www.shotokan-braunschweig.de,DNS:www.massimo-abate.eu,IP:192.168.1.1,IP:192.168.69.144
Suppport otherName of type hardware module name Add support of parsing of subject alternative name, of type otherName. Currently supports only hardware module name, as defined in rfc 4108.
2019-03-21 12:40:13 +01:00
[hw_module_name]
hwtype = OID:1.3.6.1.4.1.17.3
hwserial = OCT:123456
Add a new test with a binary hwSerialNum Signed-off-by: Victor Barpp Gomes <17840319+Kabbah@users.noreply.github.com>
2022-09-29 16:40:20 +02:00
[nonprintable_hw_module_name]
hwtype = OID:1.3.6.1.4.1.17.3
hwserial = FORMAT:HEX, OCT:3132338081008180333231
Add support for certificate policies extension Add support for certificate policies, as defined in rfc 5280. Currently support only `anyPolicy` policy.
2019-03-21 13:00:03 +01:00
[v3_any_policy_ca]
basicConstraints = CA:true
certificatePolicies = 2.5.29.32.0
[v3_any_policy_qualifier_ca]
basicConstraints = CA:true
certificatePolicies = @policy_info
[v3_multi_policy_ca]
basicConstraints = CA:true
certificatePolicies = 1.2.3.4,2.5.29.32.0
[v3_unsupported_policy_ca]
basicConstraints = CA:true
certificatePolicies = 1.2.3.4
[policy_info]
policyIdentifier = 2.5.29.32.0
CPS.1 ="CPS uri string"
Add Wisun Fan device certificate Add certificate with Wisun fan device extended key usage, support parsing it and add tests.
2019-03-25 13:05:23 +01:00
[fan_cert]
extendedKeyUsage = 1.3.6.1.4.1.45605.1
Add test for CA forgery attempt As we accept EE certs that are explicitly trusted (in the list of trusted roots) and usually look for parent by subject, and in the future we might want to avoid checking the self-signature on trusted certs, there could a risk that we incorrectly accept a cert that looks like a trusted root except it doesn't have the same key. This test ensures this will never happen.
2017-06-29 09:48:08 +02:00
[noext_ca]
basicConstraints = CA:true
Merge tag 'mbedtls-2.8.0' into iotssl-1381-x509-verify-refactor-restricted Conflict resolution: * ChangeLog * tests/data_files/Makefile: concurrent additions, order irrelevant * tests/data_files/test-ca.opensslconf: concurrent additions, order irrelevant * tests/scripts/all.sh: one comment change conflicted with a code addition. In addition some of the additions in the iotssl-1381-x509-verify-refactor-restricted branch need support for keep-going mode, this will be added in a subsequent commit.
2018-03-22 22:21:55 +01:00
x509: CRL: reject unsupported critical extensions
2018-03-13 11:53:30 +01:00
[test_ca]
database = /dev/null
[crl_ext_idp]
issuingDistributionPoint=critical, @idpdata
x509: CRL: add tests for non-critical extension The 'critical' boolean can be set to false in two ways: - by leaving it implicit (test data generated by openssl) - by explicitly setting it to false (generated by hand)
2018-03-14 12:23:56 +01:00
[crl_ext_idp_nc]
issuingDistributionPoint=@idpdata
x509: CRL: reject unsupported critical extensions
2018-03-13 11:53:30 +01:00
[idpdata]
fullname=URI:http://pki.example.com/
Add test: DNS names should not match IP addresses Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2020-07-23 12:39:53 +02:00
# these IPs are the ascii values for 'abcd' and 'abcd.example.com'
[tricky_ip_san]
subjectAltName=IP:97.98.99.100,IP:6162:6364:2e65:7861:6d70:6c65:2e63:6f6d
Generate csr files to test v3 extensions Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2023-01-12 15:30:45 +01:00
[csr_ext_v3_keyUsage]
keyUsage = digitalSignature, keyEncipherment
[csr_ext_v3_subjectAltName]
subjectAltName=DNS:example.com, DNS:example.net, DNS:*.example.org
[csr_ext_v3_nsCertType]
nsCertType=server
[csr_ext_v3_all]
keyUsage = cRLSign
subjectAltName=otherName:1.3.6.1.5.5.7.8.4;SEQ:nonprintable_hw_module_name
nsCertType=client
Add support for directoryName subjectAltName Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2023-01-10 12:47:38 +01:00
[directory_name_san]
subjectAltName=dirName:dirname_sect
Fix malformed directoryName extensions Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2023-06-28 10:58:19 +02:00
[two_directorynames]
subjectAltName=dirName:dirname_sect, dirName:dirname_to_malform
Add the original certificate to be malformed for x509 tests Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2023-01-12 12:51:20 +01:00
Add support for directoryName subjectAltName Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2023-01-10 12:47:38 +01:00
[dirname_sect]
C=UK
O=Mbed TLS
CN=Mbed TLS directoryName SAN
Add the original certificate to be malformed for x509 tests Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2023-01-12 12:51:20 +01:00
Fix malformed directoryName extensions Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2023-06-28 10:58:19 +02:00
[dirname_to_malform]
Add the original certificate to be malformed for x509 tests Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2023-01-12 12:51:20 +01:00
O=MALFORM_ME
Reference in a new issue Copy permalink