1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
begin
require "openssl"
require File.join(File.dirname(__FILE__), "utils.rb")
rescue LoadError
end
require "test/unit"
if defined?(OpenSSL)
class OpenSSL::TestX509Extension < Test::Unit::TestCase
def setup
@basic_constraints_value = OpenSSL::ASN1::Sequence([
OpenSSL::ASN1::Boolean(true), # CA
OpenSSL::ASN1::Integer(2) # pathlen
])
@basic_constraints = OpenSSL::ASN1::Sequence([
OpenSSL::ASN1::ObjectId("basicConstraints"),
OpenSSL::ASN1::Boolean(true),
OpenSSL::ASN1::OctetString(@basic_constraints_value.to_der),
])
end
def teardown
end
def test_new
ext = OpenSSL::X509::Extension.new(@basic_constraints.to_der)
assert_equal("basicConstraints", ext.oid)
assert_equal(true, ext.critical?)
assert_equal("CA:TRUE, pathlen:2", ext.value)
ext = OpenSSL::X509::Extension.new("2.5.29.19",
@basic_constraints_value.to_der, true)
assert_equal(@basic_constraints.to_der, ext.to_der)
end
def test_create_by_factory
ef = OpenSSL::X509::ExtensionFactory.new
bc = ef.create_extension("basicConstraints", "critical, CA:TRUE, pathlen:2")
assert_equal(@basic_constraints.to_der, bc.to_der)
bc = ef.create_extension("basicConstraints", "CA:TRUE, pathlen:2", true)
assert_equal(@basic_constraints.to_der, bc.to_der)
begin
ef.config = OpenSSL::Config.parse(<<-_end_of_cnf_)
[crlDistPts]
URI.1 = http://www.example.com/crl
URI.2 = ldap://ldap.example.com/cn=ca?certificateRevocationList;binary
_end_of_cnf_
rescue NotImplementedError
return
end
cdp = ef.create_extension("crlDistributionPoints", "@crlDistPts")
assert_equal(false, cdp.critical?)
assert_equal("crlDistributionPoints", cdp.oid)
=begin TODO: JRuby-OSSL does not implement some features such as config reference, DER:, etc.
assert_match(%{URI:http://www\.example\.com/crl}, cdp.value)
assert_match(
%r{URI:ldap://ldap\.example\.com/cn=ca\?certificateRevocationList;binary},
cdp.value)
=end
cdp = ef.create_extension("crlDistributionPoints", "critical, @crlDistPts")
assert_equal(true, cdp.critical?)
assert_equal("crlDistributionPoints", cdp.oid)
=begin TODO: ditto
assert_match(%{URI:http://www.example.com/crl}, cdp.value)
assert_match(
%r{URI:ldap://ldap.example.com/cn=ca\?certificateRevocationList;binary},
cdp.value)
=end
end
# JRUBY-3888
# Problems with subjectKeyIdentifier with non 20-bytes sha1 digested keys
def test_certificate_with_rare_extension
cert_file = File.expand_path('../fixture/max.pem', File.dirname(__FILE__))
cer = OpenSSL::X509::Certificate.new(File.read(cert_file))
exts = Hash.new
cer.extensions.each{|ext| exts[ext.oid] = ext.value}
assert exts["subjectKeyIdentifier"] == "4C:B9:E1:DC:7A:AC:35:CF"
end
def test_extension_from_20_byte_sha1_digests
cert_file = File.expand_path('../fixture/common.pem', File.dirname(__FILE__))
cer = OpenSSL::X509::Certificate.new(File.read(cert_file))
exts = Hash.new
cer.extensions.each{|ext| exts[ext.oid] = ext.value}
assert exts["subjectKeyIdentifier"] == "B4:AC:83:5D:21:FB:D6:8A:56:7E:B2:49:6D:69:BB:E4:6F:D8:5A:AC"
end
end
end
|
