blob: 3b974c97f1339c86c22265a4a6e8068b2a9ea6e9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
|
$! TOCSP.COM
$
$ cmd = "mcr ''exe_dir'openssl"
$ ocspdir = "ocsp-tests"
$ ! 17 December 2012 so we don't get certificate expiry errors.
$ check_time = "-attime 1355875200"
$
$ test_ocsp: subroutine
$ set noon
$ 'cmd' base64 -d -in [.'ocspdir']'p1' -out f.d
$ 'cmd' ocsp -respin f.d -partial_chain 'check_time' -
"-CAfile" [.'ocspdir']'p2' -verify_other [.'ocspdir']'p2' -
"-CApath" nul:
$ ! when ocsp exits with 0, VMS severity becomes 1
$ ! when ocsp exits with 1, VMS severity becomes 2
$ ! See the definition of EXIT(n) in the VMS sextion in e_os.h
$ if $severity .ne. 'p3'+1 then exit 2 ! severity error
$ exit 1
$ endsubroutine
$
$ on error then exit 2
$ write sys$output "=== VALID OCSP RESPONSES ==="
$ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
$ call test_ocsp ND1.ors ND1_Issuer_ICA.pem 0
$ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp ND2.ors ND2_Issuer_Root.pem 0
$ write sys$output "NON-DELEGATED; Root CA -> EE"
$ call test_ocsp ND3.ors ND3_Issuer_Root.pem 0
$ write sys$output "DELEGATED; Intermediate CA -> EE"
$ call test_ocsp D1.ors D1_Issuer_ICA.pem 0
$ write sys$output "DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp D2.ors D2_Issuer_Root.pem 0
$ write sys$output "DELEGATED; Root CA -> EE"
$ call test_ocsp D3.ors D3_Issuer_Root.pem 0
$
$ write sys$output "=== INVALID SIGNATURE on the OCSP RESPONSE ==="
$ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
$ call test_ocsp ISOP_ND1.ors ND1_Issuer_ICA.pem 1
$ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp ISOP_ND2.ors ND2_Issuer_Root.pem 1
$ write sys$output "NON-DELEGATED; Root CA -> EE"
$ call test_ocsp ISOP_ND3.ors ND3_Issuer_Root.pem 1
$ write sys$output "DELEGATED; Intermediate CA -> EE"
$ call test_ocsp ISOP_D1.ors D1_Issuer_ICA.pem 1
$ write sys$output "DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp ISOP_D2.ors D2_Issuer_Root.pem 1
$ write sys$output "DELEGATED; Root CA -> EE"
$ call test_ocsp ISOP_D3.ors D3_Issuer_Root.pem 1
$
$ write sys$output "=== WRONG RESPONDERID in the OCSP RESPONSE ==="
$ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
$ call test_ocsp WRID_ND1.ors ND1_Issuer_ICA.pem 1
$ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp WRID_ND2.ors ND2_Issuer_Root.pem 1
$ write sys$output "NON-DELEGATED; Root CA -> EE"
$ call test_ocsp WRID_ND3.ors ND3_Issuer_Root.pem 1
$ write sys$output "DELEGATED; Intermediate CA -> EE"
$ call test_ocsp WRID_D1.ors D1_Issuer_ICA.pem 1
$ write sys$output "DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp WRID_D2.ors D2_Issuer_Root.pem 1
$ write sys$output "DELEGATED; Root CA -> EE"
$ call test_ocsp WRID_D3.ors D3_Issuer_Root.pem 1
$
$ write sys$output "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ==="
$ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
$ call test_ocsp WINH_ND1.ors ND1_Issuer_ICA.pem 1
$ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp WINH_ND2.ors ND2_Issuer_Root.pem 1
$ write sys$output "NON-DELEGATED; Root CA -> EE"
$ call test_ocsp WINH_ND3.ors ND3_Issuer_Root.pem 1
$ write sys$output "DELEGATED; Intermediate CA -> EE"
$ call test_ocsp WINH_D1.ors D1_Issuer_ICA.pem 1
$ write sys$output "DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp WINH_D2.ors D2_Issuer_Root.pem 1
$ write sys$output "DELEGATED; Root CA -> EE"
$ call test_ocsp WINH_D3.ors D3_Issuer_Root.pem 1
$
$ write sys$output "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ==="
$ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
$ call test_ocsp WIKH_ND1.ors ND1_Issuer_ICA.pem 1
$ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp WIKH_ND2.ors ND2_Issuer_Root.pem 1
$ write sys$output "NON-DELEGATED; Root CA -> EE"
$ call test_ocsp WIKH_ND3.ors ND3_Issuer_Root.pem 1
$ write sys$output "DELEGATED; Intermediate CA -> EE"
$ call test_ocsp WIKH_D1.ors D1_Issuer_ICA.pem 1
$ write sys$output "DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp WIKH_D2.ors D2_Issuer_Root.pem 1
$ write sys$output "DELEGATED; Root CA -> EE"
$ call test_ocsp WIKH_D3.ors D3_Issuer_Root.pem 1
$
$ write sys$output "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ==="
$ write sys$output "DELEGATED; Intermediate CA -> EE"
$ call test_ocsp WKDOSC_D1.ors D1_Issuer_ICA.pem 1
$ write sys$output "DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp WKDOSC_D2.ors D2_Issuer_Root.pem 1
$ write sys$output "DELEGATED; Root CA -> EE"
$ call test_ocsp WKDOSC_D3.ors D3_Issuer_Root.pem 1
$
$ write sys$output "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ==="
$ write sys$output "DELEGATED; Intermediate CA -> EE"
$ call test_ocsp ISDOSC_D1.ors D1_Issuer_ICA.pem 1
$ write sys$output "DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp ISDOSC_D2.ors D2_Issuer_Root.pem 1
$ write sys$output "DELEGATED; Root CA -> EE"
$ call test_ocsp ISDOSC_D3.ors D3_Issuer_Root.pem 1
$
$ write sys$output "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ==="
$ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
$ call test_ocsp ND1.ors WSNIC_ND1_Issuer_ICA.pem 1
$ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp ND2.ors WSNIC_ND2_Issuer_Root.pem 1
$ write sys$output "NON-DELEGATED; Root CA -> EE"
$ call test_ocsp ND3.ors WSNIC_ND3_Issuer_Root.pem 1
$ write sys$output "DELEGATED; Intermediate CA -> EE"
$ call test_ocsp D1.ors WSNIC_D1_Issuer_ICA.pem 1
$ write sys$output "DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp D2.ors WSNIC_D2_Issuer_Root.pem 1
$ write sys$output "DELEGATED; Root CA -> EE"
$ call test_ocsp D3.ors WSNIC_D3_Issuer_Root.pem 1
$
$ write sys$output "=== WRONG KEY in the ISSUER CERTIFICATE ==="
$ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
$ call test_ocsp ND1.ors WKIC_ND1_Issuer_ICA.pem 1
$ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp ND2.ors WKIC_ND2_Issuer_Root.pem 1
$ write sys$output "NON-DELEGATED; Root CA -> EE"
$ call test_ocsp ND3.ors WKIC_ND3_Issuer_Root.pem 1
$ write sys$output "DELEGATED; Intermediate CA -> EE"
$ call test_ocsp D1.ors WKIC_D1_Issuer_ICA.pem 1
$ write sys$output "DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp D2.ors WKIC_D2_Issuer_Root.pem 1
$ write sys$output "DELEGATED; Root CA -> EE"
$ call test_ocsp D3.ors WKIC_D3_Issuer_Root.pem 1
$
$ write sys$output "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ==="
$ !# Expect success, because we're explicitly trusting the issuer certificate.
$ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
$ call test_ocsp ND1.ors ISIC_ND1_Issuer_ICA.pem 0
$ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp ND2.ors ISIC_ND2_Issuer_Root.pem 0
$ write sys$output "NON-DELEGATED; Root CA -> EE"
$ call test_ocsp ND3.ors ISIC_ND3_Issuer_Root.pem 0
$ write sys$output "DELEGATED; Intermediate CA -> EE"
$ call test_ocsp D1.ors ISIC_D1_Issuer_ICA.pem 0
$ write sys$output "DELEGATED; Root CA -> Intermediate CA"
$ call test_ocsp D2.ors ISIC_D2_Issuer_Root.pem 0
$ write sys$output "DELEGATED; Root CA -> EE"
$ call test_ocsp D3.ors ISIC_D3_Issuer_Root.pem 0
$
$ write sys$output "ALL OCSP TESTS SUCCESSFUL"
$ exit 1
|
