#! /bin/bash # # This Source Code Form is subject to the terms of the Mozilla Public # License, v. 2.0. If a copy of the MPL was not distributed with this # file, You can obtain one at http://mozilla.org/MPL/2.0/.
######################################################################## # # mozilla/security/nss/tests/cert/rcert.sh # # Certificate generating and handeling for NSS QA, can be included # multiple times from all.sh and the individual scripts # # needs to work on all Unix and Windows platforms # # included from (don't expect this to be up to date) # -------------------------------------------------- # all.sh # ssl.sh # smime.sh # tools.sh # # special strings # --------------- # FIXME ... known problems, search for this string # NOTE .... unexpected behavior # # FIXME - Netscape - NSS ########################################################################
############################## cert_init ############################### # local shell function to initialize this script ########################################################################
cert_init()
{
SCRIPTNAME="cert.sh" if [ -z "${CLEANUP}" ] ; then# if nobody else is responsible for
CLEANUP="${SCRIPTNAME}"# cleaning this script will do it fi if [ -z "${INIT_SOURCED}" ] ; then
cd ../common
. ./init.sh fi if [ -z "${IOPR_CERT_SOURCED}" ]; then
. ../iopr/cert_iopr.sh fi
SCRIPTNAME="cert.sh"
CRL_GRP_DATE=`date -u "+%Y%m%d%H%M%SZ"`
html_head "Certutil and Crlutil Tests"
LIBDIR="${DIST}/${OBJDIR}/lib"
ROOTCERTSFILE=`ls -1 ${LIBDIR}/*nssckbi.* | head -1` if [ ! "${ROOTCERTSFILE}" ] ; then
html_failed "Looking for root certs module."
cert_log "ERROR: Root certs module not found."
Exit 5 "Fatal - Root certs module not found." else
html_passed "Looking for root certs module." fi
if [ "${OS_ARCH}" = "WINNT" -a "$OS_NAME" = "CYGWIN_NT" ]; then
ROOTCERTSFILE=`cygpath -m ${ROOTCERTSFILE}` fi
}
######################################################################## # function wraps calls to pk12util, also: writes action and options # to stdout. # Params are the same as to pk12util. # Returns pk12util status #
pk12u()
{ echo"${CU_ACTION} --------------------------"
echo"pk12util $@"
${BINDIR}/pk12util $@
RET=$?
return $RET
}
################################ certu ################################# # local shell function to call certutil, also: writes action and options to # stdout, sets variable RET and writes results to the html file results ########################################################################
certu()
{ echo"$SCRIPTNAME: ${CU_ACTION} --------------------------"
EXPECTED=${RETEXPECTED-0}
if [ -n "${CU_SUBJECT}" ]; then #the subject of the cert contains blanks, and the shell #will strip the quotes off the string, if called otherwise... echo"certutil -s \"${CU_SUBJECT}\" $*"
${PROFTOOL} ${BINDIR}/certutil -s "${CU_SUBJECT}" $*
RET=$?
CU_SUBJECT="" else echo"certutil $*"
${PROFTOOL} ${BINDIR}/certutil $*
RET=$? fi if [ "$RET" -ne "$EXPECTED" ]; then
CERTFAILED=$RET
html_failed "${CU_ACTION} ($RET=$EXPECTED) "
cert_log "ERROR: ${CU_ACTION} failed $RET" else
html_passed "${CU_ACTION}" fi
return $RET
}
################################ crlu ################################# # local shell function to call crlutil, also: writes action and options to # stdout, sets variable RET and writes results to the html file results ########################################################################
crlu()
{ echo"$SCRIPTNAME: ${CU_ACTION} --------------------------"
CRLUTIL="crlutil -q" echo"$CRLUTIL $*"
${PROFTOOL} ${BINDIR}/$CRLUTIL $*
RET=$? if [ "$RET" -ne 0 ]; then
CRLFAILED=$RET
html_failed "${CU_ACTION} ($RET) "
cert_log "ERROR: ${CU_ACTION} failed $RET" else
html_passed "${CU_ACTION}" fi
return $RET
}
################################ ocspr ################################## # local shell function to call ocsresp, also: writes action and options to # stdout, sets variable RET and writes results to the html file results #########################################################################
ocspr()
{ echo"$SCRIPTNAME: ${OR_ACTION} --------------------------"
OCSPRESP="ocspresp" echo"$OCSPRESP $*"
${PROFTOOL} ${BINDIR}/$OCSPRESP $*
RET=$? if [ "$RET" -ne 0 ]; then
OCSPFAILED=$RET
html_failed "${OR_ACTION} ($RET) "
cert_log "ERROR: ${OR_ACTION} failed $RET" else
html_passed "${OR_ACTION}" fi
MODUTIL="modutil" echo"$MODUTIL $*" # echo is used to press Enter expected by modutil echo | ${BINDIR}/$MODUTIL $*
RET=$? if [ "$RET" -ne 0 ]; then
MODFAILED=$RET
html_failed "${CU_ACTION} ($RET) "
cert_log "ERROR: ${CU_ACTION} failed $RET" else
html_passed "${CU_ACTION}" fi
return $RET
}
############################# cert_init_cert ########################## # local shell function to initialize creation of client and server certs ########################################################################
cert_init_cert()
{
CERTDIR="$1"
CERTNAME="$2"
CERTSERIAL="$3"
DOMAIN="$4"
if [ ! -d "${CERTDIR}" ]; then
mkdir -p "${CERTDIR}" else echo"$SCRIPTNAME: WARNING - ${CERTDIR} exists" fi
cd "${CERTDIR}"
CERTDIR="."
PROFILEDIR=`cd ${CERTDIR}; pwd` if [ "${OS_ARCH}" = "WINNT" -a "$OS_NAME" = "CYGWIN_NT" ]; then
PROFILEDIR=`cygpath -m ${PROFILEDIR}` fi if [ -n "${MULTIACCESS_DBM}" ]; then
PROFILEDIR="multiaccess:${DOMAIN}" fi
noise
}
############################# hw_acc ################################# # local shell function to add hw accelerator modules to the db ########################################################################
hw_acc()
{
HW_ACC_RET=0
HW_ACC_ERR="" if [ -n "$O_HWACC" -a "$O_HWACC" = ON -a -z "$USE_64" ] ; then echo"creating $CERTNAME s cert with hwaccelerator..." #case $ACCELERATOR in #rainbow)
echo"modutil -add rainbow -libfile /usr/lib/libcryptoki22.so " echo" -dbdir ${PROFILEDIR} 2>&1 " echo | ${BINDIR}/modutil -add rainbow -libfile /usr/lib/libcryptoki22.so \
-dbdir ${PROFILEDIR} 2>&1 if [ "$?" -ne 0 ]; then echo"modutil -add rainbow failed in `pwd`"
HW_ACC_RET=1
HW_ACC_ERR="modutil -add rainbow" fi
echo"modutil -add ncipher " echo" -libfile /opt/nfast/toolkits/pkcs11/libcknfast.so " echo" -dbdir ${PROFILEDIR} 2>&1 " echo | ${BINDIR}/modutil -add ncipher \
-libfile /opt/nfast/toolkits/pkcs11/libcknfast.so \
-dbdir ${PROFILEDIR} 2>&1 if [ "$?" -ne 0 ]; then echo"modutil -add ncipher failed in `pwd`"
HW_ACC_RET=`expr $HW_ACC_RET + 2`
HW_ACC_ERR="$HW_ACC_ERR,modutil -add ncipher" fi if [ "$HW_ACC_RET" -ne 0 ]; then
html_failed "Adding HW accelerators to certDB for ${CERTNAME} ($HW_ACC_RET) " else
html_passed "Adding HW accelerators to certDB for ${CERTNAME}" fi
fi
return $HW_ACC_RET
}
############################# cert_create_cert ######################### # local shell function to create client certs # initialize DB, import # root cert # add cert to DB ########################################################################
cert_create_cert()
{
cert_init_cert "$1""$2""$3""$4"
CU_ACTION="Initializing ${CERTNAME}'s Cert DB"
certu -N -d "${PROFILEDIR}" -f "${R_PWFILE}" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
CU_ACTION="Loading root cert module to ${CERTNAME}'s Cert DB"
modu -add "RootCerts" -libfile "${ROOTCERTSFILE}" -dbdir "${PROFILEDIR}" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
hw_acc
CU_ACTION="Import Root CA for $CERTNAME"
certu -A -n "TestCA" -t "TC,TC,TC" -f "${R_PWFILE}" -d "${PROFILEDIR}" \
-i "${R_CADIR}/TestCA.ca.cert" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
CU_ACTION="Import DSA Root CA for $CERTNAME"
certu -A -n "TestCA-dsa" -t "TC,TC,TC" -f "${R_PWFILE}" \
-d "${PROFILEDIR}" -i "${R_CADIR}/TestCA-dsa.ca.cert" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
CU_ACTION="Import EC Root CA for $CERTNAME"
certu -A -n "TestCA-ec" -t "TC,TC,TC" -f "${R_PWFILE}" \
-d "${PROFILEDIR}" -i "${R_CADIR}/TestCA-ec.ca.cert" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
cert_add_cert "$5"
return $?
}
############################# cert_add_cert ############################ # local shell function to add client certs to an existing CERT DB # generate request # sign request # import Cert # ########################################################################
cert_add_cert()
{
CU_ACTION="Generate Cert Request for $CERTNAME"
CU_SUBJECT="CN=$CERTNAME, E=${CERTNAME}@example.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
certu -R -d "${PROFILEDIR}" -f "${R_PWFILE}" -z "${R_NOISE_FILE}" -o req 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
CU_ACTION="Sign ${CERTNAME}'s Request"
certu -C -c "TestCA" -m "$CERTSERIAL" -v 60 -d "${P_R_CADIR}" \
-i req -o "${CERTNAME}.cert" -f "${R_PWFILE}""$1" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
CU_ACTION="Import $CERTNAME's Cert"
certu -A -n "$CERTNAME" -t "u,u,u" -d "${PROFILEDIR}" -f "${R_PWFILE}" \
-i "${CERTNAME}.cert" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
cert_log "SUCCESS: $CERTNAME's Cert Created"
# # Generate and add DSA cert #
CU_ACTION="Generate DSA Cert Request for $CERTNAME"
CU_SUBJECT="CN=$CERTNAME, E=${CERTNAME}-dsa@example.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
certu -R -k dsa -d "${PROFILEDIR}" -f "${R_PWFILE}" \
-z "${R_NOISE_FILE}" -o req 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
CU_ACTION="Sign ${CERTNAME}'s DSA Request"
certu -C -c "TestCA-dsa" -m "$CERTSERIAL" -v 60 -d "${P_R_CADIR}" \
-i req -o "${CERTNAME}-dsa.cert" -f "${R_PWFILE}""$1" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
CU_ACTION="Import $CERTNAME's DSA Cert"
certu -A -n "${CERTNAME}-dsa" -t "u,u,u" -d "${PROFILEDIR}" \
-f "${R_PWFILE}" -i "${CERTNAME}-dsa.cert" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
cert_log "SUCCESS: $CERTNAME's DSA Cert Created"
# Generate DSA certificate signed with RSA
CU_ACTION="Generate mixed DSA Cert Request for $CERTNAME"
CU_SUBJECT="CN=$CERTNAME, E=${CERTNAME}-dsamixed@example.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
certu -R -k dsa -d "${PROFILEDIR}" -f "${R_PWFILE}" \
-z "${R_NOISE_FILE}" -o req 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
CU_ACTION="Sign ${CERTNAME}'s DSA Request with RSA" # Avoid conflicting serial numbers with TestCA issuer by keeping # this set far away. A smaller number risks colliding with the # extended ssl user certificates.
NEWSERIAL=`expr ${CERTSERIAL} + 20000`
certu -C -c "TestCA" -m "$NEWSERIAL" -v 60 -d "${P_R_CADIR}" \
-i req -o "${CERTNAME}-dsamixed.cert" -f "${R_PWFILE}""$1" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
CU_ACTION="Import $CERTNAME's mixed DSA Cert"
certu -A -n "${CERTNAME}-dsamixed" -t "u,u,u" -d "${PROFILEDIR}" \
-f "${R_PWFILE}" -i "${CERTNAME}-dsamixed.cert" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
cert_log "SUCCESS: $CERTNAME's mixed DSA Cert Created"
# # Generate and add EC cert #
CURVE="secp384r1"
CU_ACTION="Generate EC Cert Request for $CERTNAME"
CU_SUBJECT="CN=$CERTNAME, E=${CERTNAME}-ec@example.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
certu -R -k ec -q "${CURVE}" -d "${PROFILEDIR}" -f "${R_PWFILE}" \
-z "${R_NOISE_FILE}" -o req 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
CU_ACTION="Sign ${CERTNAME}'s EC Request"
certu -C -c "TestCA-ec" -m "$CERTSERIAL" -v 60 -d "${P_R_CADIR}" \
-i req -o "${CERTNAME}-ec.cert" -f "${R_PWFILE}""$1" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
CU_ACTION="Import $CERTNAME's EC Cert"
certu -A -n "${CERTNAME}-ec" -t "u,u,u" -d "${PROFILEDIR}" \
-f "${R_PWFILE}" -i "${CERTNAME}-ec.cert" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
cert_log "SUCCESS: $CERTNAME's EC Cert Created"
# Generate EC certificate signed with RSA
CU_ACTION="Generate mixed EC Cert Request for $CERTNAME"
CU_SUBJECT="CN=$CERTNAME, E=${CERTNAME}-ecmixed@example.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
certu -R -k ec -q "${CURVE}" -d "${PROFILEDIR}" -f "${R_PWFILE}" \
-z "${R_NOISE_FILE}" -o req 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
CU_ACTION="Sign ${CERTNAME}'s EC Request with RSA" # Avoid conflicting serial numbers with TestCA issuer by keeping # this set far away. A smaller number risks colliding with the # extended ssl user certificates.
NEWSERIAL=`expr ${CERTSERIAL} + 10000`
certu -C -c "TestCA" -m "$NEWSERIAL" -v 60 -d "${P_R_CADIR}" \
-i req -o "${CERTNAME}-ecmixed.cert" -f "${R_PWFILE}""$1" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
CU_ACTION="Import $CERTNAME's mixed EC Cert"
certu -A -n "${CERTNAME}-ecmixed" -t "u,u,u" -d "${PROFILEDIR}" \
-f "${R_PWFILE}" -i "${CERTNAME}-ecmixed.cert" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
cert_log "SUCCESS: $CERTNAME's mixed EC Cert Created"
echo"Importing RSA-PSS server certificate"
pk12u -i ${QADIR}/cert/TestUser-rsa-pss-interop.p12 -k ${R_PWFILE} -w ${R_PWFILE} -d ${PROFILEDIR} # Let's get the key ID of the imported private key.
KEYID=`${BINDIR}/certutil -d ${PROFILEDIR} -K -f ${R_PWFILE} | \
grep 'TestUser-rsa-pss-interop$' | sed -n 's/^<.*> [^ ]\{1,\} *\([^ ]\{1,\}\).*/\1/p'`
################################# cert_all_CA ################################ # local shell function to build the additional Temp. Certificate Authority (CA) # used for the "real life" ssl test with 2 different CA's in the # client and in the server's dir ##########################################################################
cert_all_CA()
{
ALL_CU_SUBJECT="CN=NSS Test CA, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
cert_CA $CADIR TestCA -x "CTu,CTu,CTu" ${D_CA} "1"
ALL_CU_SUBJECT="CN=NSS Server Test CA, O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_CA $SERVER_CADIR serverCA -x "Cu,Cu,Cu" ${D_SERVER_CA} "2"
ALL_CU_SUBJECT="CN=NSS Chain1 Server Test CA, O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_CA $SERVER_CADIR chain-1-serverCA "-c serverCA""u,u,u" ${D_SERVER_CA} "3"
ALL_CU_SUBJECT="CN=NSS Chain2 Server Test CA, O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_CA $SERVER_CADIR chain-2-serverCA "-c chain-1-serverCA""u,u,u" ${D_SERVER_CA} "4"
ALL_CU_SUBJECT="CN=NSS Client Test CA, O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_CA $CLIENT_CADIR clientCA -x "Tu,Cu,Cu" ${D_CLIENT_CA} "5"
ALL_CU_SUBJECT="CN=NSS Chain1 Client Test CA, O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_CA $CLIENT_CADIR chain-1-clientCA "-c clientCA""u,u,u" ${D_CLIENT_CA} "6"
ALL_CU_SUBJECT="CN=NSS Chain2 Client Test CA, O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_CA $CLIENT_CADIR chain-2-clientCA "-c chain-1-clientCA""u,u,u" ${D_CLIENT_CA} "7"
# root.cert in $CLIENT_CADIR and in $SERVER_CADIR is one of the last # in the chain
# # Create DSA version of TestCA
ALL_CU_SUBJECT="CN=NSS Test CA (DSA), O=BOGUS NSS, L=Mountain View, ST=California, C=US"
cert_dsa_CA $CADIR TestCA-dsa -x "CTu,CTu,CTu" ${D_CA} "1" # # Create DSA versions of the intermediate CA certs
ALL_CU_SUBJECT="CN=NSS Server Test CA (DSA), O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_dsa_CA $SERVER_CADIR serverCA-dsa -x "Cu,Cu,Cu" ${D_SERVER_CA} "2"
ALL_CU_SUBJECT="CN=NSS Chain1 Server Test CA (DSA), O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_dsa_CA $SERVER_CADIR chain-1-serverCA-dsa "-c serverCA-dsa""u,u,u" ${D_SERVER_CA} "3"
ALL_CU_SUBJECT="CN=NSS Chain2 Server Test CA (DSA), O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_dsa_CA $SERVER_CADIR chain-2-serverCA-dsa "-c chain-1-serverCA-dsa""u,u,u" ${D_SERVER_CA} "4"
ALL_CU_SUBJECT="CN=NSS Client Test CA (DSA), O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_dsa_CA $CLIENT_CADIR clientCA-dsa -x "Tu,Cu,Cu" ${D_CLIENT_CA} "5"
ALL_CU_SUBJECT="CN=NSS Chain1 Client Test CA (DSA), O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_dsa_CA $CLIENT_CADIR chain-1-clientCA-dsa "-c clientCA-dsa""u,u,u" ${D_CLIENT_CA} "6"
ALL_CU_SUBJECT="CN=NSS Chain2 Client Test CA (DSA), O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_dsa_CA $CLIENT_CADIR chain-2-clientCA-dsa "-c chain-1-clientCA-dsa""u,u,u" ${D_CLIENT_CA} "7"
rm $CLIENT_CADIR/dsaroot.cert $SERVER_CADIR/dsaroot.cert # dsaroot.cert in $CLIENT_CADIR and in $SERVER_CADIR is one of the last # in the chain
# # Create RSA-PSS version of TestCA
ALL_CU_SUBJECT="CN=NSS Test CA (RSA-PSS), O=BOGUS NSS, L=Mountain View, ST=California, C=US"
cert_rsa_pss_CA $CADIR TestCA-rsa-pss -x "CTu,CTu,CTu" ${D_CA} "1" SHA256 rm $CADIR/rsapssroot.cert
ALL_CU_SUBJECT="CN=NSS Test CA (RSA-PSS-SHA1), O=BOGUS NSS, L=Mountain View, ST=California, C=US"
cert_rsa_pss_CA $CADIR TestCA-rsa-pss-sha1 -x "CTu,CTu,CTu" ${D_CA} "1" SHA1 rm $CADIR/rsapssroot.cert
# # Create EC version of TestCA
CA_CURVE="secp521r1"
ALL_CU_SUBJECT="CN=NSS Test CA (ECC), O=BOGUS NSS, L=Mountain View, ST=California, C=US"
cert_ec_CA $CADIR TestCA-ec -x "CTu,CTu,CTu" ${D_CA} "1" ${CA_CURVE} # # Create EC versions of the intermediate CA certs
ALL_CU_SUBJECT="CN=NSS Server Test CA (ECC), O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_ec_CA $SERVER_CADIR serverCA-ec -x "Cu,Cu,Cu" ${D_SERVER_CA} "2" ${CA_CURVE}
ALL_CU_SUBJECT="CN=NSS Chain1 Server Test CA (ECC), O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_ec_CA $SERVER_CADIR chain-1-serverCA-ec "-c serverCA-ec""u,u,u" ${D_SERVER_CA} "3" ${CA_CURVE}
ALL_CU_SUBJECT="CN=NSS Chain2 Server Test CA (ECC), O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_ec_CA $SERVER_CADIR chain-2-serverCA-ec "-c chain-1-serverCA-ec""u,u,u" ${D_SERVER_CA} "4" ${CA_CURVE}
ALL_CU_SUBJECT="CN=NSS Client Test CA (ECC), O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_ec_CA $CLIENT_CADIR clientCA-ec -x "Tu,Cu,Cu" ${D_CLIENT_CA} "5" ${CA_CURVE}
ALL_CU_SUBJECT="CN=NSS Chain1 Client Test CA (ECC), O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_ec_CA $CLIENT_CADIR chain-1-clientCA-ec "-c clientCA-ec""u,u,u" ${D_CLIENT_CA} "6" ${CA_CURVE}
ALL_CU_SUBJECT="CN=NSS Chain2 Client Test CA (ECC), O=BOGUS NSS, L=Santa Clara, ST=California, C=US"
cert_ec_CA $CLIENT_CADIR chain-2-clientCA-ec "-c chain-1-clientCA-ec""u,u,u" ${D_CLIENT_CA} "7" ${CA_CURVE}
rm $CLIENT_CADIR/ecroot.cert $SERVER_CADIR/ecroot.cert # ecroot.cert in $CLIENT_CADIR and in $SERVER_CADIR is one of the last # in the chain
}
################################# cert_CA ################################ # local shell function to build the Temp. Certificate Authority (CA) # used for testing purposes, creating a CA Certificate and a root cert ##########################################################################
cert_CA()
{
CUR_CADIR=$1
NICKNAME=$2
SIGNER=$3
TRUSTARG=$4
DOMAIN=$5
CERTSERIAL=$6
echo"$SCRIPTNAME: Creating a CA Certificate $NICKNAME =========================="
if [ ! -d "${CUR_CADIR}" ]; then
mkdir -p "${CUR_CADIR}" fi
cd ${CUR_CADIR}
pwd
LPROFILE=`pwd` if [ "${OS_ARCH}" = "WINNT" -a "$OS_NAME" = "CYGWIN_NT" ]; then
LPROFILE=`cygpath -m ${LPROFILE}` fi if [ -n "${MULTIACCESS_DBM}" ]; then
LPROFILE="multiaccess:${DOMAIN}" fi
if [ "$SIGNER" = "-x" ] ; then# self signed -> create DB
CU_ACTION="Creating CA Cert DB"
certu -N -d "${LPROFILE}" -f ${R_PWFILE} 2>&1 if [ "$RET" -ne 0 ]; then
Exit 5 "Fatal - failed to create CA $NICKNAME " fi
CU_ACTION="Loading root cert module to CA Cert DB"
modu -add "RootCerts" -libfile "${ROOTCERTSFILE}" -dbdir "${LPROFILE}" 2>&1 if [ "$RET" -ne 0 ]; then
return $RET fi
echo"$SCRIPTNAME: Certificate initialized ----------" fi
################# Creating CA Cert ###################################### #
CU_ACTION="Creating CA Cert $NICKNAME "
CU_SUBJECT=$ALL_CU_SUBJECT
certu -S -n $NICKNAME -t $TRUSTARG -v 600 $SIGNER -d ${LPROFILE} -1 -2 -5 \
-f ${R_PWFILE} -z ${R_NOISE_FILE} -m $CERTSERIAL 2>&1 <<CERTSCRIPT
5
6
9
n
y
-1
n
5
6
7
9
n
CERTSCRIPT
if [ "$RET" -ne 0 ]; then echo"return value is $RET"
Exit 6 "Fatal - failed to create CA cert" fi
################# Exporting Root Cert ################################### #
CU_ACTION="Exporting Root Cert"
certu -L -n $NICKNAME -r -d ${LPROFILE} -o root.cert if [ "$RET" -ne 0 ]; then
Exit 7 "Fatal - failed to export root cert" fi cp root.cert ${NICKNAME}.ca.cert
}
################################ cert_dsa_CA ############################# # local shell function to build the Temp. Certificate Authority (CA) # used for testing purposes, creating a CA Certificate and a root cert # This is the DSA version of cert_CA. ##########################################################################
cert_dsa_CA()
{
CUR_CADIR=$1
NICKNAME=$2
SIGNER=$3
TRUSTARG=$4
DOMAIN=$5
CERTSERIAL=$6
echo"$SCRIPTNAME: Creating a DSA CA Certificate $NICKNAME =========================="
if [ ! -d "${CUR_CADIR}" ]; then
mkdir -p "${CUR_CADIR}" fi
cd ${CUR_CADIR}
pwd
LPROFILE=. if [ -n "${MULTIACCESS_DBM}" ]; then
LPROFILE="multiaccess:${DOMAIN}" fi
################# Creating a DSA CA Cert ############################### #
CU_ACTION="Creating DSA CA Cert $NICKNAME "
CU_SUBJECT=$ALL_CU_SUBJECT
certu -S -n $NICKNAME -k dsa -t $TRUSTARG -v 600 $SIGNER \
-d ${LPROFILE} -1 -2 -5 -f ${R_PWFILE} -z ${R_NOISE_FILE} \
-m $CERTSERIAL 2>&1 <<CERTSCRIPT
5
6
9
n
y
-1
n
5
6
7
9
n
CERTSCRIPT
if [ "$RET" -ne 0 ]; then echo"return value is $RET"
Exit 6 "Fatal - failed to create DSA CA cert" fi
################# Exporting DSA Root Cert ############################### #
CU_ACTION="Exporting DSA Root Cert"
certu -L -n $NICKNAME -r -d ${LPROFILE} -o dsaroot.cert if [ "$RET" -ne 0 ]; then
Exit 7 "Fatal - failed to export dsa root cert" fi cp dsaroot.cert ${NICKNAME}.ca.cert
}
################################ cert_rsa_pss_CA ############################# # local shell function to build the Temp. Certificate Authority (CA) # used for testing purposes, creating a CA Certificate and a root cert # This is the RSA-PSS version of cert_CA. ##########################################################################
cert_rsa_pss_CA()
{
CUR_CADIR=$1
NICKNAME=$2
SIGNER=$3
TRUSTARG=$4
DOMAIN=$5
CERTSERIAL=$6
HASHALG=$7
echo"$SCRIPTNAME: Creating an RSA-PSS CA Certificate $NICKNAME =========================="
if [ ! -d "${CUR_CADIR}" ]; then
mkdir -p "${CUR_CADIR}" fi
cd ${CUR_CADIR}
pwd
LPROFILE=. if [ -n "${MULTIACCESS_DBM}" ]; then
LPROFILE="multiaccess:${DOMAIN}" fi
HASHOPT= if [ -n "$HASHALG" ]; then
HASHOPT="-Z $HASHALG" fi
################# Creating an RSA-PSS CA Cert ############################### #
CU_ACTION="Creating RSA-PSS CA Cert $NICKNAME "
CU_SUBJECT=$ALL_CU_SUBJECT
certu -S -n $NICKNAME -k rsa --pss $HASHOPT -t $TRUSTARG -v 600 $SIGNER \
-d ${LPROFILE} -1 -2 -5 -f ${R_PWFILE} -z ${R_NOISE_FILE} \
-m $CERTSERIAL 2>&1 <<CERTSCRIPT
5
6
9
n
y
-1
n
5
6
7
9
n
CERTSCRIPT
if [ "$RET" -ne 0 ]; then echo"return value is $RET"
Exit 6 "Fatal - failed to create RSA-PSS CA cert" fi
################# Exporting RSA-PSS Root Cert ############################### #
CU_ACTION="Exporting RSA-PSS Root Cert"
certu -L -n $NICKNAME -r -d ${LPROFILE} -o rsapssroot.cert if [ "$RET" -ne 0 ]; then
Exit 7 "Fatal - failed to export RSA-PSS root cert" fi cp rsapssroot.cert ${NICKNAME}.ca.cert
}
################################ cert_ec_CA ############################## # local shell function to build the Temp. Certificate Authority (CA) # used for testing purposes, creating a CA Certificate and a root cert # This is the ECC version of cert_CA. ##########################################################################
cert_ec_CA()
{
CUR_CADIR=$1
NICKNAME=$2
SIGNER=$3
TRUSTARG=$4
DOMAIN=$5
CERTSERIAL=$6
CURVE=$7
echo"$SCRIPTNAME: Creating an EC CA Certificate $NICKNAME =========================="
if [ ! -d "${CUR_CADIR}" ]; then
mkdir -p "${CUR_CADIR}" fi
cd ${CUR_CADIR}
pwd
LPROFILE=. if [ -n "${MULTIACCESS_DBM}" ]; then
LPROFILE="multiaccess:${DOMAIN}" fi
################# Creating an EC CA Cert ################################ #
CU_ACTION="Creating EC CA Cert $NICKNAME "
CU_SUBJECT=$ALL_CU_SUBJECT
certu -S -n $NICKNAME -k ec -q $CURVE -t $TRUSTARG -v 600 $SIGNER \
-d ${LPROFILE} -1 -2 -5 -f ${R_PWFILE} -z ${R_NOISE_FILE} \
-m $CERTSERIAL 2>&1 <<CERTSCRIPT
5
6
9
n
y
-1
n
5
6
7
9
n
CERTSCRIPT
if [ "$RET" -ne 0 ]; then echo"return value is $RET"
Exit 6 "Fatal - failed to create EC CA cert" fi
################# Exporting EC Root Cert ################################ #
CU_ACTION="Exporting EC Root Cert"
certu -L -n $NICKNAME -r -d ${LPROFILE} -o ecroot.cert if [ "$RET" -ne 0 ]; then
Exit 7 "Fatal - failed to export ec root cert" fi cp ecroot.cert ${NICKNAME}.ca.cert
}
############################## cert_smime_client ############################# # local shell function to create client Certificates for S/MIME tests ##############################################################################
cert_smime_client()
{
CERTFAILED=0 echo"$SCRIPTNAME: Creating Client CA Issued Certificates =============="
echo"$SCRIPTNAME: Creating Dave's Certificate -------------------------"
cert_create_cert "${DAVEDIR}" Dave 50 ${D_DAVE}
## XXX With this new script merging ECC and non-ECC tests, the ## call to cert_create_cert ends up creating two separate certs ## one for Eve and another for Eve-ec but they both end up with ## the same Subject Alt Name Extension, i.e., both the cert for ## Eve@example.com and the cert for Eve-ec@example.com end up ## listing eve@example.net in the Certificate Subject Alt Name extension. ## This can cause a problem later when cmsutil attempts to create ## enveloped data and accidently picks up the ECC cert (NSS currently ## does not support ECC for enveloped data creation). This script ## avoids the problem by ensuring that these conflicting certs are ## never added to the same cert database (see comment marked XXXX). echo"$SCRIPTNAME: Creating multiEmail's Certificate --------------------"
cert_create_cert "${EVEDIR}""Eve" 60 ${D_EVE} "-7 eve@example.net,eve@example.org,beve@example.com"
#echo "************* Copying CA files to ${SERVERDIR}" #cp ${CADIR}/*.db . #hw_acc
CU_ACTION="Import Dave's EC cert into Alice's DB"
certu -E -t ",," -d ${P_R_ALICEDIR} -f ${R_PWFILE} \
-i ${R_DAVEDIR}/Dave-ec.cert 2>&1
CU_ACTION="Import Dave's EC cert into Bob's DB"
certu -E -t ",," -d ${P_R_BOBDIR} -f ${R_PWFILE} \
-i ${R_DAVEDIR}/Dave-ec.cert 2>&1
## XXXX Do not import Eve's EC cert until we can make sure that ## the email addresses listed in the Subject Alt Name Extension ## inside Eve's ECC and non-ECC certs are different. # CU_ACTION="Import Eve's EC cert into Alice's DB" # certu -E -t ",," -d ${P_R_ALICEDIR} -f ${R_PWFILE} \ # -i ${R_EVEDIR}/Eve-ec.cert 2>&1
if [ "$CERTFAILED" != 0 ] ; then
cert_log "ERROR: SMIME failed $RET" else
cert_log "SUCCESS: SMIME passed" fi
}
############################## cert_extended_ssl ####################### # local shell function to create client + server certs for extended SSL test ########################################################################
cert_extended_ssl()
{
################# Creating Certs for extended SSL test #################### #
CERTFAILED=0 echo"$SCRIPTNAME: Creating Certificates, issued by the last ===============" echo" of a chain of CA's which are not in the same database============"
# CU_ACTION="Import Client mixed EC Root CA -t T,, for $CERTNAME (ext.)" # certu -A -n "clientCA-ecmixed" -t "T,," -f "${R_PWFILE}" \ # -d "${PROFILEDIR}" -i "${CLIENT_CADIR}/clientCA-ecmixed.ca.cert" \ # 2>&1
# Check that a repeated import with a different nickname doesn't change the # nickname of the existing cert (bug 1458518). # We want to search for the results using grep, to avoid subset matches, # we'll use one of the longer nicknames for testing. # (Because "grep -w hostname" matches "grep -w hostname-dsamixed")
MYDBPASS="-d ${PROFILEDIR} -f ${R_PWFILE}"
TESTNAME="Ensure there's exactly one match for ${CERTNAME}-dsamixed"
cert_check_nickname_exists "$MYDBPASS""${CERTNAME}-dsamixed" 0 1 "${TESTNAME}"
CU_ACTION="Repeated import of $CERTNAME's mixed DSA Cert with different nickname"
certu -A -n "${CERTNAME}-repeated-dsamixed" -t "u,u,u" -d "${PROFILEDIR}" \
-f "${R_PWFILE}" -i "${CERTNAME}-dsamixed.cert" 2>&1
TESTNAME="Ensure there's still exactly one match for ${CERTNAME}-dsamixed"
cert_check_nickname_exists "$MYDBPASS""${CERTNAME}-dsamixed" 0 1 "${TESTNAME}"
TESTNAME="Ensure there's zero matches for ${CERTNAME}-repeated-dsamixed"
cert_check_nickname_exists "$MYDBPASS""${CERTNAME}-repeated-dsamixed" 0 0 "${TESTNAME}"
echo"Importing all the server's own CA chain into the servers DB" for CA in `find ${SERVER_CADIR} -name "?*.ca.cert"` ; do
N=`basename $CA | sed -e "s/.ca.cert//"` if [ $N = "serverCA" -o $N = "serverCA-ec" -o $N = "serverCA-dsa" ] ; then
T="-t C,C,C" else
T="-t u,u,u" fi
CU_ACTION="Import $N CA $T for $CERTNAME (ext.) "
certu -A -n $N $T -f "${R_PWFILE}" -d "${PROFILEDIR}" \
-i "${CA}" 2>&1 done #============ echo"Client Cert"
cert_init_cert ${EXT_CLIENTDIR} ExtendedSSLUser 1 ${D_EXT_CLIENT}
CU_ACTION="Initializing ${CERTNAME}'s Cert DB (ext.)"
certu -N -d "${PROFILEDIR}" -f "${R_PWFILE}" 2>&1
CU_ACTION="Loading root cert module to ${CERTNAME}'s Cert DB (ext.)"
modu -add "RootCerts" -libfile "${ROOTCERTSFILE}" -dbdir "${PROFILEDIR}" 2>&1
# CU_ACTION="Import Server EC Root CA -t C,C,C for $CERTNAME (ext.)" # certu -A -n "serverCA-ec" -t "C,C,C" -f "${R_PWFILE}" \ # -d "${PROFILEDIR}" -i "${SERVER_CADIR}/serverCA-ec.ca.cert" 2>&1 # # done with mixed EC certs #
echo"Importing all the client's own CA chain into the servers DB" for CA in `find ${CLIENT_CADIR} -name "?*.ca.cert"` ; do
N=`basename $CA | sed -e "s/.ca.cert//"` if [ $N = "clientCA" -o $N = "clientCA-ec" -o $N = "clientCA-dsa" ] ; then
T="-t T,C,C" else
T="-t u,u,u" fi
CU_ACTION="Import $N CA $T for $CERTNAME (ext.)"
certu -A -n $N $T -f "${R_PWFILE}" -d "${PROFILEDIR}" \
-i "${CA}" 2>&1 done if [ "$CERTFAILED" != 0 ] ; then
cert_log "ERROR: EXT failed $RET" else
cert_log "SUCCESS: EXT passed" fi
}
############################## cert_ssl ################################ # local shell function to create client + server certs for SSL test ########################################################################
cert_ssl()
{ ################# Creating Certs for SSL test ########################### #
CERTFAILED=0 echo"$SCRIPTNAME: Creating Client CA Issued Certificates ==============="
cert_create_cert ${CLIENTDIR} "TestUser" 70 ${D_CLIENT}
echo"$SCRIPTNAME: Creating Server CA Issued Certificate for \\" echo" ${HOSTADDR} ------------------------------------"
cert_create_cert ${SERVERDIR} "${HOSTADDR}" 100 ${D_SERVER} echo"$SCRIPTNAME: Creating Server CA Issued Certificate for \\" echo" ${HOSTADDR}-sni --------------------------------"
CERTSERIAL=101
CERTNAME="${HOST}-sni${sniCertCount}.${DOMSUF}"
cert_add_cert
CU_ACTION="Modify trust attributes of Root CA -t TC,TC,TC"
certu -M -n "TestCA" -t "TC,TC,TC" -d ${PROFILEDIR} -f "${R_PWFILE}"
CU_ACTION="Modify trust attributes of DSA Root CA -t TC,TC,TC"
certu -M -n "TestCA-dsa" -t "TC,TC,TC" -d ${PROFILEDIR} -f "${R_PWFILE}"
echo"$SCRIPTNAME: Creating database for strsclnt no login tests ===============" echo"cp -r ${CLIENTDIR} ${NOLOGINDIR}" cp -r ${R_CLIENTDIR} ${R_NOLOGINDIR} # change the password to empty
certu -W -d "${R_NOLOGINDIR}" -f "${R_PWFILE}" -@ "${R_EMPTY_FILE}" 2>&1
}
############################## cert_stresscerts ################################ # local shell function to create client certs for SSL stresstest ########################################################################
cert_stresscerts()
{
############### Creating Certs for SSL stress test ####################### #
CERTDIR="$CLIENTDIR"
cd "${CERTDIR}"
PROFILEDIR=`cd ${CERTDIR}; pwd` if [ "${OS_ARCH}" = "WINNT" -a "$OS_NAME" = "CYGWIN_NT" ]; then
PROFILEDIR=`cygpath -m ${PROFILEDIR}` fi if [ -n "${MULTIACCESS_DBM}" ]; then
PROFILEDIR="multiaccess:${D_CLIENT}" fi
CERTFAILED=0 echo"$SCRIPTNAME: Creating Client CA Issued Certificates ==============="
CONTINUE=$GLOB_MAX_CERT
CERTSERIAL=10
while [ $CONTINUE -ge $GLOB_MIN_CERT ] do
CERTNAME="TestUser$CONTINUE" # cert_add_cert ${CLIENTDIR} "TestUser$CONTINUE" $CERTSERIAL
cert_add_cert
CERTSERIAL=`expr $CERTSERIAL + 1 `
CONTINUE=`expr $CONTINUE - 1 ` done if [ "$CERTFAILED" != 0 ] ; then
cert_log "ERROR: StressCert failed $RET" else
cert_log "SUCCESS: StressCert passed" fi
}
############################## cert_fips ##################################### # local shell function to create certificates for FIPS tests ##############################################################################
cert_fips()
{
CERTFAILED=0 echo"$SCRIPTNAME: Creating FIPS 140 DSA Certificates =============="
cert_init_cert "${FIPSDIR}""FIPS PUB 140 Test Certificate" 1000 "${D_FIPS}"
CU_ACTION="Loading root cert module to ${CERTNAME}'s Cert DB (ext.)"
modu -add "RootCerts" -libfile "${ROOTCERTSFILE}" -dbdir "${PROFILEDIR}" 2>&1
echo"$SCRIPTNAME: Enable FIPS mode on database -----------------------"
CU_ACTION="Enable FIPS mode on database for ${CERTNAME}" echo"modutil -dbdir ${PROFILEDIR} -fips true "
${BINDIR}/modutil -dbdir ${PROFILEDIR} -fips true 2>&1 <<MODSCRIPT
y
MODSCRIPT
RET=$? if [ "$RET" -ne 0 ]; then
html_failed "${CU_ACTION} ($RET) "
cert_log "ERROR: ${CU_ACTION} failed $RET" else
html_passed "${CU_ACTION}" fi
CU_ACTION="Setting invalid database password in FIPS mode"
RETEXPECTED=255
certu -W -d "${PROFILEDIR}" -f "${R_FIPSPWFILE}" -@ "${R_FIPSBADPWFILE}" 2>&1
CU_ACTION="Attempt to generate a key with exponent of 3 (too small)"
certu -G -k rsa -g 2048 -y 3 -d "${PROFILEDIR}" -z ${R_NOISE_FILE} -f "${R_FIPSPWFILE}"
CU_ACTION="Attempt to generate a key with exponent of 17 (too small)"
certu -G -k rsa -g 2048 -y 17 -d "${PROFILEDIR}" -z ${R_NOISE_FILE} -f "${R_FIPSPWFILE}"
RETEXPECTED=0
CU_ACTION="Generate Certificate for ${CERTNAME}"
CU_SUBJECT="CN=${CERTNAME}, E=fips@example.com, O=BOGUS NSS, OU=FIPS PUB 140, L=Mountain View, ST=California, C=US"
certu -S -n ${FIPSCERTNICK} -x -t "Cu,Cu,Cu" -d "${PROFILEDIR}" -f "${R_FIPSPWFILE}" -k dsa -v 600 -m 500 -z "${R_NOISE_FILE}" 2>&1 if [ "$RET" -eq 0 ]; then
cert_log "SUCCESS: FIPS passed" fi
}
########################## cert_rsa_exponent ################################# # local shell function to verify small rsa exponent can be used (only # run if FIPS has not been turned on in the build). ##############################################################################
cert_rsa_exponent_nonfips()
{ echo"$SCRIPTNAME: Verify that small RSA exponents still work =============="
CU_ACTION="Attempt to generate a key with exponent of 3"
certu -G -k rsa -g 2048 -y 3 -d "${CLIENTDIR}" -z ${R_NOISE_FILE} -f "${R_PWFILE}"
CU_ACTION="Attempt to generate a key with exponent of 17"
certu -G -k rsa -g 2048 -y 17 -d "${CLIENTDIR}" -z ${R_NOISE_FILE} -f "${R_PWFILE}"
}
############################## cert_eccurves ########################### # local shell function to create server certs for all EC curves ########################################################################
cert_eccurves()
{ ################# Creating Certs for EC curves test ######################## # echo"$SCRIPTNAME: Creating Server CA Issued Certificate for " echo" EC Curves Test Certificates ------------------------------------"
cert_init_cert "${ECCURVES_DIR}""EC Curves Test Certificates" 1 ${D_ECCURVES}
CU_ACTION="Loading root cert module to EC Curve's Cert DB"
modu -add "RootCerts" -libfile "${ROOTCERTSFILE}" -dbdir "${PROFILEDIR}" 2>&1
CU_ACTION="Import EC Root CA for $CERTNAME"
certu -A -n "TestCA-ec" -t "TC,TC,TC" -f "${R_PWFILE}" \
-d "${PROFILEDIR}" -i "${R_CADIR}/TestCA-ec.ca.cert" 2>&1
RET=$? if [ "${RET}" -ne "${EXPECT}" ]; then # if we expected failure to create, then delete unexpected certificate if [ "${EXPECT}" -ne 0 ]; then
${BINDIR}/certutil ${DIRPASS} -D ${CERTNAME} fi
RET=$? if [ "${RET}" -ne "${EXPECT}" ]; then
CERTFAILED=1
html_failed "${MYTESTNAME} - list"
cert_log "ERROR: ${MYTESTNAME} - list"
return 1 fi
LISTCOUNT=`${BINDIR}/certutil ${MYDIRPASS} -L | grep -wc ${MYCERTNAME}` if [ "${LISTCOUNT}" -ne "${EXPECTCOUNT}" ]; then
CERTFAILED=1
html_failed "${MYTESTNAME} - list and count"
cert_log "ERROR: ${MYTESTNAME} - list and count failed"
return 1 fi
RET=$? if [ "${RET}" -ne "${EXPECT}" ]; then
CERTFAILED=1
html_failed "${TESTNAME} (${COUNT}) - list and count"
cert_log "ERROR: ${TESTNAME} - list and count failed"
return 1 fi
LISTCOUNT=`${BINDIR}/certutil ${DIRPASS} -L ${CERTNAME} | grep -wc DNS` if [ "${LISTCOUNT}" -ne "${EXPECTCOUNT}" ]; then
CERTFAILED=1
html_failed "${TESTNAME} (${COUNT}) - list and count"
cert_log "ERROR: ${TESTNAME} - list and count failed"
return 1 fi
cert_inc_count
cert_list_and_count_dns "${DIR}""${CERTNAME}" 255 0 \ "expect failure to list cert, because we deleted it"
}
############################## cert_crl_ssl ############################ # local shell function to generate certs and crls for SSL tests ########################################################################
cert_crl_ssl()
{
########### Creating second CRL which includes groups 1 and 2 ##############
CRL_GRP_END=`expr ${CRL_GRP_2_BEGIN} + ${CRL_GRP_2_RANGE} - 1`
CRL_FILE_GRP_2=${R_SERVERDIR}/root.crl_${CRL_GRP_2_BEGIN}-${CRL_GRP_END}
echo"$SCRIPTNAME: Creating CA CRL for groups 1 and 2 ==============="
sleep 2
CRLUPDATE=`date -u "+%Y%m%d%H%M%SZ"`
CRL_GRP_DATE=`date -u "+%Y%m%d%H%M%SZ"`
CU_ACTION="Creating CRL for groups 1 and 2"
crlu -d $CADIR -M -n "TestCA" -f ${R_PWFILE} -o ${CRL_FILE_GRP_2} \
-i ${CRL_FILE_GRP_1} <<EOF_CRLINI
update=$CRLUPDATE
addcert ${CRL_GRP_2_BEGIN}-${CRL_GRP_END} $CRL_GRP_DATE
addext invalidityDate 0 $CRLUPDATE
rmcert ${UNREVOKED_CERT_GRP_2}
EOF_CRLINI
CRL_GEN_RES=`expr $? + $CRL_GEN_RES`
chmod 600 ${CRL_FILE_GRP_2}
CU_ACTION="Creating CRL (ECC) for groups 1 and 2"
crlu -d $CADIR -M -n "TestCA-ec" -f ${R_PWFILE} -o ${CRL_FILE_GRP_2}-ec \
-i ${CRL_FILE_GRP_1}-ec <<EOF_CRLINI
update=$CRLUPDATE
addcert ${CRL_GRP_2_BEGIN}-${CRL_GRP_END} $CRL_GRP_DATE
addext invalidityDate 0 $CRLUPDATE
rmcert ${UNREVOKED_CERT_GRP_2}
EOF_CRLINI
CRL_GEN_RES=`expr $? + $CRL_GEN_RES`
chmod 600 ${CRL_FILE_GRP_2}-ec
########### Creating second CRL which includes groups 1, 2 and 3 ##############
CRL_GRP_END=`expr ${CRL_GRP_3_BEGIN} + ${CRL_GRP_3_RANGE} - 1`
CRL_FILE_GRP_3=${R_SERVERDIR}/root.crl_${CRL_GRP_3_BEGIN}-${CRL_GRP_END}
echo"$SCRIPTNAME: Creating CA CRL for groups 1, 2 and 3 ==============="
sleep 2
CRLUPDATE=`date -u "+%Y%m%d%H%M%SZ"`
CRL_GRP_DATE=`date -u "+%Y%m%d%H%M%SZ"`
CU_ACTION="Creating CRL for groups 1, 2 and 3"
crlu -d $CADIR -M -n "TestCA" -f ${R_PWFILE} -o ${CRL_FILE_GRP_3} \
-i ${CRL_FILE_GRP_2} <<EOF_CRLINI
update=$CRLUPDATE
addcert ${CRL_GRP_3_BEGIN}-${CRL_GRP_END} $CRL_GRP_DATE
rmcert ${UNREVOKED_CERT_GRP_3}
addext crlNumber 0 2
EOF_CRLINI
CRL_GEN_RES=`expr $? + $CRL_GEN_RES`
chmod 600 ${CRL_FILE_GRP_3}
CU_ACTION="Creating CRL (ECC) for groups 1, 2 and 3"
crlu -d $CADIR -M -n "TestCA-ec" -f ${R_PWFILE} -o ${CRL_FILE_GRP_3}-ec \
-i ${CRL_FILE_GRP_2}-ec <<EOF_CRLINI
update=$CRLUPDATE
addcert ${CRL_GRP_3_BEGIN}-${CRL_GRP_END} $CRL_GRP_DATE
rmcert ${UNREVOKED_CERT_GRP_3}
addext crlNumber 0 2
EOF_CRLINI
CRL_GEN_RES=`expr $? + $CRL_GEN_RES`
chmod 600 ${CRL_FILE_GRP_3}-ec
############ Importing Server CA Issued CRL for certs of first group #######
echo"$SCRIPTNAME: Importing Server CA Issued CRL for certs ${CRL_GRP_BEGIN} trough ${CRL_GRP_END}"
CU_ACTION="Importing CRL for groups 1"
crlu -D -n TestCA -f "${R_PWFILE}" -d "${R_SERVERDIR}"
crlu -I -i ${CRL_FILE} -n "TestCA" -f "${R_PWFILE}" -d "${R_SERVERDIR}"
CRL_GEN_RES=`expr $? + $CRL_GEN_RES`
CU_ACTION="Importing CRL (ECC) for groups 1"
crlu -D -n TestCA-ec -f "${R_PWFILE}" -d "${R_SERVERDIR}"
crlu -I -i ${CRL_FILE}-ec -n "TestCA-ec" -f "${R_PWFILE}" \
-d "${R_SERVERDIR}"
CRL_GEN_RES=`expr $? + $CRL_GEN_RES`
if [ "$CERTFAILED" != 0 -o "$CRL_GEN_RES" != 0 ] ; then
cert_log "ERROR: SSL CRL prep failed $CERTFAILED : $CRL_GEN_RES" else
cert_log "SUCCESS: SSL CRL prep passed" fi
}
################# # Verify the we can successfully change the password on the database #
cert_test_password()
{
CERTFAILED=0 echo"$SCRIPTNAME: Create A Password Test Cert =============="
cert_init_cert "${DBPASSDIR}""Password Test Cert" 1000 "${D_DBPASSDIR}"
echo"$SCRIPTNAME: Create A Password Test Ca --------"
ALL_CU_SUBJECT="CN=NSS Password Test CA, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
cert_CA ${DBPASSDIR} PasswordCA -x "CTu,CTu,CTu" ${D_DBPASS} "1"
# now change the password
CU_ACTION="Changing password on ${CERTNAME}'s Cert DB"
certu -W -d "${PROFILEDIR}" -f "${R_PWFILE}" -@ "${R_FIPSPWFILE}" 2>&1
# finally make sure we can use the old key with the new password
CU_ACTION="Generate Certificate for ${CERTNAME} with new password"
CU_SUBJECT="CN=${CERTNAME}, E=password@example.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
certu -S -n PasswordCert -c PasswordCA -t "u,u,u" -d "${PROFILEDIR}" -f "${R_FIPSPWFILE}" -z "${R_NOISE_FILE}" 2>&1 if [ "$RET" -eq 0 ]; then
cert_log "SUCCESS: PASSWORD passed" fi
CU_ACTION="Verify Certificate for ${CERTNAME} with new password"
certu -V -n PasswordCert -u S -d "${PROFILEDIR}" -f "${R_FIPSPWFILE}" 2>&1
}
############################### # test if we can distrust a certificate. # # we create 3 new certs: # 1 leaf signed by the trusted root. # 1 intermediate signed by the trusted root. # 1 leaf signed by the intermediate. # # we mark the first leaf and the intermediate as explicitly untrusted. # we then try to verify the two leaf certs for our possible usages. # All verification should fail. #
cert_test_distrust()
{ echo"$SCRIPTNAME: Creating Distrusted Certificate"
cert_create_cert ${DISTRUSTDIR} "Distrusted" 2000 ${D_DISTRUST}
CU_ACTION="Mark CERT as unstrusted"
certu -M -n "Distrusted" -t p,p,p -d ${PROFILEDIR} -f "${R_PWFILE}" 2>&1 echo"$SCRIPTNAME: Creating Distrusted Intermediate"
CERTNAME="DistrustedCA"
ALL_CU_SUBJECT="CN=${CERTNAME}, E=${CERTNAME}@example.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
cert_CA ${CADIR} "${CERTNAME}""-c TestCA"",," ${D_CA} 2010 2>&1
CU_ACTION="Import Distrusted Intermediate"
certu -A -n "${CERTNAME}" -t "p,p,p" -f "${R_PWFILE}" -d "${PROFILEDIR}" \
-i "${R_CADIR}/DistrustedCA.ca.cert" 2>&1
# now create the last leaf signed by our distrusted CA # since it's not signed by TestCA it requires more steps.
CU_ACTION="Generate Cert Request for Leaf Chained to Distrusted CA"
CERTNAME="LeafChainedToDistrustedCA"
CU_SUBJECT="CN=${CERTNAME}, E=${CERTNAME}@example.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
certu -R -d "${PROFILEDIR}" -f "${R_PWFILE}" -z "${R_NOISE_FILE}" -o req 2>&1
cert_test_implicit_db_init()
{ echo"$SCRIPTNAME: test implicit database init"
CU_ACTION="Add cert with trust flags to db with implicit init"
mkdir ${IMPLICIT_INIT_DIR}
certu -A -n ca -t 'C,C,C' -d ${P_R_IMPLICIT_INIT_DIR} -i "${SERVER_CADIR}/serverCA.ca.cert"
}
cert_test_token_uri()
{ echo"$SCRIPTNAME: specify token with PKCS#11 URI"
CU_ACTION="List keys in NSS Certificate DB"
certu -K -f "${R_PWFILE}" -d ${P_R_SERVERDIR} -h ${CERTIFICATE_DB_URI}
# This token shouldn't have any keys
CU_ACTION="List keys in NSS Builtin Objects"
RETEXPECTED=255
certu -K -f "${R_PWFILE}" -d ${P_R_SERVERDIR} -h ${BUILTIN_OBJECTS_URI}
RETEXPECTED=0
}
cert_test_orphan_key_delete()
{
CU_ACTION="Create orphan key in serverdir"
certu -G -k ec -q nistp256 -f "${R_PWFILE}" -z ${R_NOISE_FILE} -d ${PROFILEDIR} # Let's get the key ID of the first orphan key. # The output of certutil -K (list keys) isn't well formatted. # The initial <key-number> part may or may not contain white space, which # makes the use of awk to filter the column unreliable. # To fix that, we remove the initial <number> field using sed, then select the # column that contains the key ID.
ORPHAN=`${BINDIR}/certutil -d ${PROFILEDIR} -K -f ${R_PWFILE} | \
sed 's/^<.*>//g' | grep -w orphan | head -1 | awk '{print $2}'`
CU_ACTION="Delete orphan key"
certu -F -f "${R_PWFILE}" -k ${ORPHAN} -d ${PROFILEDIR} # Ensure that the key is removed
certu -K -f "${R_PWFILE}" -d ${PROFILEDIR} | grep ${ORPHAN}
RET=$? if [ "$RET" -eq 0 ]; then
html_failed "Deleting orphan key ($RET)"
cert_log "ERROR: Deleting orphan key failed $RET" fi
}
cert_test_orphan_key_reuse()
{
CU_ACTION="Create orphan key in serverdir"
certu -G -f "${R_PWFILE}" -z ${R_NOISE_FILE} -d ${PROFILEDIR} # Let's get the key ID of the first orphan key. # The output of certutil -K (list keys) isn't well formatted. # The initial <key-number> part may or may not contain white space, which # makes the use of awk to filter the column unreliable. # To fix that, we remove the initial <number> field using sed, then select the # column that contains the key ID.
ORPHAN=`${BINDIR}/certutil -d ${PROFILEDIR} -K -f ${R_PWFILE} | \
sed 's/^<.*>//g' | grep -w orphan | head -1 | awk '{print $2}'`
CU_ACTION="Create cert request for orphan key"
certu -R -f "${R_PWFILE}" -k ${ORPHAN} -s "CN=orphan" -d ${PROFILEDIR} \
-o ${SERVERDIR}/orphan.req # Ensure that creating the request really works by listing it, and check # if listing was successful.
${BINDIR}/pp -t certificate-request -i ${SERVERDIR}/orphan.req
RET=$? if [ "$RET" -ne 0 ]; then
html_failed "Listing cert request for orphan key ($RET)"
cert_log "ERROR: Listing cert request for orphan key failed $RET" fi
}
############################## cert_cleanup ############################ # local shell function to finish this script (no exit since it might be # sourced) ########################################################################
cert_cleanup()
{
cert_log "$SCRIPTNAME: finished $SCRIPTNAME"
html "</TABLE><BR>"
cd ${QADIR}
. common/cleanup.sh
}
cert_make_cache()
{ if [ -n "${NSS_USE_CERT_CACHE}" ] ; then
pushd ${HOSTDIR}
tar czf "${CERTCACHE}" .
popd fi
}
cert_use_cache()
{ if [ -n "${NSS_USE_CERT_CACHE}" ] ; then
pushd ${HOSTDIR} if [ -r "${CERTCACHE}" ]; then
tar xzf "${CERTCACHE}"
return 1; fi
popd fi
rm"${CERTCACHE}"
return 0;
}
################## main #################################################
cert_use_cache
USING_CACHE=$? if [[ $USING_CACHE -eq 1 ]]; then
return 0; fi
cert_init
cert_all_CA
cert_test_implicit_db_init
cert_extended_ssl
cert_ssl
cert_test_orphan_key_delete
cert_test_orphan_key_reuse
cert_smime_client
IS_FIPS_DISABLED=`certutil --build-flags |grep -cw NSS_FIPS_DISABLED` if [ $IS_FIPS_DISABLED -ne 0 ]; then
cert_rsa_exponent_nonfips else
cert_fips fi
cert_eccurves
cert_extensions
cert_san_and_generic_extensions
cert_test_password
cert_test_distrust
cert_test_ocspresp
cert_test_rsapss if [ "${TEST_MODE}" = "SHARED_DB" ] ; then
cert_test_rsapss_policy fi
cert_test_token_uri
if [ -z "$NSS_TEST_DISABLE_CRL" ] ; then
cert_crl_ssl else echo"$SCRIPTNAME: Skipping CRL Tests" fi
if [ -n "$DO_DIST_ST" -a "$DO_DIST_ST" = "TRUE" ] ; then
cert_stresscerts fi
cert_iopr_setup
cert_cleanup
cert_make_cache
Messung V0.5 in Prozent
¤ Dauer der Verarbeitung: 0.48 Sekunden
(vorverarbeitet am 2026-04-25)
¤
Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.
Bemerkung:
Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.
