# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at
http://mozilla.org/MPL/2.0/.
scenario IPsec
entity Root
type Root
entity CA1
type Intermediate
issuer Root
entity NoKU
type EE
issuer CA1
entity DigSig
type EE
issuer CA1
ku digitalSignature
entity NonRep
type EE
issuer CA1
ku nonRepudiation
entity DigSigNonRepAndExtra
type EE
issuer CA1
ku digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment,keyAgreement
entity NoMatch
type EE
issuer CA1
ku keyEncipherment,dataEncipherment,keyAgreement
entity NonCriticalServerAuthEKU
type EE
issuer CA1
eku serverAuth
entity NonIPSECEKU
type EE
issuer CA1
eku codeSigning
entity CriticalServerAuthEKU
type EE
issuer CA1
ku digitalSignature
eku critical,serverAuth
entity EKUIPsecIKE
type EE
issuer CA1
ku digitalSignature
eku critical,ipsecIKE
entity EKUIPsecIKEEnd
type EE
issuer CA1
ku digitalSignature
eku ipsecIKEEnd
entity EKUIPsecIKEIntermediate
type EE
issuer CA1
ku digitalSignature
eku codeSigning,serverAuth,ipsecIKEIntermediate
entity EKUAny
type EE
issuer CA1
ku digitalSignature
eku x509Any
entity EKUEmail
type EE
issuer CA1
ku digitalSignature
eku emailProtection
entity EKUIPsecUser
type EE
issuer CA1
ku digitalSignature
eku ipsecUser
db All
import Root::C,,
import CA1:Root:
verify NoKU:CA1
usage 12
result pass
verify DigSig:CA1
usage 12
result pass
verify NonRep:CA1
usage 12
result pass
verify DigSigNonRepAndExtra:CA1
usage 12
result pass
verify NoMatch:CA1
usage 12
result fail
verify NonIPSECEKU:CA1
usage 12
result fail
verify NonCriticalServerAuthEKU:CA1
usage 12
result pass
verify CriticalServerAuthEKU:CA1
usage 12
result pass
verify EKUIPsecIKE:CA1
usage 12
result pass
verify EKUIPsecIKEEnd:CA1
usage 12
result pass
verify EKUIPsecIKEIntermediate:CA1
usage 12
result pass
verify EKUAny:CA1
usage 12
result pass
verify EKUEmail:CA1
usage 12
result pass
verify EKUIPsecUser:CA1
usage 12
result pass
