From 370b9255e0dadd88d42641b5ddd183e0ba5c3e4a Mon Sep 17 00:00:00 2001 From: Hideki Miyazaki Date: Thu, 26 Sep 2024 12:14:26 +0900 Subject: [PATCH] fix qt unit test qsslcertificate fix trusted peer cert cache --- .../ca_false_intermediate/gentestcert.sh | 161 ++++++++++++++++++ .../ca_false_intermediate/int_ca.key | 28 +++ .../ca_false_intermediate/server.key | 28 +++ .../ca_false_intermediate/test_ca.key | 28 +++ .../ca_false_intermediate/test_ca.pem | 80 +++++++++ .../test_int_not_cacert.pem | 87 ++++++++++ .../test_sign_bynoca_srv.pem | 90 ++++++++++ .../ca_false_intermediate/wolfssl_base.conf | 72 ++++++++ .../ca_false_intermediate/wolfssl_srv.conf | 26 +++ certs/intermediate/include.am | 10 +- src/ssl.c | 18 +- src/x509_str.c | 40 ++++- tests/api.c | 72 ++++++++ wolfssl/wolfcrypt/asn.h | 4 + 14 files changed, 733 insertions(+), 11 deletions(-) create mode 100755 certs/intermediate/ca_false_intermediate/gentestcert.sh create mode 100644 certs/intermediate/ca_false_intermediate/int_ca.key create mode 100644 certs/intermediate/ca_false_intermediate/server.key create mode 100644 certs/intermediate/ca_false_intermediate/test_ca.key create mode 100644 certs/intermediate/ca_false_intermediate/test_ca.pem create mode 100644 certs/intermediate/ca_false_intermediate/test_int_not_cacert.pem create mode 100644 certs/intermediate/ca_false_intermediate/test_sign_bynoca_srv.pem create mode 100644 certs/intermediate/ca_false_intermediate/wolfssl_base.conf create mode 100644 certs/intermediate/ca_false_intermediate/wolfssl_srv.conf diff --git a/certs/intermediate/ca_false_intermediate/gentestcert.sh b/certs/intermediate/ca_false_intermediate/gentestcert.sh new file mode 100755 index 0000000000..83e94f6d93 --- /dev/null +++ b/certs/intermediate/ca_false_intermediate/gentestcert.sh @@ -0,0 +1,161 @@ +#!/bin/bash + +# Script for generating RSA CA and server certs based on it. +# +SERVER_PEM='test_sign_bynoca_srv.pem' +INTCA_PEM='test_int_not_cacert.pem' +CA_PEM='test_ca.pem' + +CURRENT=$(cd $(dirname $0);pwd) +# OpenSSL configuration files +OPENSSL_BASE_CA_CONF='wolfssl_base.conf' +OPENSSL_CA_CONF='wolfssl_ca.conf' +OPENSSL_INTCA_CONF='wolfssl_int_ca.conf' +OPENSSL_SRV_CONF='wolfssl_srv.conf' +# SEt ver +CA_NAME="test_ca" +INTCA_NAME="int_ca" +SRVCERT_NAME="server_ext" +CRT_HOSTNAME="WOLFSSL" +CRT_DN="${CRT_HOSTNAME%% *}" +CRT_ALT_NAME="$(echo $CRT_HOSTNAME | sed -e "s/^/DNS:/" -e "s/ /,DNS:/g")" + +CA_HOME=$(cd $(dirname $0);pwd)/pki/$CA_NAME +INT_CA_HOME="$CA_HOME/gen_int/$CRT_DN" +SRV_CRT_HOME="$CA_HOME/gen_srv/$CRT_DN" + +Prepare_folder_file(){ + mkdir -m 700 pki + + # Create folders for CA + mkdir "$CA_HOME"/{,certs,db,gen_srv,gen_int} + mkdir -m 700 "$CA_HOME/private" + # Create folders for Intermediate CA + mkdir "$INT_CA_HOME" + mkdir "$INT_CA_HOME"/{,certs,db} + mkdir -m 700 "$INT_CA_HOME/private" + # Create folders for Server + mkdir "$SRV_CRT_HOME" + mkdir -m 700 "$SRV_CRT_HOME/private" + + # Create and populate openssl CA files + touch "$CA_HOME"/db/index + openssl rand -hex 16 > "$CA_HOME"/db/serial + + touch "$INT_CA_HOME"/db/index + openssl rand -hex 16 > "$INT_CA_HOME"/db/serial + + # Copy openssl config and private key + cp "$OPENSSL_CA_CONF" "$CA_HOME" + cp ./"$CA_NAME".key ./pki/$CA_NAME/private/"$CA_NAME".key + + cp "$OPENSSL_INTCA_CONF" "$INT_CA_HOME" + cp ./"$INTCA_NAME".key "$INT_CA_HOME"/private/"$INTCA_NAME".key + + cp "$OPENSSL_SRV_CONF" "$SRV_CRT_HOME" + cp ./server.key "$SRV_CRT_HOME"/private/server.key +} + +Generate_conf(){ + # copy conf from base + cp $OPENSSL_BASE_CA_CONF $OPENSSL_CA_CONF + cp $OPENSSL_BASE_CA_CONF $OPENSSL_INTCA_CONF + # Replace contents + # For CA + sed -i "s/_CA_NAME_/$CA_NAME/" "$OPENSSL_CA_CONF" + sed -i "s/_CERT_NAME_/$INTCA_NAME/" "$OPENSSL_CA_CONF" + sed -i "s/_CA_DEPART_/Development/" "$OPENSSL_CA_CONF" + # For Intermediate CA + sed -i "s/_CA_NAME_/$INTCA_NAME/" "$OPENSSL_INTCA_CONF" + sed -i "s/_CERT_NAME_/$SRVCERT_NAME/" "$OPENSSL_INTCA_CONF" + sed -i "s/_CA_DEPART_/Product_Support/" "$OPENSSL_INTCA_CONF" +} + +cleanup_files(){ + rm -f wolfssl_ca.conf + rm -f wolfssl_int_ca.conf + rm -rf pki/ +} + +# clean up +if [ "$1" = "clean" ]; then + echo "Cleaning temp files" + cleanup_files + exit 0 +fi +if [ "$1" = "cleanall" ]; then + echo "Cleaning all files" + rm -f ./"$SERVER_PEM" + rm -f ./"$INTCA_PEM" + rm -f ./"$CA_PEM" + cleanup_files + exit 0 +fi +# Generate OpenSSL Conf files +Generate_conf +# Prepare folders and files +Prepare_folder_file +########################################## +## Create CA, Intermediate and Server Cert +########################################## +# Generate CA +cd "$CA_HOME" + +# Generate CA private key and csr - use config file info +openssl req -new -config "$OPENSSL_CA_CONF" \ + -out "$CA_NAME.csr" -key "private/$CA_NAME.key" + +# Self-sign CA certificate - use config file info +# Note: Use extension from config "ca_ext" section +openssl ca -selfsign -config "$OPENSSL_CA_CONF" \ + -notext -in "$CA_NAME.csr" -out "$CA_NAME.crt" -extensions ca_ext -batch + +# Generate Intermediate CA +# cd into Cert generation folder +cd "$INT_CA_HOME" + +# Create private key and csr +openssl req -new -config "$OPENSSL_INTCA_CONF" \ + -out "$INTCA_NAME.csr" -key "private/$INTCA_NAME.key" + +cd "$CA_HOME" +# Sign certificate with CA +openssl ca -config "$OPENSSL_CA_CONF" -notext \ + -in "$INT_CA_HOME/$INTCA_NAME.csr" -out "$INT_CA_HOME/$INTCA_NAME.crt" \ + -extensions "$INTCA_NAME" -batch + +# cd into Cert generation folder +cd "$SRV_CRT_HOME" +# Create private key and csr +openssl req -new -config "$OPENSSL_SRV_CONF" \ + -out server.csr -key private/server.key + +# cd into intermediate CA home +cd "$CA_HOME/gen_int/WOLFSSL/" + +# Sign certificate with CA +openssl ca -config "$OPENSSL_INTCA_CONF" -notext \ + -in "$SRV_CRT_HOME/server.csr" -out "$SRV_CRT_HOME/server.crt" \ + -extensions server_ext -batch + + +# cp genereated certificates +cd $CURRENT +# CA +openssl x509 -in ./pki/$CA_NAME/$CA_NAME.crt -inform PEM -noout -text > ./pki/$CA_NAME/$CA_NAME.pem +cat ./pki/$CA_NAME/$CA_NAME.crt >> ./pki/$CA_NAME/$CA_NAME.pem +mv ./pki/$CA_NAME/$CA_NAME.pem $CA_PEM + +# Intermediate CA +openssl x509 -in $INT_CA_HOME/$INTCA_NAME.crt -inform PEM -noout -text > $INT_CA_HOME/$INTCA_NAME.pem +cat $INT_CA_HOME/$INTCA_NAME.crt >> $INT_CA_HOME/$INTCA_NAME.pem +mv $INT_CA_HOME/$INTCA_NAME.pem $INTCA_PEM +# Server +openssl x509 -in $SRV_CRT_HOME/server.crt -inform PEM -noout -text > $SRV_CRT_HOME/server.pem +cat $SRV_CRT_HOME/server.crt >> $SRV_CRT_HOME/server.pem +mv $SRV_CRT_HOME/server.pem $SERVER_PEM + +# clean up +cleanup_files + +echo "Completed" diff --git a/certs/intermediate/ca_false_intermediate/int_ca.key b/certs/intermediate/ca_false_intermediate/int_ca.key new file mode 100644 index 0000000000..558acd2ff1 --- /dev/null +++ b/certs/intermediate/ca_false_intermediate/int_ca.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC4VOnmv/SyU9w8 +kloGnogOLqerpp0HNI8/fOU3+CYr4M0mETKuBvI7PkXBV0VLNpupt5MmAgi/H1QX +bejxNiBsQOLo278NgFYPoNm1OdazQ5PeX8+lNFJ7OEq8TBHSriwfJuJRyNaU5Mr+ +qxcTDZx4+Mvr8cZbmVoSK8s5S6DT7CJmYjSdV52aB8ZFOj3psoLnEsavPKi5Wk+O +BRvQnWNy0yxjZ9k+Md39gZiEbezfQyy3UzHi7aUc6MrfUDOpmAwmuaE6I/caztFP +HpgZqT7sva20RPvOKtBhuVyxd27h9dzHr+ZD7rc8FohFRg5tVtccDq41/oRvy9CN +1uM99eyHAgMBAAECggEADBW/wq8caIHy/c2iiq3jbE/xZ4w5iKVmLDAQtHCtH/yn +C93eHWa7Lth6/kgDH6vph2D6YWg0u+2z4lgEXlFsIsIbnk9PNqAOrwuepQZbuyOt +Esvj8zLQ+DR37IxthrXV6Aeb7ZIQmhu960sQQjbcPATOacj6IOXsRSYLNtXB1OLu +Xo4UbjLX3uOrAg5uMsi/Z/2s9jy3eDBf8FWmM6fBDsejRl18MzY2Y7bYS1yL3762 +4ydB4yHJEEkiFurtjgdX2pscF+ftivYrVqZDUWhM7htFLJz6bS4sRpgjfQegYs4f +RLTuef/+ozFVhpH/HuPrV2jH67T90Z5lHgZ6Nm5qwQKBgQDybcwCKcFFWKac84ln +JDJuqPHyyRgH09cia6C7Y/t1/caSJvJP6KR4c7TuEvIYpc6hSsO1Pd1k6ajFkDdN +IWYfOF3R6K3vR956LPWPdxkYWdONjmwBvVaKozWmxR01RHeGXk+VxFb7PBudAvEu +cGOzDEaTuE5RC1RxNHjZYxZ98QKBgQDCpoljVMR+/7+pwKoIEmw1FmH+DEEgL+so +U1pBcaPU1poBRYKH+1yah7M+eFhTEzV4XbJCjMYeynSCWMSqGXrHwWq0AmA3jhSM +OyDuwboTXVHCkqIuAs/Q/8A9dcyTejsgLuU6mLU1eXzNeWm0/0VjfvPgOziM7SHt +14tip/P59wKBgQDTY74yXKp0h3qw/QLg9wUqzRI8O/FCUgwTrXm4LNSF7EWMB33f +A+L2TR6FQevsZhgpOIIytcEpTz2lF73A+dCMhJ/6e0O/lBGAw1dUQ+uT+i+oDXpM +ggbGWM5dnx965Tq75dzLoSqfY6hIXtpjPgkRhTC9ekaAELsPA0wlcmuYYQKBgDVT +Llw6AsLQCY/Vqj8f3OkGQr44WTcaKZAYladMHJfYWsRyaHocUJg9CMvaaEgKASIC +eS1mJ3iT+isjam03Ib3LrRG3fOh7UgHAyRrfk7xuWlG1nhyAxLH6/o1X0j2sxLni +XwYYg7wslhYsZtsg+79wLhuF3c4twJfJ7vOOE3atAoGBAKiH+9h5SdQ2L4gjM+dl +0dr1fTZpJta+l0FIEiOdQcbGp7ia9G9WglV5HkzyhETG+wTNNuG8GD/jTlg23AVE +vVf2vPq7La3juAT7oOoEkm13vQ//2VUJum4g34dP4V9FpWP5FLiAAu9H8op5P9Hp +LqbpMcrAkbexh41ZEZlmzSx5 +-----END PRIVATE KEY----- diff --git a/certs/intermediate/ca_false_intermediate/server.key b/certs/intermediate/ca_false_intermediate/server.key new file mode 100644 index 0000000000..156364df15 --- /dev/null +++ b/certs/intermediate/ca_false_intermediate/server.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC6IGIrgaxYzvMi +XZ9GkLfppLP84bdp07YUh8u7MR67YPI/jGoNY1WiyANKjdajY937KO8xlXDMKJUf +8JyJ9PZWHgCBUxt4G/mf4xBljMZANiHNV1WyFHGaVznu2pgbr4ngwyv5oZM/TWVB +K2YdZpyVld8Z3I14RvQV62Rclxbs4uzK6+IDuEGBxfTKpOSr3u0a2qONAjmNACxd +fu+RsdeWumXBQ//UajX6F1DNdj4dvqRp9u5Hw3pJmoBv5puD4OhYcfvNbcG0FtI3 +ZKa8sPT++/Rypjx5MnrAtTAhsTXf2UV/xPbFHJhtU9b/NsE4GLd2ExDIRWpSc2V+ +ublm1DwnAgMBAAECggEAA92CTGb//kQl9nO9SAjfWOHLvxes6Gy2Hk0HpRaLDdcg +kMNIvIhwkdXXg6fYakI7rOiXtw7kbcj199jWV2MX7ofm+MiSDHeAQprDj2hSAale +IFaM+ArGpS7kjBpMCF8n3NwQwLljRnBEBwtwrnGgFNcs7+uNoI7QqNffmLCmkDrJ +BCK3kXXbjENOuzlddgxsb1mipsXot3uwDaByB8Tl2OtI7ezZvhCraeYZMyRXuq2o +JDPk3FZ9O/mPgULZrqnlvxyJmog2ajgyED4M0mqM29L4YB3MOOz8Wgeksp20VEQJ +lHJtpHK+zcodnT3rXGMj2A1Qu4HHoYEdKvAb8XzuUQKBgQD/nP7ZFOCJGR+q/Wu1 +CSLYwO9YM8sn7gMy3R1C1Ps7UKvjVWDv9cjsgId7XnYSQQ/52kV8HbIMqr9EOlwS +pHkHmAbqDNhLY++hhqf9nPHo6e0AiMY4uF/JcfYb8A4PE8/x8Iv5HVjH9WYJFwcL +UNDgm0ULrSbRR7ULtaSpZjyXfwKBgQC6aHlpNIvqa3+KmFmZFI4Xx5EB6fHBy02R +PJKk/B2SVsW+kq0kAwsYdnS6rbkYS8ZmfyJKzvacXpDYvUfFV93s+ewoT5J2a4Ab +WmELmWABqqCwvyT7h2oO+hqLljGNIJxygR0iu9F/fHVYp8G/oHZBeDZEJt+PNR0G +cuG7/6zvWQKBgF/dforl1Iw2evUDFFkSMxp9yYYX7rJsBpEV8np1LEADsmORSsjU +MmXYkndHZxrTge1f2j2BWZx8kT1CcfOf8bBSaQ1wgdJMibvXp7trGCMVUIipw0XU +iEAh2H6D2pH3CT8gyy5Dvl9H/tub4k1xItWKBiwp5WwJ67GXj0jlCgZ7AoGARYmz +wQtZJpnzekBbLD/+weAwuAYNqb2tsgBmtCVY4r58Bhuxez2nZfjKktk7s1SRLqs+ +n6mVVb/xSOlTXMrqfvy8nE0S1hpEL/AHQ8xzhCuixkyH/00Ew5GJVYkx8vO3aP/B +XrOx81z6aZgrLtEtTD8L/2CBBWtK6JzymK9IVAECgYAfoFaqRVl0JJlQJttfQtc+ +cYyVzZEBzckIH3BriHuNwDpnPOq6iSx5JUp6mh03G3/3mHx4G45tD6GvsK53WIAH +TCrHQv6vRjrA2oay/AlO2x/ElBOkdOVo8x20YGAAhIRAh65rwFrdTREnfUwChwSV +QVeI7CdToIyIiZGhYmmO/g== +-----END PRIVATE KEY----- diff --git a/certs/intermediate/ca_false_intermediate/test_ca.key b/certs/intermediate/ca_false_intermediate/test_ca.key new file mode 100644 index 0000000000..b40399f05a --- /dev/null +++ b/certs/intermediate/ca_false_intermediate/test_ca.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC8QEMO8Y4eCzs2 +9n6qVnfSp9tVSxQQUtgkAVgmIJX+5g3MZef9vR2ZOSeXVXibOluq2SBjRlzrorJQ +AXY8r07l1+PNFpf4UQr70yaI1xO8VAlC/zmFqmE5zI8OjqbH4Ck8r6yaM+ZPNM20 +VClvkoIAzlGnVe6vziHpNuGnDXXfMtYOFeNmeCFBe87VnOjFCZR+hHtZKmRrkUtL +9w30UJKP9QMNcyBMTnugjcpflM82HObhuxRBkBZoAkFTksbEbNOtVgUiSq6aKt78 +6tiZolplL/5DrivplHCuNdyPE3Jhv7r8SLeh7VysXJxLxU1J2oZldzS7uq5uTPl9 +9sKCkJzhAgMBAAECggEABxk4Ph3DMWRUhwnL9HHewlGEjoaOeuAY2OC5GXT0mwBD +SHAWS6XgMhkq4kS9j8LnVn2qADxUwCjqJuSrN/YXWEjoBOGDeQBbVOwdIZ9Ule8o +Sz+zBFSMpoCNa2vbI6HTBEAOluD6oAV6dUCQMG4am1usTg5KOhRgiHoCj8lM5s3j +/f0KWkJReql92o//bLDXDjeGGDtIzaWfIKpsW7gwPe6nHsR7n854sbkdRT9b6BMa +EZPg17XD8Dg1ZkvUemShrvgPrGFPMH/JFcvpX1s4/l2kM88xQEL+s45E4IyTT2gh +FlDFC3QXrFI7M7emid3rwXIVEkEIO4Aw4xW34OAVnQKBgQD5cJE/WojeHI3Pyo3L +sMDaWabzWWAAsev5EpDo41BalPDpBig29qO31afkIwIgCQyLNMXn9VqxoxILOg5d +uopBaPWHihmME5qgLp6F6nDeOYril1b1LU1/7G2Ehu9lGYLJd6hdQ6tC/iKMfrIz +fnsHEH/FC4woWmXdFMozujyZNQKBgQDBM7jeBtdIOOZhcwc98y9mQUr+ttlUODC6 +BNI2xAcV6ZJg/y0JXby84jM0fP5MuCkGHdNvufpvT68Dn9NRhrOBz8JyhCy5m4Rz +/dIr3JUT5Y0r4+2l5MgfZMlcYCWESNcJPwchSstzAthLhtrgP2ZFGfzzZUZGAMxR +f6sZK7pWfQKBgQCYpp4NAm/eVeUndBNAw4PSXKlCJcENy9TYkdci3vHu7VVdlgoI +UPoyZ8ueXxpO1prZmks/QDTnnx9MxZPDIoS3sO8JqqclxV2Mh9s1oxq9tMNdFjb+ +RmI2Vk9TmmxpF6qldtgPc3kcv4APMP4Ha3EJCrzWrtFwZJoQKUfxThkFvQKBgQCI +Scs0XJELMpBZ2AIY0m7ybEbSDfyba5P79SCxX3E8JOuMnxWPEN/uQocqlK3zQso1 +tV6M5x3h3c0w+lLgpOwGO6AIlnLScAFsrXXQWSeUxI7kkkH3j78YXkmpb22ntpZy +wFJwSsngFPatuLC4FiE3x9Bnhl6fTTrUlwIEnJMzJQKBgFc5ej1NXuPWDlLKjC7w +0N4YPs5BJRuhoUxyajYC3FxiWvr5bTz7zqc5DAPcH0nGAH/UVWZzWXMUw+Je3dej +chkmVUuKjfTZTZHOBAqJDCNRfZcfzWnzAcXkcmsAHr53UKYnH8XGuHsPVHujQVu/ +0Hx7AKuJK48fZeo8LTZufg1l +-----END PRIVATE KEY----- diff --git a/certs/intermediate/ca_false_intermediate/test_ca.pem b/certs/intermediate/ca_false_intermediate/test_ca.pem new file mode 100644 index 0000000000..c40c1467d6 --- /dev/null +++ b/certs/intermediate/ca_false_intermediate/test_ca.pem @@ -0,0 +1,80 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 3b:1d:6e:96:2e:32:85:de:99:5a:63:dd:49:1c:eb:cc + Signature Algorithm: sha256WithRSAEncryption + Issuer: C = US, ST = Wahington, O = Seattle, OU = Development, CN = www.wolfssl.com + Validity + Not Before: Oct 10 03:44:23 2024 GMT + Not After : Oct 8 03:44:23 2034 GMT + Subject: C = US, ST = Wahington, O = Seattle, OU = Development, CN = www.wolfssl.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:bc:40:43:0e:f1:8e:1e:0b:3b:36:f6:7e:aa:56: + 77:d2:a7:db:55:4b:14:10:52:d8:24:01:58:26:20: + 95:fe:e6:0d:cc:65:e7:fd:bd:1d:99:39:27:97:55: + 78:9b:3a:5b:aa:d9:20:63:46:5c:eb:a2:b2:50:01: + 76:3c:af:4e:e5:d7:e3:cd:16:97:f8:51:0a:fb:d3: + 26:88:d7:13:bc:54:09:42:ff:39:85:aa:61:39:cc: + 8f:0e:8e:a6:c7:e0:29:3c:af:ac:9a:33:e6:4f:34: + cd:b4:54:29:6f:92:82:00:ce:51:a7:55:ee:af:ce: + 21:e9:36:e1:a7:0d:75:df:32:d6:0e:15:e3:66:78: + 21:41:7b:ce:d5:9c:e8:c5:09:94:7e:84:7b:59:2a: + 64:6b:91:4b:4b:f7:0d:f4:50:92:8f:f5:03:0d:73: + 20:4c:4e:7b:a0:8d:ca:5f:94:cf:36:1c:e6:e1:bb: + 14:41:90:16:68:02:41:53:92:c6:c4:6c:d3:ad:56: + 05:22:4a:ae:9a:2a:de:fc:ea:d8:99:a2:5a:65:2f: + fe:43:ae:2b:e9:94:70:ae:35:dc:8f:13:72:61:bf: + ba:fc:48:b7:a1:ed:5c:ac:5c:9c:4b:c5:4d:49:da: + 86:65:77:34:bb:ba:ae:6e:4c:f9:7d:f6:c2:82:90: + 9c:e1 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Key Usage: critical + Digital Signature, Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + 49:CB:00:BF:AC:AD:4B:18:2C:DB:69:21:1E:60:EF:00:4E:FC:69:52 + Signature Algorithm: sha256WithRSAEncryption + Signature Value: + 24:1c:cf:b6:3e:20:6e:99:e8:36:b3:7e:2d:67:0d:cb:b5:1c: + 69:ff:5a:bb:0b:2f:52:fd:d6:3e:73:5c:a2:47:8e:8d:1d:fc: + 96:e7:e0:ca:e6:b6:3d:af:fa:f1:77:77:e6:2e:67:e6:44:d7: + 84:36:ce:dc:cb:3e:3d:bf:bc:8b:48:53:30:fa:bf:43:81:5b: + e0:a3:a7:db:44:c2:29:cd:4c:8a:68:e8:b9:3e:5d:eb:e4:06: + 17:6d:de:cf:76:e9:5a:6a:16:27:f8:6f:96:43:8a:4f:65:be: + 3a:f2:7e:fd:ad:55:93:ad:ac:00:b4:b5:f3:85:b0:d7:83:6d: + ab:d0:8f:1a:23:36:e1:1f:c4:9d:54:e8:ee:20:cd:b9:da:56: + a7:92:5a:a5:bd:36:c5:a2:ea:ac:06:24:98:e5:32:0a:e0:00: + 64:63:9c:7d:01:18:66:5a:7a:b1:d5:b4:24:9b:5e:8a:6b:a0: + 25:eb:39:52:cd:12:61:d0:62:6c:19:e7:f5:ae:32:a3:aa:d5: + 2f:05:fe:6f:cb:47:20:a0:32:1d:cb:88:96:59:ed:8e:69:dd: + cf:f0:6f:83:85:ff:0a:59:ef:80:94:16:99:a6:35:ee:a7:b8: + d4:e9:3c:4f:56:5b:77:0e:b5:bd:61:21:b9:93:ad:be:2c:55: + 9b:bf:01:19 +-----BEGIN CERTIFICATE----- +MIIDkjCCAnqgAwIBAgIQOx1uli4yhd6ZWmPdSRzrzDANBgkqhkiG9w0BAQsFADBj +MQswCQYDVQQGEwJVUzESMBAGA1UECAwJV2FoaW5ndG9uMRAwDgYDVQQKDAdTZWF0 +dGxlMRQwEgYDVQQLDAtEZXZlbG9wbWVudDEYMBYGA1UEAwwPd3d3LndvbGZzc2wu +Y29tMB4XDTI0MTAxMDAzNDQyM1oXDTM0MTAwODAzNDQyM1owYzELMAkGA1UEBhMC +VVMxEjAQBgNVBAgMCVdhaGluZ3RvbjEQMA4GA1UECgwHU2VhdHRsZTEUMBIGA1UE +CwwLRGV2ZWxvcG1lbnQxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTCCASIwDQYJ +KoZIhvcNAQEBBQADggEPADCCAQoCggEBALxAQw7xjh4LOzb2fqpWd9Kn21VLFBBS +2CQBWCYglf7mDcxl5/29HZk5J5dVeJs6W6rZIGNGXOuislABdjyvTuXX480Wl/hR +CvvTJojXE7xUCUL/OYWqYTnMjw6OpsfgKTyvrJoz5k80zbRUKW+SggDOUadV7q/O +Iek24acNdd8y1g4V42Z4IUF7ztWc6MUJlH6Ee1kqZGuRS0v3DfRQko/1Aw1zIExO +e6CNyl+UzzYc5uG7FEGQFmgCQVOSxsRs061WBSJKrpoq3vzq2JmiWmUv/kOuK+mU +cK413I8TcmG/uvxIt6HtXKxcnEvFTUnahmV3NLu6rm5M+X32woKQnOECAwEAAaNC +MEAwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEnL +AL+srUsYLNtpIR5g7wBO/GlSMA0GCSqGSIb3DQEBCwUAA4IBAQAkHM+2PiBumeg2 +s34tZw3LtRxp/1q7Cy9S/dY+c1yiR46NHfyW5+DK5rY9r/rxd3fmLmfmRNeENs7c +yz49v7yLSFMw+r9DgVvgo6fbRMIpzUyKaOi5Pl3r5AYXbd7PdulaahYn+G+WQ4pP +Zb468n79rVWTrawAtLXzhbDXg22r0I8aIzbhH8SdVOjuIM252lanklqlvTbFouqs +BiSY5TIK4ABkY5x9ARhmWnqx1bQkm16Ka6Al6zlSzRJh0GJsGef1rjKjqtUvBf5v +y0cgoDIdy4iWWe2Oad3P8G+Dhf8KWe+AlBaZpjXup7jU6TxPVlt3DrW9YSG5k62+ +LFWbvwEZ +-----END CERTIFICATE----- diff --git a/certs/intermediate/ca_false_intermediate/test_int_not_cacert.pem b/certs/intermediate/ca_false_intermediate/test_int_not_cacert.pem new file mode 100644 index 0000000000..bcfef819ea --- /dev/null +++ b/certs/intermediate/ca_false_intermediate/test_int_not_cacert.pem @@ -0,0 +1,87 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 3b:1d:6e:96:2e:32:85:de:99:5a:63:dd:49:1c:eb:cd + Signature Algorithm: sha256WithRSAEncryption + Issuer: C = US, ST = Wahington, O = Seattle, OU = Development, CN = www.wolfssl.com + Validity + Not Before: Oct 10 03:44:23 2024 GMT + Not After : Oct 8 03:44:23 2034 GMT + Subject: C = US, ST = Wahington, O = Seattle, OU = Product_Support, CN = www.wolfssl.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:b8:54:e9:e6:bf:f4:b2:53:dc:3c:92:5a:06:9e: + 88:0e:2e:a7:ab:a6:9d:07:34:8f:3f:7c:e5:37:f8: + 26:2b:e0:cd:26:11:32:ae:06:f2:3b:3e:45:c1:57: + 45:4b:36:9b:a9:b7:93:26:02:08:bf:1f:54:17:6d: + e8:f1:36:20:6c:40:e2:e8:db:bf:0d:80:56:0f:a0: + d9:b5:39:d6:b3:43:93:de:5f:cf:a5:34:52:7b:38: + 4a:bc:4c:11:d2:ae:2c:1f:26:e2:51:c8:d6:94:e4: + ca:fe:ab:17:13:0d:9c:78:f8:cb:eb:f1:c6:5b:99: + 5a:12:2b:cb:39:4b:a0:d3:ec:22:66:62:34:9d:57: + 9d:9a:07:c6:45:3a:3d:e9:b2:82:e7:12:c6:af:3c: + a8:b9:5a:4f:8e:05:1b:d0:9d:63:72:d3:2c:63:67: + d9:3e:31:dd:fd:81:98:84:6d:ec:df:43:2c:b7:53: + 31:e2:ed:a5:1c:e8:ca:df:50:33:a9:98:0c:26:b9: + a1:3a:23:f7:1a:ce:d1:4f:1e:98:19:a9:3e:ec:bd: + ad:b4:44:fb:ce:2a:d0:61:b9:5c:b1:77:6e:e1:f5: + dc:c7:af:e6:43:ee:b7:3c:16:88:45:46:0e:6d:56: + d7:1c:0e:ae:35:fe:84:6f:cb:d0:8d:d6:e3:3d:f5: + ec:87 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:FALSE + Netscape Cert Type: + SSL Server + X509v3 Subject Key Identifier: + D9:9F:9A:2E:FE:80:7F:EB:6C:92:A1:91:60:9B:65:7B:36:2A:F4:35 + X509v3 Key Usage: critical + Digital Signature, Key Encipherment + X509v3 Extended Key Usage: + TLS Web Client Authentication, TLS Web Server Authentication + X509v3 Authority Key Identifier: + 49:CB:00:BF:AC:AD:4B:18:2C:DB:69:21:1E:60:EF:00:4E:FC:69:52 + Signature Algorithm: sha256WithRSAEncryption + Signature Value: + 87:de:e3:93:74:f5:56:64:e7:d9:43:14:20:2e:69:8a:e7:c4: + aa:38:c7:61:49:f5:b6:aa:43:46:c3:a0:b7:91:9f:4d:b9:c1: + 94:5c:89:5d:21:cb:b7:16:9b:d2:fb:d1:ea:bf:0d:9d:c5:2e: + f1:1d:4c:a3:14:22:1b:46:7c:f7:9f:cc:02:97:88:73:e0:12: + 8e:14:59:ae:ac:39:59:2a:79:65:a7:65:19:8e:a8:d1:00:a3: + 62:80:bb:4c:fc:d9:7e:46:e4:cc:fb:0b:81:91:52:8e:1d:7f: + fb:31:51:25:02:7d:5d:a3:c5:d9:9b:1a:94:4e:68:04:56:17: + 04:8d:ba:ed:75:76:b2:f9:ef:d8:60:af:7a:6b:24:57:b9:02: + 38:83:66:a5:97:dc:af:64:b7:33:3e:43:04:46:7f:79:83:7f: + c7:55:a5:78:1e:9d:b0:75:8c:6b:09:db:5f:0a:e7:0c:61:95: + 70:9c:6a:6f:a7:8c:4d:bf:74:dd:ee:55:94:21:ba:63:d4:f1: + fb:af:fc:8f:76:8d:29:e7:0f:6e:ff:54:81:59:ac:10:0a:e5: + 65:1c:bb:de:83:85:1c:5a:23:26:9c:e0:c9:50:8c:ac:cd:09: + 9c:50:ed:e9:1d:c9:c3:a0:a3:da:00:b1:9b:03:b6:97:cc:eb: + 02:a9:e2:41 +-----BEGIN CERTIFICATE----- +MIID6DCCAtCgAwIBAgIQOx1uli4yhd6ZWmPdSRzrzTANBgkqhkiG9w0BAQsFADBj +MQswCQYDVQQGEwJVUzESMBAGA1UECAwJV2FoaW5ndG9uMRAwDgYDVQQKDAdTZWF0 +dGxlMRQwEgYDVQQLDAtEZXZlbG9wbWVudDEYMBYGA1UEAwwPd3d3LndvbGZzc2wu +Y29tMB4XDTI0MTAxMDAzNDQyM1oXDTM0MTAwODAzNDQyM1owZzELMAkGA1UEBhMC +VVMxEjAQBgNVBAgMCVdhaGluZ3RvbjEQMA4GA1UECgwHU2VhdHRsZTEYMBYGA1UE +CwwPUHJvZHVjdF9TdXBwb3J0MRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20wggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4VOnmv/SyU9w8kloGnogOLqer +pp0HNI8/fOU3+CYr4M0mETKuBvI7PkXBV0VLNpupt5MmAgi/H1QXbejxNiBsQOLo +278NgFYPoNm1OdazQ5PeX8+lNFJ7OEq8TBHSriwfJuJRyNaU5Mr+qxcTDZx4+Mvr +8cZbmVoSK8s5S6DT7CJmYjSdV52aB8ZFOj3psoLnEsavPKi5Wk+OBRvQnWNy0yxj +Z9k+Md39gZiEbezfQyy3UzHi7aUc6MrfUDOpmAwmuaE6I/caztFPHpgZqT7sva20 +RPvOKtBhuVyxd27h9dzHr+ZD7rc8FohFRg5tVtccDq41/oRvy9CN1uM99eyHAgMB +AAGjgZMwgZAwDAYDVR0TAQH/BAIwADARBglghkgBhvhCAQEEBAMCBkAwHQYDVR0O +BBYEFNmfmi7+gH/rbJKhkWCbZXs2KvQ1MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUE +FjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwHwYDVR0jBBgwFoAUScsAv6ytSxgs22kh +HmDvAE78aVIwDQYJKoZIhvcNAQELBQADggEBAIfe45N09VZk59lDFCAuaYrnxKo4 +x2FJ9baqQ0bDoLeRn025wZRciV0hy7cWm9L70eq/DZ3FLvEdTKMUIhtGfPefzAKX +iHPgEo4UWa6sOVkqeWWnZRmOqNEAo2KAu0z82X5G5Mz7C4GRUo4df/sxUSUCfV2j +xdmbGpROaARWFwSNuu11drL579hgr3prJFe5AjiDZqWX3K9ktzM+QwRGf3mDf8dV +pXgenbB1jGsJ218K5wxhlXCcam+njE2/dN3uVZQhumPU8fuv/I92jSnnD27/VIFZ +rBAK5WUcu96DhRxaIyac4MlQjKzNCZxQ7ekdycOgo9oAsZsDtpfM6wKp4kE= +-----END CERTIFICATE----- diff --git a/certs/intermediate/ca_false_intermediate/test_sign_bynoca_srv.pem b/certs/intermediate/ca_false_intermediate/test_sign_bynoca_srv.pem new file mode 100644 index 0000000000..4cf39cf70f --- /dev/null +++ b/certs/intermediate/ca_false_intermediate/test_sign_bynoca_srv.pem @@ -0,0 +1,90 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + df:0d:6c:4b:d6:db:eb:35:5f:41:a1:3a:7a:56:16:93 + Signature Algorithm: sha256WithRSAEncryption + Issuer: C = US, ST = Wahington, O = Seattle, OU = Product_Support, CN = www.wolfssl.com + Validity + Not Before: Oct 10 03:44:23 2024 GMT + Not After : Oct 8 03:44:23 2034 GMT + Subject: C = US, ST = Wahington, O = Seattle, OU = Support, CN = www.wolfssl.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:ba:20:62:2b:81:ac:58:ce:f3:22:5d:9f:46:90: + b7:e9:a4:b3:fc:e1:b7:69:d3:b6:14:87:cb:bb:31: + 1e:bb:60:f2:3f:8c:6a:0d:63:55:a2:c8:03:4a:8d: + d6:a3:63:dd:fb:28:ef:31:95:70:cc:28:95:1f:f0: + 9c:89:f4:f6:56:1e:00:81:53:1b:78:1b:f9:9f:e3: + 10:65:8c:c6:40:36:21:cd:57:55:b2:14:71:9a:57: + 39:ee:da:98:1b:af:89:e0:c3:2b:f9:a1:93:3f:4d: + 65:41:2b:66:1d:66:9c:95:95:df:19:dc:8d:78:46: + f4:15:eb:64:5c:97:16:ec:e2:ec:ca:eb:e2:03:b8: + 41:81:c5:f4:ca:a4:e4:ab:de:ed:1a:da:a3:8d:02: + 39:8d:00:2c:5d:7e:ef:91:b1:d7:96:ba:65:c1:43: + ff:d4:6a:35:fa:17:50:cd:76:3e:1d:be:a4:69:f6: + ee:47:c3:7a:49:9a:80:6f:e6:9b:83:e0:e8:58:71: + fb:cd:6d:c1:b4:16:d2:37:64:a6:bc:b0:f4:fe:fb: + f4:72:a6:3c:79:32:7a:c0:b5:30:21:b1:35:df:d9: + 45:7f:c4:f6:c5:1c:98:6d:53:d6:ff:36:c1:38:18: + b7:76:13:10:c8:45:6a:52:73:65:7e:b9:b9:66:d4: + 3c:27 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:FALSE + Netscape Cert Type: + SSL Server + X509v3 Subject Key Identifier: + 10:71:71:98:BD:C2:B2:97:DD:6F:B6:CD:28:EA:23:0E:51:AE:44:34 + X509v3 Key Usage: critical + Digital Signature, Key Encipherment + X509v3 Extended Key Usage: + TLS Web Client Authentication, TLS Web Server Authentication + X509v3 Subject Alternative Name: + DNS:www.wolfssl.com, DNS:wolfssl.jp + X509v3 Authority Key Identifier: + D9:9F:9A:2E:FE:80:7F:EB:6C:92:A1:91:60:9B:65:7B:36:2A:F4:35 + Signature Algorithm: sha256WithRSAEncryption + Signature Value: + 54:7d:68:93:69:e0:3b:ea:3d:d8:68:ae:b1:97:97:2b:17:5d: + 76:7c:0d:0b:70:c5:a4:ec:3c:23:55:a5:bc:d7:dd:42:57:32: + dd:7e:9b:c9:b0:9c:8a:30:de:b6:7c:f9:ff:93:46:29:82:cf: + 8a:05:bb:b2:64:cf:22:db:15:bd:8e:56:14:2e:a4:5c:44:c2: + 3c:9d:3c:a0:dd:bd:a1:40:df:c3:8d:ff:71:73:6f:88:d6:57: + f2:c8:6c:20:18:ad:48:b8:2f:4c:41:ba:2a:f6:36:21:97:1b: + ee:7c:83:a8:43:80:08:8b:ac:a8:ed:df:dd:9c:7a:64:c9:6a: + 16:09:3b:57:1d:fc:f3:db:82:8f:c1:0e:e3:48:b7:d1:e8:19: + 1c:90:f0:b8:e6:ad:17:c5:82:b3:d5:15:bf:a3:c0:a6:4b:a7: + 97:98:86:93:4b:b0:1b:0e:62:61:16:d0:68:c2:e2:22:8a:f5: + 89:c7:bd:9d:38:65:0f:df:b1:38:9a:c7:e9:df:76:f4:5a:9f: + f5:2b:17:aa:9b:32:37:0a:72:93:8a:db:1d:b2:81:ff:0e:12: + b6:0a:31:46:7e:86:5e:0b:03:0d:7f:d0:bf:60:f2:f5:93:94: + f2:78:4f:80:34:b9:f7:66:ee:d6:b9:80:ca:bb:52:d0:e2:2f: + 1a:ac:99:a7 +-----BEGIN CERTIFICATE----- +MIIEDTCCAvWgAwIBAgIRAN8NbEvW2+s1X0GhOnpWFpMwDQYJKoZIhvcNAQELBQAw +ZzELMAkGA1UEBhMCVVMxEjAQBgNVBAgMCVdhaGluZ3RvbjEQMA4GA1UECgwHU2Vh +dHRsZTEYMBYGA1UECwwPUHJvZHVjdF9TdXBwb3J0MRgwFgYDVQQDDA93d3cud29s +ZnNzbC5jb20wHhcNMjQxMDEwMDM0NDIzWhcNMzQxMDA4MDM0NDIzWjBfMQswCQYD +VQQGEwJVUzESMBAGA1UECAwJV2FoaW5ndG9uMRAwDgYDVQQKDAdTZWF0dGxlMRAw +DgYDVQQLDAdTdXBwb3J0MRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20wggEiMA0G +CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6IGIrgaxYzvMiXZ9GkLfppLP84bdp +07YUh8u7MR67YPI/jGoNY1WiyANKjdajY937KO8xlXDMKJUf8JyJ9PZWHgCBUxt4 +G/mf4xBljMZANiHNV1WyFHGaVznu2pgbr4ngwyv5oZM/TWVBK2YdZpyVld8Z3I14 +RvQV62Rclxbs4uzK6+IDuEGBxfTKpOSr3u0a2qONAjmNACxdfu+RsdeWumXBQ//U +ajX6F1DNdj4dvqRp9u5Hw3pJmoBv5puD4OhYcfvNbcG0FtI3ZKa8sPT++/Rypjx5 +MnrAtTAhsTXf2UV/xPbFHJhtU9b/NsE4GLd2ExDIRWpSc2V+ublm1DwnAgMBAAGj +gbswgbgwDAYDVR0TAQH/BAIwADARBglghkgBhvhCAQEEBAMCBkAwHQYDVR0OBBYE +FBBxcZi9wrKX3W+2zSjqIw5RrkQ0MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAU +BggrBgEFBQcDAgYIKwYBBQUHAwEwJgYDVR0RBB8wHYIPd3d3LndvbGZzc2wuY29t +ggp3b2xmc3NsLmpwMB8GA1UdIwQYMBaAFNmfmi7+gH/rbJKhkWCbZXs2KvQ1MA0G +CSqGSIb3DQEBCwUAA4IBAQBUfWiTaeA76j3YaK6xl5crF112fA0LcMWk7DwjVaW8 +191CVzLdfpvJsJyKMN62fPn/k0Ypgs+KBbuyZM8i2xW9jlYULqRcRMI8nTyg3b2h +QN/Djf9xc2+I1lfyyGwgGK1IuC9MQboq9jYhlxvufIOoQ4AIi6yo7d/dnHpkyWoW +CTtXHfzz24KPwQ7jSLfR6BkckPC45q0XxYKz1RW/o8CmS6eXmIaTS7AbDmJhFtBo +wuIiivWJx72dOGUP37E4msfp33b0Wp/1KxeqmzI3CnKTitsdsoH/DhK2CjFGfoZe +CwMNf9C/YPL1k5TyeE+ANLn3Zu7WuYDKu1LQ4i8arJmn +-----END CERTIFICATE----- diff --git a/certs/intermediate/ca_false_intermediate/wolfssl_base.conf b/certs/intermediate/ca_false_intermediate/wolfssl_base.conf new file mode 100644 index 0000000000..632f67f741 --- /dev/null +++ b/certs/intermediate/ca_false_intermediate/wolfssl_base.conf @@ -0,0 +1,72 @@ +# OpenSSL config: certificate authority (CA) +# Default value +[ default ] +ca_name = _CA_NAME_ # CA name +home = . # Top dir +default_ca = ca # Default CA section +name_opt = utf8,esc_ctrl,multiline,lname,align # Display UTF-8 characters + +# Certificate request +[ req ] +default_bits = 2048 # RSA key size +encrypt_key = yes # Encrypted CA private key +default_md = sha256 # Message Digest to use +utf8 = yes # Input is UTF-8 +string_mask = utf8only # Emit UTF-8 strings +prompt = no # Don't prompt for DN +distinguished_name = ca_dn # DN section +req_extensions = ca_ext # Desired extensions + +# CA certificate info +[ ca_dn ] +countryName = "US" # CA cert info +stateOrProvinceName = "Wahington" # CA cert info +organizationName = "Seattle" # CA cert info +localityName = "WOLFSSL" # CA cert info +organizationalUnitName = "_CA_DEPART_" # CA cert info +commonName = "www.wolfssl.com" # Replaced during build proceduce + +# Extention for signing CA certificate +[ ca_ext ] +keyUsage = critical,keyCertSign,cRLSign,digitalSignature # Limit key usage +basicConstraints = critical,CA:true # Dont allow intermediary CA +subjectKeyIdentifier = hash # SKI validation + +# CA operational settings +[ ca ] +default_ca = _CA_NAME_ # Default CA section + +# CA Section +[ _CA_NAME_ ] +certificate = $home/$ca_name.crt # CA certificate +private_key = $home/private/$ca_name.key # CA private key +new_certs_dir = $home/certs # Generated certificates +database = $home/db/index # Index file of generated crt +serial = $home/db/serial # Serial number file +RANDFILE = $home/ca/private/random # Random file +unique_subject = no # Dont require unique subject +default_days = 3650 # How long to certify for +default_md = sha256 # Message Digest to use +policy = match_pol # Default naming policy +email_in_dn = no # Dont add email to cert DN +copy_extensions = copy # Copy extensions from CSR (!) +x509_extensions = server_ext # Default cert extensions + +# Matching policy +# Enforce that all cert issued by the CA match criteria +# Useful for CA used internaly with limited scope +[ match_pol ] +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +# Extension used when signing server cert +[ _CERT_NAME_ ] +basicConstraints = critical,CA:false # Dont allow intermediary CA +nsCertType = server # Certificate type +subjectKeyIdentifier = hash # SKI validation +keyUsage = critical,digitalSignature,keyEncipherment # Define key usage +extendedKeyUsage = clientAuth,serverAuth # key usage continued diff --git a/certs/intermediate/ca_false_intermediate/wolfssl_srv.conf b/certs/intermediate/ca_false_intermediate/wolfssl_srv.conf new file mode 100644 index 0000000000..311f62fc03 --- /dev/null +++ b/certs/intermediate/ca_false_intermediate/wolfssl_srv.conf @@ -0,0 +1,26 @@ +############################################ +# OpenSSL config: genrate server key/csr +############################################ +# Certificate request +[ req ] +default_bits = 2048 # RSA key size +encrypt_key = no # Encrypted CA private key +default_md = sha256 # Message Digest to use +utf8 = yes # Input is UTF-8 +string_mask = utf8only # Emit UTF-8 strings +prompt = no # Don't prompt for DN +distinguished_name = server_dn # DN section +req_extensions = server_ext # Desired extensions + +# Server certificate info +[ server_dn ] +countryName = "US" +stateOrProvinceName = "Wahington" +organizationName = "Seattle" +localityName = "wolfSSL" +organizationalUnitName = "Support" +commonName = "www.wolfssl.com" + +# Extension - add alternative name to cert +[ server_ext ] +subjectAltName = "DNS:www.wolfssl.com,DNS:wolfssl.jp" diff --git a/certs/intermediate/include.am b/certs/intermediate/include.am index f480880da2..ad3a66b217 100644 --- a/certs/intermediate/include.am +++ b/certs/intermediate/include.am @@ -40,4 +40,12 @@ EXTRA_DIST += \ certs/intermediate/server-int-cert.der \ certs/intermediate/server-int-cert.pem \ certs/intermediate/server-int-ecc-cert.der \ - certs/intermediate/server-int-ecc-cert.pem + certs/intermediate/ca_false_intermediate/gentestcert.sh \ + certs/intermediate/ca_false_intermediate/int_ca.key \ + certs/intermediate/ca_false_intermediate/server.key \ + certs/intermediate/ca_false_intermediate/test_ca.key \ + certs/intermediate/ca_false_intermediate/test_ca.pem \ + certs/intermediate/ca_false_intermediate/test_int_not_cacert.pem \ + certs/intermediate/ca_false_intermediate/test_sign_bynoca_srv.pem \ + certs/intermediate/ca_false_intermediate/wolfssl_base.conf \ + certs/intermediate/ca_false_intermediate/wolfssl_srv.conf diff --git a/src/ssl.c b/src/ssl.c index 4c3e361a79..b446d554c8 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -5020,8 +5020,13 @@ int AlreadyTrustedPeer(WOLFSSL_CERT_MANAGER* cm, DecodedCert* cert) return ret; tp = cm->tpTable[row]; while (tp) { - if (XMEMCMP(cert->subjectHash, tp->subjectNameHash, + if ((XMEMCMP(cert->subjectHash, tp->subjectNameHash, SIGNER_DIGEST_SIZE) == 0) + #ifndef WOLFSSL_NO_ISSUERHASH_TDPEER + && (XMEMCMP(cert->issuerHash, tp->issuerHash, + SIGNER_DIGEST_SIZE) == 0) + #endif + ) ret = 1; #ifndef NO_SKID if (cert->extSubjKeyIdSet) { @@ -5061,8 +5066,13 @@ TrustedPeerCert* GetTrustedPeer(void* vp, DecodedCert* cert) tp = cm->tpTable[row]; while (tp) { - if (XMEMCMP(cert->subjectHash, tp->subjectNameHash, + if ((XMEMCMP(cert->subjectHash, tp->subjectNameHash, + SIGNER_DIGEST_SIZE) == 0) + #ifndef WOLFSSL_NO_ISSUERHASH_TDPEER + && (XMEMCMP(cert->issuerHash, tp->issuerHash, SIGNER_DIGEST_SIZE) == 0) + #endif + ) ret = tp; #ifndef NO_SKID if (cert->extSubjKeyIdSet) { @@ -5328,6 +5338,10 @@ int AddTrustedPeer(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int verify) #endif XMEMCPY(peerCert->subjectNameHash, cert->subjectHash, SIGNER_DIGEST_SIZE); + #ifndef WOLFSSL_NO_ISSUERHASH_TDPEER + XMEMCPY(peerCert->issuerHash, cert->issuerHash, + SIGNER_DIGEST_SIZE); + #endif /* If Key Usage not set, all uses valid. */ peerCert->next = NULL; cert->subjectCN = 0; diff --git a/src/x509_str.c b/src/x509_str.c index c3d33b85fb..a252c0c5a9 100644 --- a/src/x509_str.c +++ b/src/x509_str.c @@ -239,17 +239,24 @@ int GetX509Error(int e) } } +static void SetupStoreCtxError_ex(WOLFSSL_X509_STORE_CTX* ctx, int ret, + int depth) +{ + int error = GetX509Error(ret); + + wolfSSL_X509_STORE_CTX_set_error(ctx, error); + wolfSSL_X509_STORE_CTX_set_error_depth(ctx, depth); +} + static void SetupStoreCtxError(WOLFSSL_X509_STORE_CTX* ctx, int ret) { int depth = 0; - int error = GetX509Error(ret); /* Set error depth */ if (ctx->chain) depth = (int)ctx->chain->num; - wolfSSL_X509_STORE_CTX_set_error(ctx, error); - wolfSSL_X509_STORE_CTX_set_error_depth(ctx, depth); + SetupStoreCtxError_ex(ctx, ret, depth); } static int X509StoreVerifyCert(WOLFSSL_X509_STORE_CTX* ctx) @@ -265,7 +272,8 @@ static int X509StoreVerifyCert(WOLFSSL_X509_STORE_CTX* ctx) SetupStoreCtxError(ctx, ret); #if defined(OPENSSL_ALL) || defined(WOLFSSL_QT) if (ctx->store->verify_cb) - ret = ctx->store->verify_cb(ret >= 0 ? 1 : 0, ctx) == 1 ? 0 : ret; + ret = ctx->store->verify_cb(ret >= 0 ? 1 : 0, ctx) == 1 ? + WOLFSSL_SUCCESS : ret; #endif #ifndef NO_ASN_TIME @@ -290,7 +298,7 @@ static int X509StoreVerifyCert(WOLFSSL_X509_STORE_CTX* ctx) #if defined(OPENSSL_ALL) || defined(WOLFSSL_QT) if (ctx->store->verify_cb) ret = ctx->store->verify_cb(ret >= 0 ? 1 : 0, - ctx) == 1 ? 0 : -1; + ctx) == 1 ? WOLFSSL_SUCCESS : -1; #endif } #endif @@ -393,21 +401,37 @@ int wolfSSL_X509_verify_cert(WOLFSSL_X509_STORE_CTX* ctx) /* We found our issuer in the non-trusted cert list, add it * to the CM and verify the current cert against it */ + #if defined(OPENSSL_ALL) || defined(WOLFSSL_QT) + /* OpenSSL doesn't allow the cert as CA if it is not CA:TRUE for + * intermediate certs. + */ + if (!issuer->isCa) { + /* error depth is curren depth + 1 */ + SetupStoreCtxError_ex(ctx, X509_V_ERR_INVALID_CA, + (ctx->chain) ? (int)(ctx->chain->num + 1) : 1); + if (ctx->store->verify_cb) { + ret = ctx->store->verify_cb(0, ctx); + if (ret != WOLFSSL_SUCCESS) { + goto exit; + } + } + } else { + #endif ret = X509StoreAddCa(ctx->store, issuer, WOLFSSL_TEMP_CA); if (ret != WOLFSSL_SUCCESS) { goto exit; } - added = 1; - ret = X509StoreVerifyCert(ctx); if (ret != WOLFSSL_SUCCESS) { goto exit; } - /* Add it to the current chain and look at the issuer cert next */ wolfSSL_sk_X509_push(ctx->chain, ctx->current_cert); + #if defined(OPENSSL_ALL) || defined(WOLFSSL_QT) + } + #endif ctx->current_cert = issuer; } else if (ret == WC_NO_ERR_TRACE(WOLFSSL_FAILURE)) { diff --git a/tests/api.c b/tests/api.c index c15e431b1e..8b1fe7e63e 100644 --- a/tests/api.c +++ b/tests/api.c @@ -60341,6 +60341,75 @@ static int test_X509_STORE_untrusted_load_cert_to_stack(const char* filename, return EXPECT_RESULT(); } +#if defined(OPENSSL_ALL) + +static int last_errcode; +static int last_errdepth; + +static int X509Callback(int ok, X509_STORE_CTX *ctx) +{ + + if (!ok) { + last_errcode = X509_STORE_CTX_get_error(ctx); + last_errdepth = X509_STORE_CTX_get_error_depth(ctx); + } + /* Always return OK to allow verification to continue.*/ + return 1; +} + +static int test_X509_STORE_InvalidCa(void) +{ + EXPECT_DECLS; + const char* filename = "./certs/intermediate/ca_false_intermediate/" + "test_int_not_cacert.pem"; + const char* srvfile = "./certs/intermediate/ca_false_intermediate/" + "test_sign_bynoca_srv.pem"; + X509_STORE_CTX* ctx = NULL; + X509_STORE* str = NULL; + XFILE fp = XBADFILE; + X509* cert = NULL; + STACK_OF(X509)* untrusted = NULL; + + last_errcode = 0; + last_errdepth = 0; + + ExpectTrue((fp = XFOPEN(srvfile, "rb")) + != XBADFILE); + ExpectNotNull(cert = PEM_read_X509(fp, 0, 0, 0 )); + if (fp != XBADFILE) { + XFCLOSE(fp); + fp = XBADFILE; + } + + ExpectNotNull(str = X509_STORE_new()); + ExpectNotNull(ctx = X509_STORE_CTX_new()); + ExpectNotNull(untrusted = sk_X509_new_null()); + + /* create cert chain stack */ + ExpectIntEQ(test_X509_STORE_untrusted_load_cert_to_stack(filename, + untrusted), TEST_SUCCESS); + + X509_STORE_set_verify_cb(str, X509Callback); + + ExpectIntEQ(X509_STORE_load_locations(str, + "./certs/intermediate/ca_false_intermediate/test_ca.pem", + NULL), 1); + + ExpectIntEQ(X509_STORE_CTX_init(ctx, str, cert, untrusted), 1); + ExpectIntEQ(X509_verify_cert(ctx), 1); + ExpectIntEQ(last_errcode, X509_V_ERR_INVALID_CA); + + X509_free(cert); + X509_STORE_free(str); + X509_STORE_CTX_free(ctx); + sk_X509_pop_free(untrusted, NULL); + + return EXPECT_RESULT(); +} +#endif /* OPENSSL_ALL */ + + + static int test_X509_STORE_untrusted_certs(const char** filenames, int ret, int err, int loadCA) { @@ -97994,6 +98063,9 @@ TEST_CASE testCases[] = { TEST_DECL(test_wolfSSL_X509_STORE_CTX), TEST_DECL(test_wolfSSL_X509_STORE_CTX_ex), TEST_DECL(test_X509_STORE_untrusted), +#if defined(OPENSSL_ALL) + TEST_DECL(test_X509_STORE_InvalidCa), +#endif TEST_DECL(test_wolfSSL_X509_STORE_CTX_trusted_stack_cleanup), TEST_DECL(test_wolfSSL_X509_STORE_CTX_get_issuer), TEST_DECL(test_wolfSSL_X509_STORE_set_flags), diff --git a/wolfssl/wolfcrypt/asn.h b/wolfssl/wolfcrypt/asn.h index 11803d6b60..36dd5d11ec 100644 --- a/wolfssl/wolfcrypt/asn.h +++ b/wolfssl/wolfcrypt/asn.h @@ -2090,6 +2090,10 @@ struct TrustedPeerCert { #endif /* IGNORE_NAME_CONSTRAINTS */ byte subjectNameHash[SIGNER_DIGEST_SIZE]; /* sha hash of names in certificate */ + #ifndef WOLFSSL_NO_ISSUERHASH_TDPEER + byte issuerHash[SIGNER_DIGEST_SIZE]; + /* sha hash of issuer name in certificate */ + #endif #ifndef NO_SKID byte subjectKeyIdHash[SIGNER_DIGEST_SIZE]; /* sha hash of SKID in certificate */