653 lines
29 KiB
Go
653 lines
29 KiB
Go
// Copyright 2014 ISRG. All rights reserved
|
|
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
package ca
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/x509"
|
|
"encoding/asn1"
|
|
"encoding/hex"
|
|
"fmt"
|
|
"testing"
|
|
"time"
|
|
|
|
cfsslConfig "github.com/letsencrypt/boulder/Godeps/_workspace/src/github.com/cloudflare/cfssl/config"
|
|
ocspConfig "github.com/letsencrypt/boulder/Godeps/_workspace/src/github.com/cloudflare/cfssl/ocsp/config"
|
|
"github.com/letsencrypt/boulder/cmd"
|
|
"github.com/letsencrypt/boulder/mocks"
|
|
|
|
"github.com/letsencrypt/boulder/core"
|
|
"github.com/letsencrypt/boulder/sa"
|
|
"github.com/letsencrypt/boulder/test"
|
|
)
|
|
|
|
var CAkeyPEM = "-----BEGIN RSA PRIVATE KEY-----\n" +
|
|
"MIIJKQIBAAKCAgEAqmM0dEf/J9MCk2ItzevL0dKJ84lVUtf/vQ7AXFi492vFXc3b\n" +
|
|
"PrJz2ybtjO08oVkhRrFGGgLufL2JeOBn5pUZQrp6TqyCLoQ4f/yrmu9tCeG8CtDg\n" +
|
|
"xi6Ye9LjvlchEHhUKhAHc8uL+ablHzWxHTeuhnuThrsLFUcJQWb10U27LiXp3XCW\n" +
|
|
"nUQuZM8Yj25wKo/VeOEStQp+teXSvyUxVYaNohxREdZPjBjK7KPvJp+mrC2To0Us\n" +
|
|
"ecLfiRD26xNuF/X2/nBeSf3uQFi9zq3IHQH+PedziZ+Tf7/uheRcmhPrdCSs50x7\n" +
|
|
"Sy9RwijEJqHKVNq032ANTFny3WPykGQHcnIaA+rEOrrsQikX+mWp/1B/uEXE1nIj\n" +
|
|
"5PEAF0c7ZCRsiUKM8y13y52RRRyra0vNIeeUsrwAOVIcKVRo5SsCm8BR5jQ4+OVx\n" +
|
|
"N2p5omRTXawIAMA3/j27pJqJYdn38/vr2YRybr6KxYRs4hvfjvSKAXU5CrycGKgJ\n" +
|
|
"JPjz+j3vBioGbKI7z6+r1XsAxFRqATbYffzgAFZiA17aBxKlqZNq5QkLGHDI7cPm\n" +
|
|
"1VMTaY7OZBVxsDqXul3zsYjEMVmmnaqt1VAdOl18kuCQA7WJuhI6xT7RFBumLvWx\n" +
|
|
"nn4zf48jJbP/DMEEfxyjYnbnniqbi3yWCr27nTX/Vy1WmVvc3+dlk9G6hHcCAwEA\n" +
|
|
"AQKCAgEAirFJ50Ubmu0V8aY/JplDRT4dcJFfVJnh36B8UC8gELY2545DYpub1s2v\n" +
|
|
"G8GYUrXcclCmgVHVktAtcKkpqfW/pCNqn1Ooe/jAjN29SdaOaTbH+/3emTMgh9o3\n" +
|
|
"6528mk14JOz7Q/Rxsft6EZeA3gmPFITOpyLleKJkFEqc2YxuSrgtz0RwNP9kzEYO\n" +
|
|
"9eGth9egqk57DcbHMYUrsM+zgqyN6WEnVF+gTKd5tnoSltvprclDnekWtN49WrLm\n" +
|
|
"ap9cREDAlogdGBmMr/AMQIoQlBwlOXqG/4VXaOtwWqhyADEqvVWFMJl+2spfwK2y\n" +
|
|
"TMfxjHSiOhlTeczV9gP/VC04Kp5aMXXoCg2Gwlcr4DBic1k6eI/lmUQv6kg/4Nbf\n" +
|
|
"yU+BCUtBW5nfKgf4DOcqX51n92ELnKbPKe41rcZxbTMvjsEQsGB51QLOMHa5tKe8\n" +
|
|
"F2R3fuP9y5k9lrMcz2vWL+9Qt4No5e++Ej+Jy1NKhrcfwQ6fGpMcZNesl0KHGjhN\n" +
|
|
"dfZZRMHNZNBbJKHrXxAHDxtvoSqWOk8XOwP12C2MbckHkSaXGTLIuGfwcW6rvdF2\n" +
|
|
"EXrSCINIT1eCmMrnXWzWCm6UWxxshLsqzU7xY5Ov8qId211gXnC2IonAezWwFDE9\n" +
|
|
"JYjwGJJzNTiEjX6WdeCzT64FMtJk4hpoa3GzroRG2LAmhhnWVaECggEBANblf0L5\n" +
|
|
"2IywbeqwGF3VsSOyT8EeiAhOD9NUj4cYfU8ueqfY0T9/0pN39kFF8StVk5kOXEmn\n" +
|
|
"dFk74gUC4+PBjrBAMoKvpQ2UpUvX9hgFQYoNmJZxSqF8KzdjS4ABcWIWi8thOAGc\n" +
|
|
"NLssTw3eBsWT7ahX097flpWFVqVaFx5OmB6DOIHVTA+ppf6RYCETgDJomaRbzn8p\n" +
|
|
"FMTpRZBYRLj/w2WxFy1J8gWGSq2sATFCMc3KNFwVQnDVS03g8W/1APqMVU0mIeau\n" +
|
|
"TltSACvdwigLgWUhYxN+1F5awBlGqMdP+TixisVrHZWZw7uFMb8L/MXW1YA4FN8h\n" +
|
|
"k2/Bp8wJTD+G/dkCggEBAMr6Tobi/VlYG+05cLmHoXGH98XaGBokYXdVrHiADGQI\n" +
|
|
"lhYtnqpXQc1vRqp+zFacjpBjcun+nd6HzIFzsoWykevxYKgONol+iTSyHaTtYDm0\n" +
|
|
"MYrgH8nBo26GSCdz3IGHJ/ux1LL8ZAbY2AbP81x63ke+g9yXQPBkZQp6vYW/SEIG\n" +
|
|
"IKhy+ZK6tZa0/z7zJNfM8PuN+bK4xJorUwbRqIv4owj0Bf92v+Q/wETYeEBpkDGU\n" +
|
|
"uJ3wDc3FVsK5+gaJECS8DNkOmZ+o5aIlMQHbwxXe8NUm4uZDT+znx0uf+Hw1wP1P\n" +
|
|
"zGL/TnjrZcmKRR47apkPXOGZWpPaNV0wkch/Xh1KEs8CggEBAJaRoJRt+LPC3pEE\n" +
|
|
"p13/3yjSxBzc5pVjFKWO5y3SE+LJ/zjhquNiDUo0UH+1oOArCsrADBuzT8tCMQAv\n" +
|
|
"4TrwoKiPopR8uxoD37l/bLex3xT6p8IpSRBSrvkVAo6C9E203Gg5CwPdzfijeBSQ\n" +
|
|
"T5BaMLe2KgZMBPdowKgEspQSn3UpngsiRzPmOx9d/svOHRG0xooppUrlnt7FT29u\n" +
|
|
"2WACHIeBCGs8F26VhHehQAiih8DX/83RO4dRe3zqsmAue2wRrabro+88jDxh/Sq/\n" +
|
|
"K03hmd0hAoljYStnTJepMZLNTyLRCxl+DvGGFmWqUou4u3hnKZq4MK+Sl/pC5u4I\n" +
|
|
"SbttOykCggEAEk0RSX4r46NbGT+Fl2TQPKFKyM8KP0kqdI0H+PFqrJZNmgBQ/wDR\n" +
|
|
"EQnIcFTwbZq+C+y7jreDWm4aFU3uObnJCGICGgT2C92Z12N74sP4WhuSH/hnRVSt\n" +
|
|
"PKjk1pHOvusFwt7c06qIBkoE6FBVm/AEHKnjz77ffw0+QvygG/AMPs+4oBeFwyIM\n" +
|
|
"f2MgZHedyctTqwq5CdE5AMGJQeMjdENdx8/gvpDhal4JIuv1o7Eg7CeBodPkGrqB\n" +
|
|
"QRttnKs9BmLiMavsVAXxdnYt/gHnjBBG3KEd8i79hNm9EWeCCwj5tp08S2zDkYl/\n" +
|
|
"6vUJmFk5GkXVVQ3zqcMR7q4TZuV9Ad0M5wKCAQAY89F3qpokGhDtlVrB78gY8Ol3\n" +
|
|
"w9eq7HwEYfu8ZTN0+TEQMTEbvLbCcNYQqfRSqAAtb8hejaBQYbxFwNx9VA6sV4Tj\n" +
|
|
"6EUMnp9ijzBf4KH0+r1wgkxobDjFH+XCewDLfTvhFDXjFcpRsaLfYRWz82JqSag6\n" +
|
|
"v+lJi6B2hbZUt750aQhomS6Bu0GE9/cE+e17xpZaMgXcWDDnse6W0JfpGHe8p6qD\n" +
|
|
"EcaaKadeO/gSnv8wM08nHL0d80JDOE/C5I0psKryMpmicJK0bI92ooGrkJsF+Sg1\n" +
|
|
"huu1W6p9RdxJHgphzmGAvTrOmrDAZeKtubsMS69VZVFjQFa1ZD/VMzWK1X2o\n" +
|
|
"-----END RSA PRIVATE KEY-----"
|
|
|
|
var CAcertPEM = "-----BEGIN CERTIFICATE-----\n" +
|
|
"MIIFxDCCA6ygAwIBAgIJALe2d/gZHJqAMA0GCSqGSIb3DQEBCwUAMDExCzAJBgNV\n" +
|
|
"BAYTAlVTMRAwDgYDVQQKDAdUZXN0IENBMRAwDgYDVQQDDAdUZXN0IENBMB4XDTE1\n" +
|
|
"MDIxMzAwMzI0NFoXDTI1MDIxMDAwMzI0NFowMTELMAkGA1UEBhMCVVMxEDAOBgNV\n" +
|
|
"BAoMB1Rlc3QgQ0ExEDAOBgNVBAMMB1Rlc3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUA\n" +
|
|
"A4ICDwAwggIKAoICAQCqYzR0R/8n0wKTYi3N68vR0onziVVS1/+9DsBcWLj3a8Vd\n" +
|
|
"zds+snPbJu2M7TyhWSFGsUYaAu58vYl44GfmlRlCunpOrIIuhDh//Kua720J4bwK\n" +
|
|
"0ODGLph70uO+VyEQeFQqEAdzy4v5puUfNbEdN66Ge5OGuwsVRwlBZvXRTbsuJend\n" +
|
|
"cJadRC5kzxiPbnAqj9V44RK1Cn615dK/JTFVho2iHFER1k+MGMrso+8mn6asLZOj\n" +
|
|
"RSx5wt+JEPbrE24X9fb+cF5J/e5AWL3OrcgdAf4953OJn5N/v+6F5FyaE+t0JKzn\n" +
|
|
"THtLL1HCKMQmocpU2rTfYA1MWfLdY/KQZAdychoD6sQ6uuxCKRf6Zan/UH+4RcTW\n" +
|
|
"ciPk8QAXRztkJGyJQozzLXfLnZFFHKtrS80h55SyvAA5UhwpVGjlKwKbwFHmNDj4\n" +
|
|
"5XE3anmiZFNdrAgAwDf+Pbukmolh2ffz++vZhHJuvorFhGziG9+O9IoBdTkKvJwY\n" +
|
|
"qAkk+PP6Pe8GKgZsojvPr6vVewDEVGoBNth9/OAAVmIDXtoHEqWpk2rlCQsYcMjt\n" +
|
|
"w+bVUxNpjs5kFXGwOpe6XfOxiMQxWaadqq3VUB06XXyS4JADtYm6EjrFPtEUG6Yu\n" +
|
|
"9bGefjN/jyMls/8MwQR/HKNidueeKpuLfJYKvbudNf9XLVaZW9zf52WT0bqEdwID\n" +
|
|
"AQABo4HeMIHbMB0GA1UdDgQWBBSaJqZ383/ySesJvVCWHAHhZcKpqzBhBgNVHSME\n" +
|
|
"WjBYgBSaJqZ383/ySesJvVCWHAHhZcKpq6E1pDMwMTELMAkGA1UEBhMCVVMxEDAO\n" +
|
|
"BgNVBAoMB1Rlc3QgQ0ExEDAOBgNVBAMMB1Rlc3QgQ0GCCQC3tnf4GRyagDAPBgNV\n" +
|
|
"HRMECDAGAQH/AgEBMAsGA1UdDwQEAwIBBjA5BggrBgEFBQcBAQQtMCswKQYIKwYB\n" +
|
|
"BQUHMAGGHWh0dHA6Ly9vY3NwLmV4YW1wbGUuY29tOjgwODAvMA0GCSqGSIb3DQEB\n" +
|
|
"CwUAA4ICAQCWJo5AaOIW9n17sZIMRO4m3S2gF2Bs03X4i29/NyMCtOGlGk+VFmu/\n" +
|
|
"1rP3XYE4KJpSq+9/LV1xXFd2FTvuSz18MAvlCz2b5V7aBl88qup1htM/0VXXTy9e\n" +
|
|
"p9tapIDuclcVez1kkdxPSwXh9sejcfNoZrgkPr/skvWp4WPy+rMvskHGB1BcRIG3\n" +
|
|
"xgR0IYIS0/3N6k6mcDaDGjGHMPoKY3sgg8Q/FToTxiMux1p2eGjbTmjKzOirXOj4\n" +
|
|
"Alv82qEjIRCMdnvOkZI35cd7tiO8Z3m209fhpkmvye2IERZxSBPRC84vrFfh0aWK\n" +
|
|
"U/PisgsVD5/suRfWMqtdMHf0Mm+ycpgcTjijqMZF1gc05zfDqfzNH/MCcCdH9R2F\n" +
|
|
"13ig5W8zJU8M1tV04ftElPi0/a6pCDs9UWk+ADIsAScee7P5kW+4WWo3t7sIuj8i\n" +
|
|
"wAGiF+tljMOkzvGnxcuy+okR3EhhQdwOl+XKBgBXrK/hfvLobSQeHKk6+oUJzg4b\n" +
|
|
"wL7gg7ommDqj181eBc1tiTzXv15Jd4cy9s/hvZA0+EfZc6+21urlwEGmEmm0EsAG\n" +
|
|
"ldK1FVOTRlXJrjw0K57bI+7MxhdD06I4ikFCXRTAIxVSRlXegrDyAwUZv7CqH0mr\n" +
|
|
"8jcQV9i1MJFGXV7k3En0lQv2z5AD9aFtkc6UjHpAzB8xEWMO0ZAtBg==\n" +
|
|
"-----END CERTIFICATE-----"
|
|
|
|
// CSR generated by Go:
|
|
// * Random public key
|
|
// * CN = not-example.com
|
|
// * DNSNames = not-example.com, www.not-example.com
|
|
var CNandSANCSRhex = "308202a130820189020100301a311830160603550403130f6e6f742d6578" +
|
|
"616d706c652e636f6d30820122300d06092a864886f70d01010105000382" +
|
|
"010f003082010a0282010100e56ccbe37003c150202e6f543f9eb1d0e590" +
|
|
"76ac7f1f62654fa82fe131a23c66bd53a2f62ff7852015c84a394e36836d" +
|
|
"2018eba278e0740c85c4c6102787400c2ef069b4a72e6eb8ad8d1da5d76b" +
|
|
"f3e70dafc126578ed28cf40030e7fe5b5307ef630254726c639561b5445d" +
|
|
"372847bdb02576aa3622a688158c6af09d3938dbeba4d670cec4325be73a" +
|
|
"fa52a0a04dcba2f335f1e85020704db94ca125dce70b3209294c6c46ed4b" +
|
|
"48b95d8d51ae2d2fd227116023a48ca7381e35fd302ad2999df625a4b5ee" +
|
|
"82a0d0fefa88ac6a62b01674de75637ef83328202cda9930947d932000b0" +
|
|
"e53b82e099ab60fec9c8b6d4eccdee508b6ebca7e6ca3f752046c8350203" +
|
|
"010001a042304006092a864886f70d01090e31333031302f0603551d1104" +
|
|
"283026820f6e6f742d6578616d706c652e636f6d82137777772e6e6f742d" +
|
|
"6578616d706c652e636f6d300d06092a864886f70d01010b050003820101" +
|
|
"008c4bf2ab4dfd28d768697eecc5be889a6275287c7dd24f9232ffad5675" +
|
|
"de708c9cc911545d0e84f61b6584c5e237915bbf231d6518e7e228be2e65" +
|
|
"b4d50bd9729ce9e6aee00482e014de4edd4b9a4f9a7777b8943ef3512dbf" +
|
|
"940ac561c25b34ded9db1074136b978a65943ab1259608fb8109e008eac6" +
|
|
"23d7b29b2f1fad3a8e358aa070ead688016d9efed6da43412b136903de07" +
|
|
"137462d3f9203a344d84d7eb336999004e7e9972d5176001e2792f206e6c" +
|
|
"7c70b86d312459f21751d29ea53b41f9d02a229f9d7615b2a7ac83e849d0" +
|
|
"d0d9f8a08f8d7ba23295e77c95bc060c9227bfec0afb8c898e33c89903d7" +
|
|
"bbde4cf059dcc3e6c4ae4eef207c499d62"
|
|
|
|
// CSR generated by Go:
|
|
// * Random public key
|
|
// * CN = not-example.com
|
|
// * DNSNames = [none]
|
|
var NoSANCSRhex = "3082025f30820147020100301a311830160603550403130f6e6f742d6578" +
|
|
"616d706c652e636f6d30820122300d06092a864886f70d01010105000382" +
|
|
"010f003082010a0282010100aa6e56ff24906f93b855e7871dc8411a3cf7" +
|
|
"678d9563627e8ca37ab17dfe814ef7f828d6aa92b717f0da9df56990b953" +
|
|
"989d5afc3f2dddacd2b504b89782b49e55a04a64a4370d8ab1b2688f2596" +
|
|
"98132e5ce536f812ef5eb13824a922bbb89e30d6f2cace77462b9e65264a" +
|
|
"32320a7b348f9903b16640bc8c1c5f1208c6b456fd85bfa96ee9b7642c68" +
|
|
"3ab05b142d249525a730b230b39f2ba8d6f253263b5c3948b1a3d8a3467f" +
|
|
"7cfcdd1fdd6bff7828fda12784fd277be8c680fcdf2cc4676acff5df759f" +
|
|
"f4bc712ee1a560157233cbf6bb4bcb91dd1c5d2824b42f4913e4715c1ba4" +
|
|
"001fde0d90c274bfa81a79e4a0d00a7ddcbfdd8de4183b497487a20d0203" +
|
|
"010001a000300d06092a864886f70d01010b050003820101000ead204cfd" +
|
|
"45d307dd49de6937d7e2d8abf17490a49a8cee5250ef7799ef53229f8cfc" +
|
|
"735b9f65d789f898945f3d5536a09932e241050bd5473c47a4ac2493707f" +
|
|
"1142bf9a06d047384ad463463acb3744d435b4cff8c8b0f9673e8700e13b" +
|
|
"6bc99a486823fa85f7707e1bb8430e62541715ab6cb3fae3efb8356042a5" +
|
|
"c9f493dd08eff690570cce65cffc4fe354aa40957dc16a37a833aa968f62" +
|
|
"693d5059d53f6a96a159195d3fb7b558d462de63d945d4e3680d2b1f2c98" +
|
|
"33c3bfd92a9235de3d345a431ee5a675e0e18308bd2729413acd84432da4" +
|
|
"2410e1b87ae70227dd9a98e49ee6aeea9eaff67f968691918201e94697f2" +
|
|
"da010d6f939cea40c26038"
|
|
|
|
// CSR generated by Go:
|
|
// * Random public key
|
|
// * C = US
|
|
// * CN = [none]
|
|
// * DNSNames = not-example.com
|
|
var NoCNCSRhex = "3082027f30820167020100300d310b300906035504061302555330820122" +
|
|
"300d06092a864886f70d01010105000382010f003082010a0282010100d8" +
|
|
"b3c11610ce17614f6d78de3f079db430e479c38978da8cd625b7c70dd445" +
|
|
"57fd99b9831693e6b9b09fb7c74a82058a1f1a4e1e087f04f93aa73bc35a" +
|
|
"688440205a6f5fd56ff478c5554b14c3b2a1a0b5eed1aef7189ad848e117" +
|
|
"04b1eb6c29b47ada40a5719a38ce2f2869896bf5405c2bafd4c7dfb99c0e" +
|
|
"9f26f80145e16b73bbacf67aedcd3b7ce57bb5b67cf692aec7956d23c236" +
|
|
"2336c2408b65469630dccca3ca006f28e36ca8c95dda84b6586f29c8de63" +
|
|
"661c09b58253e386a74707394cbba4de165f2745a65b717b9fd4b8b84c09" +
|
|
"85583b5c17d3e88bbf71c88eeeccb5d552d61cde7835ec83d6ec9b41114a" +
|
|
"0583f8eeae8a536cb3ca5786c22ab30203010001a02d302b06092a864886" +
|
|
"f70d01090e311e301c301a0603551d1104133011820f6e6f742d6578616d" +
|
|
"706c652e636f6d300d06092a864886f70d01010b05000382010100430239" +
|
|
"8db6b64b94d93399db32335232967ca6a748048483db8cb2b387871f758c" +
|
|
"6f7bf1593624b142127847cd2a511897bbadd8ad038468fb309fa2161031" +
|
|
"949b9ba24931b0d363ad2f8dae56a4c908ba748d41c664aa129dcb1a6f88" +
|
|
"0b90502cd244d9abd8dd5e78f763730660655a350f1c25af95cf1f89dda9" +
|
|
"076f4e6b84b6da9a98ed87f538624e4338fa0ff1a404e763dd6800694a21" +
|
|
"d28595927606308aefa1ac7e8f5600b05e33c0a7b25d3a9f5032c7c25264" +
|
|
"026c039733b179315254af4f25e90a1d00facd69313b36fdc66a5818fb49" +
|
|
"a0d90e0745d66a82d337289c9968b3ec4a4826c530c758cacecc18e06366" +
|
|
"dd8962c451c3ce22c2aed33726"
|
|
|
|
// CSR generated by Go:
|
|
// * Random public key
|
|
// * C = US
|
|
// * CN = [none]
|
|
// * DNSNames = [none]
|
|
var NoNameCSRhex = "308202523082013a020100300d310b300906035504061302555330820122" +
|
|
"300d06092a864886f70d01010105000382010f003082010a0282010100bc" +
|
|
"fae49f68f02c42500b2faf251628ee19e8ef048a35fef311c9c419c80606" +
|
|
"ab37340ad6e25cf4cc63c0283994b4ba705d86950ad5298094e0b9684647" +
|
|
"8d67abc695741317b4ff8da9fd33120342559cfdaf9109ac403f0d0bf9ff" +
|
|
"54dd79fa2256b218a9bdb17c608167c7fcad4cf839733c7eab9589fe6137" +
|
|
"e99bb24c24b7eb74e19f51ffee4ea62c4ab756f099ff5197c5032f60edff" +
|
|
"36022b8a99d35aeb706854fa9a31ea8a362a2251f08b93023b32e1df771a" +
|
|
"970f08a30ced656950b8ef71600d65d6995a0b92903b179c05a76f702a08" +
|
|
"0b41402c308d8ab57f14b5516b89fe317e38e13d7adad7f7025743610881" +
|
|
"9fb60268f0773b08b62ac8c8c84f2d0203010001a000300d06092a864886" +
|
|
"f70d01010b050003820101001eda9ce8253e8b933348851acd38ab63cd64" +
|
|
"f833d7ffc711f1b6e6a37a7deb7ad44b5589d90533ed61dfd48cab2775e2" +
|
|
"a19c41f5cb69faa9dde856606822a3bf798381836214154c17bc037f23ad" +
|
|
"67c84d876855c0aea871dc55bd14b2cd267e49b734bc7a38c29c334611bf" +
|
|
"ec7efdc56a1512e25fd12ca99a5809b1b6a808caf6a8baefff7fb2bda454" +
|
|
"5c226849674900ce7a1f90287ab31be80a4e2b6d64765b9d973628e60299" +
|
|
"6423edd74e7a58005bd520d4173f0c30d935de530477480d7725d9758f9a" +
|
|
"58c004d9e1e55af59ea517dfbd2bccca58216d8130b9f77c90328b2aa54b" +
|
|
"1778a629b584f2bc059489a236131de9b444adca90218c31a499a485"
|
|
|
|
// CSR generated by Go:
|
|
// * Random public key
|
|
// * CN = [none]
|
|
// * DNSNames = a.example.com, a.example.com
|
|
var DupeNameCSRhex = "308202943082017c020100300d310b300906035504061302555330820122" +
|
|
"300d06092a864886f70d01010105000382010f003082010a0282010100ee" +
|
|
"7d298c2a8237dd84e75e71dcfbbf8e1124327b103b01f3a99bc76b29be64" +
|
|
"55329dc523ad1372ed12853dc74a775f2c79d1e4e28ae2a3ce69b78ec161" +
|
|
"76b31056a72b5b87bcd7501ab9f15e83346e788c085e472718494849c012" +
|
|
"ff6c25f12c040a0c68e99a46e8646523bf2b4103dcc7c4e583c6bf02c896" +
|
|
"09b55e470beb15eaefc0bb6d57aca39e75312833e87faf2ba33e12a3204c" +
|
|
"a19e5a1016c85b750619be9cb76fb93e653f3169b873dce42deab328a034" +
|
|
"57454fd8e135e125bdb4529144a34bcc5ab20f25c6b33300ab2ad994d251" +
|
|
"9261920da78e05b1c8847852e93a74000e7b29304ef2cccfa5315888150c" +
|
|
"14e9d51e2c343de44e6bd2903740ef0203010001a042304006092a864886" +
|
|
"f70d01090e31333031302f0603551d11042830268211612e6e6f742d6578" +
|
|
"616d706c652e636f6d8211612e6e6f742d6578616d706c652e636f6d300d" +
|
|
"06092a864886f70d01010b050003820101001358a156338bacd21bd66f35" +
|
|
"83bf26afbaa6750f1d5d8e6285d062d5ae4f379000cd53568e8ef11bb542" +
|
|
"97d906879614960266fece8f9060881c3b0ec34a1bb4b28f62cc444e5831" +
|
|
"09c278d21265b2ef6f120ae8bc2554ba46b60e8d46a8cd3093ea6b72cb42" +
|
|
"9d2d6072273e4a0c1a5ec3316cc2495a2776698f12cd4f4226f4b3e85f87" +
|
|
"0b0f32785cf823b9dfa7116eec8a6f9bdc5cf01c1fff46afbb55e636ced4" +
|
|
"0ccdf4cab09e7717aa2a67c5573590bb5d461cb13cc57b8451314ed3613e" +
|
|
"21757aeb846f5b33f107a01f93a718b3a83539562e6486a72f114df898ed" +
|
|
"c34e38d9bbdb96d0b8ab243c46da274cece70deb771985c477098468063a" +
|
|
"8400ecb6"
|
|
|
|
// CSR generated by Go:
|
|
// * Random pulic key
|
|
// * CN = [none]
|
|
// * DNSNames = not-example.com, www.not-example.com, mail.example.com
|
|
var TooManyNameCSRhex = "308202aa30820192020100300d310b300906035504061302555330820122" +
|
|
"300d06092a864886f70d01010105000382010f003082010a0282010100a7" +
|
|
"75d8f833651d9a4cfa1fa0e134912b772366c7d070ca3183d3c79ffc99bb" +
|
|
"c706d328c2389b360b99f60e9a447023a019931d410b4cea0eafb7869a6d" +
|
|
"879d6a976163e3e8de715bcc6a0d80654484450a837b9abae0c5c2fa28dd" +
|
|
"4f33d8043c32e2ecb9c41a0b6c7df60f9f6eaaef6cef38722db9b278b773" +
|
|
"c8251c75d63c36c5708024d3ec67372c205342ad93a68cc4cc9f90a92789" +
|
|
"b4fcdcbe050990b6e3edf2655c9df8365eb8be89a6ee4f80267e056e5cca" +
|
|
"853094a96ec1d76a00cef8724ed3b402f602c30cfc16128abc25bab65a9c" +
|
|
"f8a046b576e314a5d01e0887cfde86c01094b621e2230fc5db588ffd0e0e" +
|
|
"2454e60e8b83a9e82f33419abc62710203010001a058305606092a864886" +
|
|
"f70d01090e3149304730450603551d11043e303c820f6e6f742d6578616d" +
|
|
"706c652e636f6d82137777772e6e6f742d6578616d706c652e636f6d8214" +
|
|
"6d61696c2e6e6f742d6578616d706c652e636f6d300d06092a864886f70d" +
|
|
"01010b05000382010100486c9cea322a3a81ec9b828ccb303524cc914e0b" +
|
|
"81b45ea23214b0dd254a79cdc77d1a661c7de8dcfcc7d404c0ad8707a67a" +
|
|
"1ecc43ed5b4a7d96fabe41cab5ad8fde18f894bd2e57c8291b3bb0220c95" +
|
|
"7c178c1c4251be4252663a14e4c303a8563bb86056f8e07ab14082693f72" +
|
|
"3a55efe017b15d22cd31b6aa7b1bb5e1078e6f7b7fb12962230b192e0d40" +
|
|
"a4f4515d6f2922b587e3586ea7f61ae7196cfeab5b4e5f78e03de0dab5a6" +
|
|
"a537e6740bbb2a72b32c94068b4b46766f94ab3d24a704869d127fab6fb9" +
|
|
"9c470101aed4852cd7b3a0a5a489b264779118b30d51907dc745879a821b" +
|
|
"85f19a24d20dc5b48141eff276aa73bb41141305905b0223ded7"
|
|
|
|
// CSR generated by Go:
|
|
// * Random public key -- 512 bits long
|
|
// * CN = (none)
|
|
// * DNSNames = not-example.com, www.not-example.com, mail.not-example.com
|
|
var ShortKeyCSRhex = "3082011f3081ca020100300d310b30090603550406130255" +
|
|
"53305c300d06092a864886f70d0101010500034b00304802" +
|
|
"4100ca8ff48b32197226bbe6398b6ba62dd4f09be06dc742" +
|
|
"4b0c6321323d90c58e93cad2b3c91b5809493836f110dfc6" +
|
|
"bbb3eca5575e6416a3a8189e782f41a29b990203010001a0" +
|
|
"58305606092a864886f70d01090e3149304730450603551d" +
|
|
"11043e303c820f6e6f742d6578616d706c652e636f6d8213" +
|
|
"7777772e6e6f742d6578616d706c652e636f6d82146d6169" +
|
|
"6c2e6e6f742d6578616d706c652e636f6d300d06092a8648" +
|
|
"86f70d0101050500034100bfdc34a0a728918f4221413631" +
|
|
"a70656db80ddb1b8126a02e6ca92c48301c350f29b6049b3" +
|
|
"c4d70bf22ac273c951e60dd22f6f427b8d234e85f6881fba" +
|
|
"35c288"
|
|
|
|
// CSR generated by Go:
|
|
// * Random public key
|
|
// * CN = (none)
|
|
// * DNSNames = not-example.com, www.not-example.com, mail.not-example.com
|
|
// * Signature algorithm: SHA1WithRSA
|
|
var BadAlgorithmCSRhex = "308202aa30820192020100300d310b300906035504061302" +
|
|
"555330820122300d06092a864886f70d0101010500038201" +
|
|
"0f003082010a02820101009f70f8d60b07f24b6960e18da8" +
|
|
"aabdc993c583a6c43c81ae256a1d4328146f3e907fb65dc4" +
|
|
"f30cb27c96d020e55bf116ef33f3696d2d957b9b408d6762" +
|
|
"2fe562311c96023100985ed8bc10929e7c552d7674027b63" +
|
|
"3973ede006b1ba338f9f4b7a88b4ea768c70632dde0f202a" +
|
|
"f59d41bf9aaa841e022735cfb2822a919b2b9ada07bdd569" +
|
|
"347894f1aa4908ee86d2019eb8980e819af20b5084eb11f7" +
|
|
"2f4f51e77c99d09e556ae84a720fa728962c5f7db176ce0a" +
|
|
"27b824fc63849ad5493ba790cd8f0c0aedf22d7979a95fce" +
|
|
"f4dfa552f8f85e15f5e7e427002b56f03f040e7cd43145d7" +
|
|
"7732ef9c4568b0f22aa91ca1e5a133f862939ed14c1859a1" +
|
|
"fdd36f0203010001a058305606092a864886f70d01090e31" +
|
|
"49304730450603551d11043e303c820f6e6f742d6578616d" +
|
|
"706c652e636f6d82137777772e6e6f742d6578616d706c65" +
|
|
"2e636f6d82146d61696c2e6e6f742d6578616d706c652e63" +
|
|
"6f6d300d06092a864886f70d0101050500038201010056cf" +
|
|
"65a690ef9d279caa0b5e44c51a1f97631c43e9f0c67fd329" +
|
|
"6b0d33acf06a695130fbdb8842a40d690549ab05f44b1738" +
|
|
"e8419b395563426d76cc5611d17ade13c96c92496a2ed008" +
|
|
"a78687f25c892af274afd9518540300edd160dc47887b402" +
|
|
"a0705b156e9b623f47a3bdaea93b84a4cf873ac1e9861b67" +
|
|
"f742024eff40c7c8e33243a953e9874e678c3f4cd24b4699" +
|
|
"28214425ef7b9181d8b10b7f07f557bef7c4b22689be4b2a" +
|
|
"42a0b6f0aaefa4dc8913338785e7f8fc2b1b95c4d189d10f" +
|
|
"72dbe575cdd6985e2d6eb0d0cbe962de0986cbcc8ca30dc8" +
|
|
"fa254808b0ee8946253830c087da95404181cb88ec59d399" +
|
|
"b4b3fcc21bbb1c9f3e1b29fd576a"
|
|
|
|
// Times for validity checking
|
|
var FarFuture = time.Date(2100, 1, 1, 0, 0, 0, 0, time.UTC)
|
|
var FarPast = time.Date(1950, 1, 1, 0, 0, 0, 0, time.UTC)
|
|
|
|
var log = mocks.UseMockLog()
|
|
|
|
// CFSSL config
|
|
const profileName = "ee"
|
|
const caKeyFile = "../test/test-ca.key"
|
|
const caCertFile = "../test/test-ca.pem"
|
|
|
|
const issuerCert = "../test/test-ca.pem"
|
|
|
|
// TODO(jmhodges): change this to boulder_ca_test database
|
|
var dbConnStr = "mysql+tcp://boulder@localhost:3306/boulder_test"
|
|
var exPA = cmd.PAConfig{
|
|
DBConnect: dbConnStr,
|
|
}
|
|
|
|
func setup(t *testing.T) (core.CertificateAuthorityDatabase, core.StorageAuthority, cmd.CAConfig, func()) {
|
|
// Create an SA
|
|
dbMap, err := sa.NewDbMap(dbConnStr)
|
|
if err != nil {
|
|
t.Fatalf("Failed to create dbMap: %s", err)
|
|
}
|
|
ssa, err := sa.NewSQLStorageAuthority(dbMap)
|
|
if err != nil {
|
|
t.Fatalf("Failed to create SA: %s", err)
|
|
}
|
|
if err = ssa.CreateTablesIfNotExists(); err != nil {
|
|
t.Fatalf("Failed to create tables: %s", err)
|
|
}
|
|
if err = dbMap.TruncateTables(); err != nil {
|
|
t.Fatalf("Failed to truncate tables: %s", err)
|
|
}
|
|
|
|
cadb, caDBCleanUp := caDBImpl(t)
|
|
cleanUp := func() {
|
|
if err = dbMap.TruncateTables(); err != nil {
|
|
t.Fatalf("Failed to truncate tables after the test: %s", err)
|
|
}
|
|
dbMap.Db.Close()
|
|
caDBCleanUp()
|
|
}
|
|
|
|
// Create a CA
|
|
caConfig := cmd.CAConfig{
|
|
Profile: profileName,
|
|
SerialPrefix: 17,
|
|
Key: cmd.KeyConfig{
|
|
File: caKeyFile,
|
|
},
|
|
TestMode: true,
|
|
Expiry: "8760h",
|
|
LifespanOCSP: "45m",
|
|
MaxNames: 2,
|
|
CFSSL: cfsslConfig.Config{
|
|
Signing: &cfsslConfig.Signing{
|
|
Profiles: map[string]*cfsslConfig.SigningProfile{
|
|
profileName: &cfsslConfig.SigningProfile{
|
|
Usage: []string{"server auth"},
|
|
CA: false,
|
|
IssuerURL: []string{"http://not-example.com/issuer-url"},
|
|
OCSP: "http://not-example.com/ocsp",
|
|
CRL: "http://not-example.com/crl",
|
|
|
|
Policies: []cfsslConfig.CertificatePolicy{
|
|
cfsslConfig.CertificatePolicy{
|
|
ID: cfsslConfig.OID(asn1.ObjectIdentifier{2, 23, 140, 1, 2, 1}),
|
|
},
|
|
},
|
|
ExpiryString: "8760h",
|
|
Backdate: time.Hour,
|
|
CSRWhitelist: &cfsslConfig.CSRWhitelist{
|
|
PublicKeyAlgorithm: true,
|
|
PublicKey: true,
|
|
SignatureAlgorithm: true,
|
|
},
|
|
},
|
|
},
|
|
Default: &cfsslConfig.SigningProfile{
|
|
ExpiryString: "8760h",
|
|
},
|
|
},
|
|
OCSP: &ocspConfig.Config{
|
|
CACertFile: issuerCert,
|
|
ResponderCertFile: issuerCert,
|
|
KeyFile: caKeyFile,
|
|
},
|
|
},
|
|
}
|
|
return cadb, ssa, caConfig, cleanUp
|
|
}
|
|
|
|
func TestFailNoSerial(t *testing.T) {
|
|
cadb, _, caConfig, cleanUp := setup(t)
|
|
defer cleanUp()
|
|
|
|
caConfig.SerialPrefix = 0
|
|
_, err := NewCertificateAuthorityImpl(cadb, caConfig, issuerCert, exPA)
|
|
test.AssertError(t, err, "CA should have failed with no SerialPrefix")
|
|
}
|
|
|
|
func TestRevoke(t *testing.T) {
|
|
cadb, storageAuthority, caConfig, cleanUp := setup(t)
|
|
defer cleanUp()
|
|
ca, err := NewCertificateAuthorityImpl(cadb, caConfig, caCertFile, exPA)
|
|
test.AssertNotError(t, err, "Failed to create CA")
|
|
if err != nil {
|
|
return
|
|
}
|
|
ca.SA = storageAuthority
|
|
ca.MaxKeySize = 4096
|
|
|
|
csrDER, _ := hex.DecodeString(CNandSANCSRhex)
|
|
csr, _ := x509.ParseCertificateRequest(csrDER)
|
|
certObj, err := ca.IssueCertificate(*csr, 1, FarFuture)
|
|
test.AssertNotError(t, err, "Failed to sign certificate")
|
|
if err != nil {
|
|
return
|
|
}
|
|
cert, err := x509.ParseCertificate(certObj.DER)
|
|
test.AssertNotError(t, err, "Certificate failed to parse")
|
|
serialString := core.SerialToString(cert.SerialNumber)
|
|
err = ca.RevokeCertificate(serialString, 0)
|
|
test.AssertNotError(t, err, "Revocation failed")
|
|
|
|
status, err := storageAuthority.GetCertificateStatus(serialString)
|
|
test.AssertNotError(t, err, "Failed to get cert status")
|
|
|
|
test.AssertEquals(t, status.Status, core.OCSPStatusRevoked)
|
|
secondAgo := time.Now().Add(-time.Second)
|
|
test.Assert(t, status.OCSPLastUpdated.After(secondAgo),
|
|
fmt.Sprintf("OCSP LastUpdated was more than a second old: %v", status.OCSPLastUpdated))
|
|
}
|
|
|
|
func TestIssueCertificate(t *testing.T) {
|
|
cadb, storageAuthority, caConfig, cleanUp := setup(t)
|
|
defer cleanUp()
|
|
ca, err := NewCertificateAuthorityImpl(cadb, caConfig, caCertFile, exPA)
|
|
test.AssertNotError(t, err, "Failed to create CA")
|
|
ca.SA = storageAuthority
|
|
ca.MaxKeySize = 4096
|
|
|
|
/*
|
|
// Uncomment to test with a local signer
|
|
signer, _ := local.NewSigner(caKey, caCert, x509.SHA256WithRSA, nil)
|
|
ca := CertificateAuthorityImpl{
|
|
Signer: signer,
|
|
SA: sa,
|
|
}
|
|
*/
|
|
|
|
csrs := []string{CNandSANCSRhex, NoSANCSRhex, NoCNCSRhex}
|
|
for _, csrHEX := range csrs {
|
|
csrDER, _ := hex.DecodeString(csrHEX)
|
|
csr, _ := x509.ParseCertificateRequest(csrDER)
|
|
|
|
// Sign CSR
|
|
issuedCert, err := ca.IssueCertificate(*csr, 1, FarFuture)
|
|
test.AssertNotError(t, err, "Failed to sign certificate")
|
|
if err != nil {
|
|
continue
|
|
}
|
|
|
|
// Verify cert contents
|
|
cert, err := x509.ParseCertificate(issuedCert.DER)
|
|
test.AssertNotError(t, err, "Certificate failed to parse")
|
|
|
|
test.AssertEquals(t, cert.Subject.CommonName, "not-example.com")
|
|
|
|
switch len(cert.DNSNames) {
|
|
case 1:
|
|
if cert.DNSNames[0] != "not-example.com" {
|
|
t.Errorf("Improper list of domain names %v", cert.DNSNames)
|
|
}
|
|
case 2:
|
|
switch {
|
|
case (cert.DNSNames[0] == "not-example.com" && cert.DNSNames[1] == "www.not-example.com"):
|
|
t.Log("case 1")
|
|
case (cert.DNSNames[0] == "www.not-example.com" && cert.DNSNames[1] == "not-example.com"):
|
|
t.Log("case 2")
|
|
default:
|
|
t.Errorf("Improper list of domain names %v", cert.DNSNames)
|
|
}
|
|
|
|
default:
|
|
t.Errorf("Improper list of domain names %v", cert.DNSNames)
|
|
}
|
|
|
|
// Test is broken by CFSSL Issue #156
|
|
// https://github.com/cloudflare/cfssl/issues/156
|
|
if len(cert.Subject.Country) > 0 {
|
|
// Uncomment the Errorf as soon as upstream #156 is fixed
|
|
// t.Errorf("Subject contained unauthorized values: %v", cert.Subject)
|
|
t.Logf("Subject contained unauthorized values: %v", cert.Subject)
|
|
}
|
|
|
|
// Verify that the cert got stored in the DB
|
|
serialString := core.SerialToString(cert.SerialNumber)
|
|
storedCert, err := storageAuthority.GetCertificate(serialString)
|
|
test.AssertNotError(t, err,
|
|
fmt.Sprintf("Certificate %s not found in database", serialString))
|
|
test.Assert(t, bytes.Equal(issuedCert.DER, storedCert.DER), "Retrieved cert not equal to issued cert.")
|
|
|
|
certStatus, err := storageAuthority.GetCertificateStatus(serialString)
|
|
test.AssertNotError(t, err,
|
|
fmt.Sprintf("Error fetching status for certificate %s", serialString))
|
|
test.Assert(t, certStatus.Status == core.OCSPStatusGood, "Certificate status was not good")
|
|
test.Assert(t, certStatus.SubscriberApproved == false, "Subscriber shouldn't have approved cert yet.")
|
|
}
|
|
}
|
|
|
|
func TestRejectNoName(t *testing.T) {
|
|
cadb, storageAuthority, caConfig, cleanUp := setup(t)
|
|
defer cleanUp()
|
|
ca, err := NewCertificateAuthorityImpl(cadb, caConfig, caCertFile, exPA)
|
|
test.AssertNotError(t, err, "Failed to create CA")
|
|
ca.SA = storageAuthority
|
|
ca.MaxKeySize = 4096
|
|
|
|
// Test that the CA rejects CSRs with no names
|
|
csrDER, _ := hex.DecodeString(NoNameCSRhex)
|
|
csr, _ := x509.ParseCertificateRequest(csrDER)
|
|
_, err = ca.IssueCertificate(*csr, 1, FarFuture)
|
|
if err == nil {
|
|
t.Errorf("CA improperly agreed to create a certificate with no name")
|
|
}
|
|
}
|
|
|
|
func TestRejectTooManyNames(t *testing.T) {
|
|
cadb, storageAuthority, caConfig, cleanUp := setup(t)
|
|
defer cleanUp()
|
|
ca, err := NewCertificateAuthorityImpl(cadb, caConfig, caCertFile, exPA)
|
|
test.AssertNotError(t, err, "Failed to create CA")
|
|
ca.SA = storageAuthority
|
|
|
|
// Test that the CA rejects a CSR with too many names
|
|
csrDER, _ := hex.DecodeString(TooManyNameCSRhex)
|
|
csr, _ := x509.ParseCertificateRequest(csrDER)
|
|
_, err = ca.IssueCertificate(*csr, 1, FarFuture)
|
|
test.Assert(t, err != nil, "Issued certificate with too many names")
|
|
}
|
|
|
|
func TestDeduplication(t *testing.T) {
|
|
cadb, storageAuthority, caConfig, cleanUp := setup(t)
|
|
defer cleanUp()
|
|
ca, err := NewCertificateAuthorityImpl(cadb, caConfig, caCertFile, exPA)
|
|
test.AssertNotError(t, err, "Failed to create CA")
|
|
ca.SA = storageAuthority
|
|
ca.MaxKeySize = 4096
|
|
|
|
// Test that the CA collapses duplicate names
|
|
csrDER, _ := hex.DecodeString(DupeNameCSRhex)
|
|
csr, _ := x509.ParseCertificateRequest(csrDER)
|
|
cert, err := ca.IssueCertificate(*csr, 1, FarFuture)
|
|
test.AssertNotError(t, err, "Failed to gracefully handle a CSR with duplicate names")
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
parsedCert, err := x509.ParseCertificate(cert.DER)
|
|
test.AssertNotError(t, err, "Error parsing certificate produced by CA")
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
correctName := "a.not-example.com"
|
|
correctNames := len(parsedCert.DNSNames) == 1 &&
|
|
parsedCert.DNSNames[0] == correctName &&
|
|
parsedCert.Subject.CommonName == correctName
|
|
test.Assert(t, correctNames, "Incorrect set of names in deduplicated certificate")
|
|
}
|
|
|
|
func TestRejectValidityTooLong(t *testing.T) {
|
|
cadb, storageAuthority, caConfig, cleanUp := setup(t)
|
|
defer cleanUp()
|
|
ca, err := NewCertificateAuthorityImpl(cadb, caConfig, caCertFile, exPA)
|
|
test.AssertNotError(t, err, "Failed to create CA")
|
|
ca.SA = storageAuthority
|
|
ca.MaxKeySize = 4096
|
|
|
|
// Test that the CA rejects CSRs that would expire after the intermediate cert
|
|
csrDER, _ := hex.DecodeString(NoCNCSRhex)
|
|
csr, _ := x509.ParseCertificateRequest(csrDER)
|
|
_, err = ca.IssueCertificate(*csr, 1, FarPast)
|
|
test.Assert(t, err == nil, "Can issue a certificate that expires after the underlying authorization.")
|
|
|
|
// Test that the CA rejects CSRs that would expire after the intermediate cert
|
|
csrDER, _ = hex.DecodeString(NoCNCSRhex)
|
|
csr, _ = x509.ParseCertificateRequest(csrDER)
|
|
ca.NotAfter = time.Now()
|
|
_, err = ca.IssueCertificate(*csr, 1, FarFuture)
|
|
test.AssertEquals(t, err.Error(), "Cannot issue a certificate that expires after the intermediate certificate.")
|
|
}
|
|
|
|
func TestShortKey(t *testing.T) {
|
|
cadb, storageAuthority, caConfig, cleanUp := setup(t)
|
|
defer cleanUp()
|
|
ca, err := NewCertificateAuthorityImpl(cadb, caConfig, caCertFile, exPA)
|
|
ca.SA = storageAuthority
|
|
ca.MaxKeySize = 4096
|
|
|
|
// Test that the CA rejects CSRs that would expire after the intermediate cert
|
|
csrDER, _ := hex.DecodeString(ShortKeyCSRhex)
|
|
csr, _ := x509.ParseCertificateRequest(csrDER)
|
|
_, err = ca.IssueCertificate(*csr, 1, FarFuture)
|
|
test.Assert(t, err != nil, "Issued a certificate with too short a key.")
|
|
}
|
|
|
|
func TestRejectBadAlgorithm(t *testing.T) {
|
|
cadb, storageAuthority, caConfig, cleanUp := setup(t)
|
|
defer cleanUp()
|
|
ca, err := NewCertificateAuthorityImpl(cadb, caConfig, caCertFile, exPA)
|
|
ca.SA = storageAuthority
|
|
ca.MaxKeySize = 4096
|
|
|
|
// Test that the CA rejects CSRs that would expire after the intermediate cert
|
|
csrDER, _ := hex.DecodeString(BadAlgorithmCSRhex)
|
|
csr, _ := x509.ParseCertificateRequest(csrDER)
|
|
_, err = ca.IssueCertificate(*csr, 1, FarFuture)
|
|
test.Assert(t, err != nil, "Issued a certificate based on a CSR with a weak algorithm.")
|
|
}
|