tocsp.com 7.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152
  1. $! TOCSP.COM
  2. $
  3. $ cmd = "mcr ''exe_dir'openssl"
  4. $ ocspdir = "ocsp-tests"
  5. $ ! 17 December 2012 so we don't get certificate expiry errors.
  6. $ check_time = "-attime 1355875200"
  7. $
  8. $ test_ocsp: subroutine
  9. $ set noon
  10. $ 'cmd' base64 -d -in [.'ocspdir']'p1' -out f.d
  11. $ 'cmd' ocsp -respin f.d -partial_chain 'check_time' -
  12. "-CAfile" [.'ocspdir']'p2' -verify_other [.'ocspdir']'p2' -
  13. "-CApath" nul:
  14. $ ! when ocsp exits with 0, VMS severity becomes 1
  15. $ ! when ocsp exits with 1, VMS severity becomes 2
  16. $ ! See the definition of EXIT(n) in the VMS sextion in e_os.h
  17. $ if $severity .ne. 'p3'+1 then exit 2 ! severity error
  18. $ exit 1
  19. $ endsubroutine
  20. $
  21. $ on error then exit 2
  22. $ write sys$output "=== VALID OCSP RESPONSES ==="
  23. $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
  24. $ call test_ocsp ND1.ors ND1_Issuer_ICA.pem 0
  25. $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
  26. $ call test_ocsp ND2.ors ND2_Issuer_Root.pem 0
  27. $ write sys$output "NON-DELEGATED; Root CA -> EE"
  28. $ call test_ocsp ND3.ors ND3_Issuer_Root.pem 0
  29. $ write sys$output "DELEGATED; Intermediate CA -> EE"
  30. $ call test_ocsp D1.ors D1_Issuer_ICA.pem 0
  31. $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
  32. $ call test_ocsp D2.ors D2_Issuer_Root.pem 0
  33. $ write sys$output "DELEGATED; Root CA -> EE"
  34. $ call test_ocsp D3.ors D3_Issuer_Root.pem 0
  35. $
  36. $ write sys$output "=== INVALID SIGNATURE on the OCSP RESPONSE ==="
  37. $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
  38. $ call test_ocsp ISOP_ND1.ors ND1_Issuer_ICA.pem 1
  39. $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
  40. $ call test_ocsp ISOP_ND2.ors ND2_Issuer_Root.pem 1
  41. $ write sys$output "NON-DELEGATED; Root CA -> EE"
  42. $ call test_ocsp ISOP_ND3.ors ND3_Issuer_Root.pem 1
  43. $ write sys$output "DELEGATED; Intermediate CA -> EE"
  44. $ call test_ocsp ISOP_D1.ors D1_Issuer_ICA.pem 1
  45. $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
  46. $ call test_ocsp ISOP_D2.ors D2_Issuer_Root.pem 1
  47. $ write sys$output "DELEGATED; Root CA -> EE"
  48. $ call test_ocsp ISOP_D3.ors D3_Issuer_Root.pem 1
  49. $
  50. $ write sys$output "=== WRONG RESPONDERID in the OCSP RESPONSE ==="
  51. $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
  52. $ call test_ocsp WRID_ND1.ors ND1_Issuer_ICA.pem 1
  53. $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
  54. $ call test_ocsp WRID_ND2.ors ND2_Issuer_Root.pem 1
  55. $ write sys$output "NON-DELEGATED; Root CA -> EE"
  56. $ call test_ocsp WRID_ND3.ors ND3_Issuer_Root.pem 1
  57. $ write sys$output "DELEGATED; Intermediate CA -> EE"
  58. $ call test_ocsp WRID_D1.ors D1_Issuer_ICA.pem 1
  59. $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
  60. $ call test_ocsp WRID_D2.ors D2_Issuer_Root.pem 1
  61. $ write sys$output "DELEGATED; Root CA -> EE"
  62. $ call test_ocsp WRID_D3.ors D3_Issuer_Root.pem 1
  63. $
  64. $ write sys$output "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ==="
  65. $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
  66. $ call test_ocsp WINH_ND1.ors ND1_Issuer_ICA.pem 1
  67. $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
  68. $ call test_ocsp WINH_ND2.ors ND2_Issuer_Root.pem 1
  69. $ write sys$output "NON-DELEGATED; Root CA -> EE"
  70. $ call test_ocsp WINH_ND3.ors ND3_Issuer_Root.pem 1
  71. $ write sys$output "DELEGATED; Intermediate CA -> EE"
  72. $ call test_ocsp WINH_D1.ors D1_Issuer_ICA.pem 1
  73. $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
  74. $ call test_ocsp WINH_D2.ors D2_Issuer_Root.pem 1
  75. $ write sys$output "DELEGATED; Root CA -> EE"
  76. $ call test_ocsp WINH_D3.ors D3_Issuer_Root.pem 1
  77. $
  78. $ write sys$output "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ==="
  79. $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
  80. $ call test_ocsp WIKH_ND1.ors ND1_Issuer_ICA.pem 1
  81. $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
  82. $ call test_ocsp WIKH_ND2.ors ND2_Issuer_Root.pem 1
  83. $ write sys$output "NON-DELEGATED; Root CA -> EE"
  84. $ call test_ocsp WIKH_ND3.ors ND3_Issuer_Root.pem 1
  85. $ write sys$output "DELEGATED; Intermediate CA -> EE"
  86. $ call test_ocsp WIKH_D1.ors D1_Issuer_ICA.pem 1
  87. $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
  88. $ call test_ocsp WIKH_D2.ors D2_Issuer_Root.pem 1
  89. $ write sys$output "DELEGATED; Root CA -> EE"
  90. $ call test_ocsp WIKH_D3.ors D3_Issuer_Root.pem 1
  91. $
  92. $ write sys$output "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ==="
  93. $ write sys$output "DELEGATED; Intermediate CA -> EE"
  94. $ call test_ocsp WKDOSC_D1.ors D1_Issuer_ICA.pem 1
  95. $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
  96. $ call test_ocsp WKDOSC_D2.ors D2_Issuer_Root.pem 1
  97. $ write sys$output "DELEGATED; Root CA -> EE"
  98. $ call test_ocsp WKDOSC_D3.ors D3_Issuer_Root.pem 1
  99. $
  100. $ write sys$output "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ==="
  101. $ write sys$output "DELEGATED; Intermediate CA -> EE"
  102. $ call test_ocsp ISDOSC_D1.ors D1_Issuer_ICA.pem 1
  103. $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
  104. $ call test_ocsp ISDOSC_D2.ors D2_Issuer_Root.pem 1
  105. $ write sys$output "DELEGATED; Root CA -> EE"
  106. $ call test_ocsp ISDOSC_D3.ors D3_Issuer_Root.pem 1
  107. $
  108. $ write sys$output "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ==="
  109. $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
  110. $ call test_ocsp ND1.ors WSNIC_ND1_Issuer_ICA.pem 1
  111. $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
  112. $ call test_ocsp ND2.ors WSNIC_ND2_Issuer_Root.pem 1
  113. $ write sys$output "NON-DELEGATED; Root CA -> EE"
  114. $ call test_ocsp ND3.ors WSNIC_ND3_Issuer_Root.pem 1
  115. $ write sys$output "DELEGATED; Intermediate CA -> EE"
  116. $ call test_ocsp D1.ors WSNIC_D1_Issuer_ICA.pem 1
  117. $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
  118. $ call test_ocsp D2.ors WSNIC_D2_Issuer_Root.pem 1
  119. $ write sys$output "DELEGATED; Root CA -> EE"
  120. $ call test_ocsp D3.ors WSNIC_D3_Issuer_Root.pem 1
  121. $
  122. $ write sys$output "=== WRONG KEY in the ISSUER CERTIFICATE ==="
  123. $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
  124. $ call test_ocsp ND1.ors WKIC_ND1_Issuer_ICA.pem 1
  125. $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
  126. $ call test_ocsp ND2.ors WKIC_ND2_Issuer_Root.pem 1
  127. $ write sys$output "NON-DELEGATED; Root CA -> EE"
  128. $ call test_ocsp ND3.ors WKIC_ND3_Issuer_Root.pem 1
  129. $ write sys$output "DELEGATED; Intermediate CA -> EE"
  130. $ call test_ocsp D1.ors WKIC_D1_Issuer_ICA.pem 1
  131. $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
  132. $ call test_ocsp D2.ors WKIC_D2_Issuer_Root.pem 1
  133. $ write sys$output "DELEGATED; Root CA -> EE"
  134. $ call test_ocsp D3.ors WKIC_D3_Issuer_Root.pem 1
  135. $
  136. $ write sys$output "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ==="
  137. $ !# Expect success, because we're explicitly trusting the issuer certificate.
  138. $ write sys$output "NON-DELEGATED; Intermediate CA -> EE"
  139. $ call test_ocsp ND1.ors ISIC_ND1_Issuer_ICA.pem 0
  140. $ write sys$output "NON-DELEGATED; Root CA -> Intermediate CA"
  141. $ call test_ocsp ND2.ors ISIC_ND2_Issuer_Root.pem 0
  142. $ write sys$output "NON-DELEGATED; Root CA -> EE"
  143. $ call test_ocsp ND3.ors ISIC_ND3_Issuer_Root.pem 0
  144. $ write sys$output "DELEGATED; Intermediate CA -> EE"
  145. $ call test_ocsp D1.ors ISIC_D1_Issuer_ICA.pem 0
  146. $ write sys$output "DELEGATED; Root CA -> Intermediate CA"
  147. $ call test_ocsp D2.ors ISIC_D2_Issuer_Root.pem 0
  148. $ write sys$output "DELEGATED; Root CA -> EE"
  149. $ call test_ocsp D3.ors ISIC_D3_Issuer_Root.pem 0
  150. $
  151. $ write sys$output "ALL OCSP TESTS SUCCESSFUL"
  152. $ exit 1