test_cert_eku.js (3975B)
1 // -*- indent-tabs-mode: nil; js-indent-level: 2 -*- 2 // This Source Code Form is subject to the terms of the Mozilla Public 3 // License, v. 2.0. If a copy of the MPL was not distributed with this 4 // file, You can obtain one at http://mozilla.org/MPL/2.0/. 5 6 // Tests that the extended key usage extension is properly processed by the 7 // platform when verifying certificates. There are already comprehensive tests 8 // in mozilla::pkix itself, but these tests serve as integration tests to ensure 9 // that the cases we're particularly concerned about are correctly handled. 10 11 "use strict"; 12 13 do_get_profile(); // must be called before getting nsIX509CertDB 14 const certdb = Cc["@mozilla.org/security/x509certdb;1"].getService( 15 Ci.nsIX509CertDB 16 ); 17 18 function certFromFile(certName) { 19 return constructCertFromFile(`test_cert_eku/${certName}.pem`); 20 } 21 22 function loadCertWithTrust(certName, trustString) { 23 addCertFromFile(certdb, `test_cert_eku/${certName}.pem`, trustString); 24 } 25 26 function checkEndEntity(cert, expectedResult) { 27 return checkCertErrorGeneric( 28 certdb, 29 cert, 30 expectedResult, 31 Ci.nsIX509CertDB.verifyUsageTLSServer 32 ); 33 } 34 35 function checkCertOn25August2016(cert, expectedResult) { 36 // (new Date("2016-08-25T00:00:00Z")).getTime() / 1000 37 const VALIDATION_TIME = 1472083200; 38 return checkCertErrorGenericAtTime( 39 certdb, 40 cert, 41 expectedResult, 42 Ci.nsIX509CertDB.verifyUsageTLSServer, 43 VALIDATION_TIME 44 ); 45 } 46 47 add_task(async function () { 48 registerCleanupFunction(() => { 49 Services.prefs.clearUserPref("privacy.reduceTimerPrecision"); 50 }); 51 Services.prefs.setBoolPref("privacy.reduceTimerPrecision", false); 52 53 loadCertWithTrust("ca", "CTu,,"); 54 // end-entity has id-kp-serverAuth => success 55 await checkEndEntity(certFromFile("ee-SA"), PRErrorCodeSuccess); 56 // end-entity has id-kp-serverAuth => success 57 await checkEndEntity(certFromFile("ee-SA-CA"), PRErrorCodeSuccess); 58 // end-entity has extended key usage, but id-kp-serverAuth is not present => 59 // failure 60 await checkEndEntity(certFromFile("ee-CA"), SEC_ERROR_INADEQUATE_CERT_TYPE); 61 // end-entity has id-kp-serverAuth => success 62 await checkEndEntity(certFromFile("ee-SA-nsSGC"), PRErrorCodeSuccess); 63 64 // end-entity has extended key usage, but id-kp-serverAuth is not present => 65 // failure (in particular, Netscape Server Gated Crypto (also known as 66 // Netscape Step Up) is not an acceptable substitute for end-entity 67 // certificates). 68 await checkEndEntity( 69 certFromFile("ee-nsSGC"), 70 SEC_ERROR_INADEQUATE_CERT_TYPE 71 ); 72 73 // end-entity has id-kp-OCSPSigning, which is not acceptable for end-entity 74 // certificates being verified as TLS server certificates => failure 75 await checkEndEntity( 76 certFromFile("ee-SA-OCSP"), 77 SEC_ERROR_INADEQUATE_CERT_TYPE 78 ); 79 80 // intermediate has id-kp-serverAuth => success 81 loadCertWithTrust("int-SA", ",,"); 82 await checkEndEntity(certFromFile("ee-int-SA"), PRErrorCodeSuccess); 83 // intermediate has id-kp-serverAuth => success 84 loadCertWithTrust("int-SA-CA", ",,"); 85 await checkEndEntity(certFromFile("ee-int-SA-CA"), PRErrorCodeSuccess); 86 // intermediate has extended key usage, but id-kp-serverAuth is not present 87 // => failure 88 loadCertWithTrust("int-CA", ",,"); 89 await checkEndEntity( 90 certFromFile("ee-int-CA"), 91 SEC_ERROR_INADEQUATE_CERT_TYPE 92 ); 93 // intermediate has id-kp-serverAuth => success 94 loadCertWithTrust("int-SA-nsSGC", ",,"); 95 await checkEndEntity(certFromFile("ee-int-SA-nsSGC"), PRErrorCodeSuccess); 96 97 // Intermediate has Netscape Server Gated Crypto, but no other suitable EKU 98 // => failure 99 loadCertWithTrust("int-nsSGC", ",,"); 100 await checkCertOn25August2016( 101 certFromFile("ee-int-nsSGC"), 102 SEC_ERROR_INADEQUATE_CERT_TYPE 103 ); 104 105 // intermediate has id-kp-OCSPSigning, which is acceptable for CA 106 // certificates => success 107 loadCertWithTrust("int-SA-OCSP", ",,"); 108 await checkEndEntity(certFromFile("ee-int-SA-OCSP"), PRErrorCodeSuccess); 109 });