test_cert_trust.js (8072B)
1 // -*- indent-tabs-mode: nil; js-indent-level: 2 -*- 2 // This Source Code Form is subject to the terms of the Mozilla Public 3 // License, v. 2.0. If a copy of the MPL was not distributed with this 4 // file, You can obtain one at http://mozilla.org/MPL/2.0/. 5 6 "use strict"; 7 8 do_get_profile(); // must be called before getting nsIX509CertDB 9 const certdb = Cc["@mozilla.org/security/x509certdb;1"].getService( 10 Ci.nsIX509CertDB 11 ); 12 13 function load_cert(cert_name, trust_string) { 14 let cert_filename = cert_name + ".pem"; 15 return addCertFromFile( 16 certdb, 17 "test_cert_trust/" + cert_filename, 18 trust_string 19 ); 20 } 21 22 function setup_basic_trusts(ca_cert, int_cert) { 23 certdb.setCertTrust( 24 ca_cert, 25 Ci.nsIX509Cert.CA_CERT, 26 Ci.nsIX509CertDB.TRUSTED_SSL | Ci.nsIX509CertDB.TRUSTED_EMAIL 27 ); 28 29 certdb.setCertTrust(int_cert, Ci.nsIX509Cert.CA_CERT, 0); 30 } 31 32 async function test_ca_distrust(ee_cert, cert_to_modify_trust, isRootCA) { 33 // On reset most usages are successful 34 await checkCertErrorGeneric( 35 certdb, 36 ee_cert, 37 PRErrorCodeSuccess, 38 Ci.nsIX509CertDB.verifyUsageTLSServer 39 ); 40 await checkCertErrorGeneric( 41 certdb, 42 ee_cert, 43 PRErrorCodeSuccess, 44 Ci.nsIX509CertDB.verifyUsageTLSClient 45 ); 46 await checkCertErrorGeneric( 47 certdb, 48 ee_cert, 49 SEC_ERROR_CA_CERT_INVALID, 50 Ci.nsIX509CertDB.verifyUsageTLSServerCA 51 ); 52 await checkCertErrorGeneric( 53 certdb, 54 ee_cert, 55 PRErrorCodeSuccess, 56 Ci.nsIX509CertDB.verifyUsageEmailSigner 57 ); 58 await checkCertErrorGeneric( 59 certdb, 60 ee_cert, 61 PRErrorCodeSuccess, 62 Ci.nsIX509CertDB.verifyUsageEmailRecipient 63 ); 64 65 // Test of active distrust. No usage should pass. 66 setCertTrust(cert_to_modify_trust, "p,p,p"); 67 await checkCertErrorGeneric( 68 certdb, 69 ee_cert, 70 SEC_ERROR_UNTRUSTED_ISSUER, 71 Ci.nsIX509CertDB.verifyUsageTLSServer 72 ); 73 await checkCertErrorGeneric( 74 certdb, 75 ee_cert, 76 SEC_ERROR_UNTRUSTED_ISSUER, 77 Ci.nsIX509CertDB.verifyUsageTLSClient 78 ); 79 await checkCertErrorGeneric( 80 certdb, 81 ee_cert, 82 SEC_ERROR_CA_CERT_INVALID, 83 Ci.nsIX509CertDB.verifyUsageTLSServerCA 84 ); 85 await checkCertErrorGeneric( 86 certdb, 87 ee_cert, 88 SEC_ERROR_UNTRUSTED_ISSUER, 89 Ci.nsIX509CertDB.verifyUsageEmailSigner 90 ); 91 await checkCertErrorGeneric( 92 certdb, 93 ee_cert, 94 SEC_ERROR_UNTRUSTED_ISSUER, 95 Ci.nsIX509CertDB.verifyUsageEmailRecipient 96 ); 97 98 // Trust set to T - trusted CA to issue client certs, where client cert is 99 // usageSSLClient. 100 setCertTrust(cert_to_modify_trust, "T,T,T"); 101 await checkCertErrorGeneric( 102 certdb, 103 ee_cert, 104 isRootCA ? SEC_ERROR_UNKNOWN_ISSUER : PRErrorCodeSuccess, 105 Ci.nsIX509CertDB.verifyUsageTLSServer 106 ); 107 108 // XXX(Bug 982340) 109 await checkCertErrorGeneric( 110 certdb, 111 ee_cert, 112 isRootCA ? SEC_ERROR_UNKNOWN_ISSUER : PRErrorCodeSuccess, 113 Ci.nsIX509CertDB.verifyUsageTLSClient 114 ); 115 116 await checkCertErrorGeneric( 117 certdb, 118 ee_cert, 119 SEC_ERROR_CA_CERT_INVALID, 120 Ci.nsIX509CertDB.verifyUsageTLSServerCA 121 ); 122 123 await checkCertErrorGeneric( 124 certdb, 125 ee_cert, 126 isRootCA ? SEC_ERROR_UNKNOWN_ISSUER : PRErrorCodeSuccess, 127 Ci.nsIX509CertDB.verifyUsageEmailSigner 128 ); 129 await checkCertErrorGeneric( 130 certdb, 131 ee_cert, 132 isRootCA ? SEC_ERROR_UNKNOWN_ISSUER : PRErrorCodeSuccess, 133 Ci.nsIX509CertDB.verifyUsageEmailRecipient 134 ); 135 136 // Now tests on the SSL trust bit 137 setCertTrust(cert_to_modify_trust, "p,C,C"); 138 await checkCertErrorGeneric( 139 certdb, 140 ee_cert, 141 SEC_ERROR_UNTRUSTED_ISSUER, 142 Ci.nsIX509CertDB.verifyUsageTLSServer 143 ); 144 145 // XXX(Bug 982340) 146 await checkCertErrorGeneric( 147 certdb, 148 ee_cert, 149 PRErrorCodeSuccess, 150 Ci.nsIX509CertDB.verifyUsageTLSClient 151 ); 152 await checkCertErrorGeneric( 153 certdb, 154 ee_cert, 155 SEC_ERROR_CA_CERT_INVALID, 156 Ci.nsIX509CertDB.verifyUsageTLSServerCA 157 ); 158 await checkCertErrorGeneric( 159 certdb, 160 ee_cert, 161 PRErrorCodeSuccess, 162 Ci.nsIX509CertDB.verifyUsageEmailSigner 163 ); 164 await checkCertErrorGeneric( 165 certdb, 166 ee_cert, 167 PRErrorCodeSuccess, 168 Ci.nsIX509CertDB.verifyUsageEmailRecipient 169 ); 170 171 // Inherited trust SSL 172 setCertTrust(cert_to_modify_trust, ",C,C"); 173 await checkCertErrorGeneric( 174 certdb, 175 ee_cert, 176 isRootCA ? SEC_ERROR_UNKNOWN_ISSUER : PRErrorCodeSuccess, 177 Ci.nsIX509CertDB.verifyUsageTLSServer 178 ); 179 // XXX(Bug 982340) 180 await checkCertErrorGeneric( 181 certdb, 182 ee_cert, 183 PRErrorCodeSuccess, 184 Ci.nsIX509CertDB.verifyUsageTLSClient 185 ); 186 await checkCertErrorGeneric( 187 certdb, 188 ee_cert, 189 SEC_ERROR_CA_CERT_INVALID, 190 Ci.nsIX509CertDB.verifyUsageTLSServerCA 191 ); 192 await checkCertErrorGeneric( 193 certdb, 194 ee_cert, 195 PRErrorCodeSuccess, 196 Ci.nsIX509CertDB.verifyUsageEmailSigner 197 ); 198 await checkCertErrorGeneric( 199 certdb, 200 ee_cert, 201 PRErrorCodeSuccess, 202 Ci.nsIX509CertDB.verifyUsageEmailRecipient 203 ); 204 205 // Now tests on the EMAIL trust bit 206 setCertTrust(cert_to_modify_trust, "C,p,C"); 207 await checkCertErrorGeneric( 208 certdb, 209 ee_cert, 210 PRErrorCodeSuccess, 211 Ci.nsIX509CertDB.verifyUsageTLSServer 212 ); 213 await checkCertErrorGeneric( 214 certdb, 215 ee_cert, 216 SEC_ERROR_UNTRUSTED_ISSUER, 217 Ci.nsIX509CertDB.verifyUsageTLSClient 218 ); 219 await checkCertErrorGeneric( 220 certdb, 221 ee_cert, 222 SEC_ERROR_CA_CERT_INVALID, 223 Ci.nsIX509CertDB.verifyUsageTLSServerCA 224 ); 225 await checkCertErrorGeneric( 226 certdb, 227 ee_cert, 228 SEC_ERROR_UNTRUSTED_ISSUER, 229 Ci.nsIX509CertDB.verifyUsageEmailSigner 230 ); 231 await checkCertErrorGeneric( 232 certdb, 233 ee_cert, 234 SEC_ERROR_UNTRUSTED_ISSUER, 235 Ci.nsIX509CertDB.verifyUsageEmailRecipient 236 ); 237 238 // inherited EMAIL Trust 239 setCertTrust(cert_to_modify_trust, "C,,C"); 240 await checkCertErrorGeneric( 241 certdb, 242 ee_cert, 243 PRErrorCodeSuccess, 244 Ci.nsIX509CertDB.verifyUsageTLSServer 245 ); 246 await checkCertErrorGeneric( 247 certdb, 248 ee_cert, 249 isRootCA ? SEC_ERROR_UNKNOWN_ISSUER : PRErrorCodeSuccess, 250 Ci.nsIX509CertDB.verifyUsageTLSClient 251 ); 252 await checkCertErrorGeneric( 253 certdb, 254 ee_cert, 255 SEC_ERROR_CA_CERT_INVALID, 256 Ci.nsIX509CertDB.verifyUsageTLSServerCA 257 ); 258 await checkCertErrorGeneric( 259 certdb, 260 ee_cert, 261 isRootCA ? SEC_ERROR_UNKNOWN_ISSUER : PRErrorCodeSuccess, 262 Ci.nsIX509CertDB.verifyUsageEmailSigner 263 ); 264 await checkCertErrorGeneric( 265 certdb, 266 ee_cert, 267 isRootCA ? SEC_ERROR_UNKNOWN_ISSUER : PRErrorCodeSuccess, 268 Ci.nsIX509CertDB.verifyUsageEmailRecipient 269 ); 270 } 271 272 add_task(async function () { 273 let certList = ["ca", "int", "ee"]; 274 let loadedCerts = []; 275 for (let certName of certList) { 276 loadedCerts.push(load_cert(certName, ",,")); 277 } 278 279 let ca_cert = loadedCerts[0]; 280 notEqual(ca_cert, null, "CA cert should have successfully loaded"); 281 let int_cert = loadedCerts[1]; 282 notEqual(int_cert, null, "Intermediate cert should have successfully loaded"); 283 let ee_cert = loadedCerts[2]; 284 notEqual(ee_cert, null, "EE cert should have successfully loaded"); 285 286 setup_basic_trusts(ca_cert, int_cert); 287 await test_ca_distrust(ee_cert, ca_cert, true); 288 289 setup_basic_trusts(ca_cert, int_cert); 290 await test_ca_distrust(ee_cert, int_cert, false); 291 292 // Reset trust to default ("inherit trust") 293 setCertTrust(ca_cert, ",,"); 294 setCertTrust(int_cert, ",,"); 295 296 // End-entities can be trust anchors for interoperability with users who 297 // prefer not to build a hierarchy and instead directly trust a particular 298 // server certificate. 299 setCertTrust(ee_cert, "CTu,CTu,CTu"); 300 await checkCertErrorGeneric( 301 certdb, 302 ee_cert, 303 PRErrorCodeSuccess, 304 Ci.nsIX509CertDB.verifyUsageTLSServer 305 ); 306 await checkCertErrorGeneric( 307 certdb, 308 ee_cert, 309 PRErrorCodeSuccess, 310 Ci.nsIX509CertDB.verifyUsageTLSClient 311 ); 312 await checkCertErrorGeneric( 313 certdb, 314 ee_cert, 315 PRErrorCodeSuccess, 316 Ci.nsIX509CertDB.verifyUsageEmailSigner 317 ); 318 await checkCertErrorGeneric( 319 certdb, 320 ee_cert, 321 PRErrorCodeSuccess, 322 Ci.nsIX509CertDB.verifyUsageEmailRecipient 323 ); 324 });