pkits.sh (71120B)
1 #!/bin/bash 2 # 3 # This Source Code Form is subject to the terms of the Mozilla Public 4 # License, v. 2.0. If a copy of the MPL was not distributed with this 5 # file, You can obtain one at http://mozilla.org/MPL/2.0/. 6 7 ######################################################################## 8 # 9 # mozilla/security/nss/tests/pkits/pkits.sh 10 # 11 # Script to test the NIST PKITS tests 12 # 13 # needs to work on all Unix and Windows platforms 14 # 15 # tests implemented: 16 # vfychain 17 # 18 # special NOTES 19 # --------------- 20 # NIST PKITS data needs to be downloaded from 21 # http://csrc.nist.gov/pki/testing/x509paths.html 22 # Environment variable PKITS_DATA needs to be set to the directory 23 # where this data is downloaded, or test data needs to be copied under 24 # the mozilla source tree in mozilla/PKITS_DATA 25 ######################################################################## 26 27 ############################## pkits_init ############################## 28 # local shell function to initialize this script 29 ######################################################################## 30 pkits_init() 31 { 32 SCRIPTNAME=pkits.sh 33 34 if [ -z "${CLEANUP}" ] ; then 35 CLEANUP="${SCRIPTNAME}" 36 fi 37 38 if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then 39 cd ../common 40 . ./init.sh 41 fi 42 43 if [ -z "${PKITS_DATA}" ]; then 44 echo "${SCRIPTNAME}: PKITS data directory not defined, skipping." 45 exit 0 46 fi 47 48 if [ ! -d "${PKITS_DATA}" ]; then 49 echo "${SCRIPTNAME}: PKITS data directory ${PKITS_DATA} doesn't exist, skipping." 50 exit 0 51 fi 52 53 PKITSDIR=${HOSTDIR}/pkits 54 55 COPYDIR=${PKITSDIR}/copydir 56 57 mkdir -p ${PKITSDIR} 58 mkdir -p ${COPYDIR} 59 mkdir -p ${PKITSDIR}/html 60 61 certs=${PKITS_DATA}/certs 62 crls=${PKITS_DATA}/crls 63 64 cd ${PKITSDIR} 65 66 PKITSdb=${PKITSDIR}/PKITSdb 67 PKITSbkp=${PKITSDIR}/PKITSbkp 68 69 PKITS_LOG=${PKITSDIR}/pkits.log #getting its own logfile 70 pkits_log "Start of logfile $PKITS_LOG" 71 72 if [ ! -d "${PKITSdb}" ]; then 73 mkdir -p ${PKITSdb} 74 else 75 pkits_log "$SCRIPTNAME: WARNING - ${PKITSdb} exists" 76 fi 77 78 if [ ! -d "${PKITSbkp}" ]; then 79 mkdir -p ${PKITSbkp} 80 else 81 pkits_log "$SCRIPTNAME: WARNING - ${PKITSbkp} exists" 82 fi 83 84 echo "HOSTDIR" $HOSTDIR 85 echo "PKITSDIR" $PKITSDIR 86 echo "PKITSdb" $PKITSdb 87 echo "PKITSbkp" $PKITSbkp 88 echo "PKITS_DATA" $PKITS_DATA 89 echo "certs" $certs 90 echo "crls" $crls 91 92 echo nss > ${PKITSdb}/pw 93 ${BINDIR}/certutil -N -d ${PKITSdb} -f ${PKITSdb}/pw 94 95 ${BINDIR}/certutil -A -n TrustAnchorRootCertificate -t "C,C,C" -i \ 96 $certs/TrustAnchorRootCertificate.crt -d $PKITSdb -f ${PKITSdb}/pw 97 if [ -z "$NSS_NO_PKITS_CRLS" ]; then 98 ${BINDIR}/crlutil -I -i $crls/TrustAnchorRootCRL.crl -d ${PKITSdb} -f ${PKITSdb}/pw 99 else 100 html "<H3>NO CRLs are being used.</H3>" 101 pkits_log "NO CRLs are being used." 102 fi 103 104 cp ${PKITSdb}/* ${PKITSbkp} 105 106 KNOWN_BUG= 107 } 108 109 ############################### pkits_log ############################## 110 # write to pkits.log file 111 ######################################################################## 112 pkits_log() 113 { 114 echo "$SCRIPTNAME $*" 115 echo $* >> ${PKITS_LOG} 116 } 117 118 restore_db() 119 { 120 echo "Restore DB" 121 rm ${PKITSdb}/* 122 cp ${PKITSbkp}/* ${PKITSdb} 123 } 124 125 log_banner() 126 { 127 echo "" 128 echo "--------------------------------------------------------------------" 129 echo "Test case ${VFY_ACTION}" 130 echo "" 131 } 132 133 start_table() 134 { 135 html "<TABLE BORDER=1><TR><TH COLSPAN=3>$*</TH></TR>" 136 html "<TR><TH width=500>Test Case</TH><TH width=50>Result</TH></TR>" 137 echo "" 138 echo "***************************************************************" 139 echo "$*" 140 echo "***************************************************************" 141 } 142 143 break_table() 144 { 145 html "</TABLE><P>" 146 start_table "$@" 147 } 148 149 ################################ pkits ################################# 150 # local shell function for positive testcases, calls vfychain, writes 151 # action and options to stdout, sets variable RET and writes results to 152 # the html file results 153 ######################################################################## 154 pkits() 155 { 156 echo "vfychain -d $PKITSdb -u 4 $*" 157 ${BINDIR}/vfychain -d $PKITSdb -u 4 $* > ${PKITSDIR}/cmdout.txt 2>&1 158 RET=$? 159 CNT=`grep -c ERROR ${PKITSDIR}/cmdout.txt` 160 RET=`expr ${RET} + ${CNT}` 161 cat ${PKITSDIR}/cmdout.txt 162 163 if [ "$RET" -ne 0 ]; then 164 html_failed "${VFY_ACTION} ($RET) " 165 pkits_log "ERROR: ${VFY_ACTION} failed $RET" 166 else 167 html_passed "${VFY_ACTION}" 168 pkits_log "SUCCESS: ${VFY_ACTION} returned as expected $RET" 169 fi 170 171 return $RET 172 } 173 174 ################################ pkitsn ################################# 175 # local shell function for negative testcases, calls vfychain, writes 176 # action and options to stdout, sets variable RET and writes results to 177 # the html file results 178 ######################################################################## 179 pkitsn() 180 { 181 echo "vfychain -d $PKITSdb -u 4 $*" 182 ${BINDIR}/vfychain -d $PKITSdb -u 4 $* > ${PKITSDIR}/cmdout.txt 2>&1 183 RET=$? 184 CNT=`grep -c ERROR ${PKITSDIR}/cmdout.txt` 185 RET=`expr ${RET} + ${CNT}` 186 cat ${PKITSDIR}/cmdout.txt 187 188 if [ "$RET" -eq 0 ]; then 189 html_failed "${VFY_ACTION} ($RET) " 190 pkits_log "ERROR: ${VFY_ACTION} failed $RET" 191 else 192 html_passed "${VFY_ACTION} ($RET) " 193 pkits_log "SUCCESS: ${VFY_ACTION} returned as expected $RET" 194 fi 195 return $RET 196 } 197 198 ################################ crlImport ############################# 199 # local shell function to import a CRL, calls crlutil -I -i, writes 200 # action and options to stdout 201 ######################################################################## 202 crlImport() 203 { 204 if [ -z "$NSS_NO_PKITS_CRLS" ]; then 205 echo "crlutil -d $PKITSdb -I -f ${PKITSdb}/pw -i $crls/$*" 206 ${BINDIR}/crlutil -d ${PKITSdb} -I -f ${PKITSdb}/pw -i $crls/$* > ${PKITSDIR}/cmdout.txt 2>&1 207 RET=$? 208 cat ${PKITSDIR}/cmdout.txt 209 210 if [ "$RET" -ne 0 ]; then 211 html_failed "${VFY_ACTION} ($RET) " 212 pkits_log "ERROR: ${VFY_ACTION} failed $RET" 213 fi 214 fi 215 } 216 217 ################################ crlImportn ############################# 218 # local shell function to import an incorrect CRL, calls crlutil -I -i, 219 # writes action and options to stdout 220 ######################################################################## 221 crlImportn() 222 { 223 RET=0 224 if [ -z "$NSS_NO_PKITS_CRLS" ]; then 225 echo "crlutil -d $PKITSdb -I -f ${PKITSdb}/pw -i $crls/$*" 226 ${BINDIR}/crlutil -d ${PKITSdb} -I -f ${PKITSdb}/pw -i $crls/$* > ${PKITSDIR}/cmdout.txt 2>&1 227 RET=$? 228 cat ${PKITSDIR}/cmdout.txt 229 230 if [ "$RET" -eq 0 ]; then 231 html_failed "${VFY_ACTION} ($RET) " 232 pkits_log "ERROR: ${VFY_ACTION} failed $RET" 233 else 234 html_passed "${VFY_ACTION} ($RET) " 235 pkits_log "SUCCESS: ${VFY_ACTION} returned as expected $RET" 236 fi 237 fi 238 return $RET 239 } 240 241 ################################ certImport ############################# 242 # local shell function to import a Cert, calls certutil -A, writes 243 # action and options to stdout 244 ######################################################################## 245 certImport() 246 { 247 echo "certutil -d $PKITSdb -A -t \",,\" -n $* -i $certs/$*.crt" 248 ${BINDIR}/certutil -d $PKITSdb -A -t ",," -n $* -i $certs/$*.crt > ${PKITSDIR}/cmdout.txt 2>&1 249 RET=$? 250 cat ${PKITSDIR}/cmdout.txt 251 252 if [ "$RET" -ne 0 ]; then 253 html_failed "${VFY_ACTION} ($RET) " 254 pkits_log "ERROR: ${VFY_ACTION} failed $RET" 255 fi 256 } 257 258 ################################ certImportn ############################# 259 # local shell function to import an incorrect Cert, calls certutil -A, 260 # writes action and options to stdout 261 ######################################################################## 262 certImportn() 263 { 264 RET=0 265 if [ -z "$NSS_NO_PKITS_CRLS" ]; then 266 echo "certutil -d $PKITSdb -A -t \",,\" -n $* -i $certs/$*.crt" 267 ${BINDIR}/certutil -d $PKITSdb -A -t ",," -n $* -i $certs/$*.crt > ${PKITSDIR}/cmdout.txt 2>&1 268 RET=$? 269 cat ${PKITSDIR}/cmdout.txt 270 271 if [ "$RET" -eq 0 ]; then 272 html_failed "${VFY_ACTION} ($RET) " 273 pkits_log "ERROR: ${VFY_ACTION} failed $RET" 274 else 275 html_passed "${VFY_ACTION} ($RET) " 276 pkits_log "SUCCESS: ${VFY_ACTION} returned as expected $RET" 277 fi 278 fi 279 } 280 281 ############################## pkits_tests_bySection ################### 282 # running the various PKITS tests 283 ######################################################################## 284 pkits_SignatureVerification() 285 { 286 start_table "NIST PKITS Section 4.1: Signature Verification" 287 288 VFY_ACTION="Valid Signatures Test1"; log_banner 289 certImport GoodCACert 290 crlImport GoodCACRL.crl 291 pkits $certs/ValidCertificatePathTest1EE.crt $certs/GoodCACert.crt 292 restore_db 293 294 VFY_ACTION="Invalid CA Signature Test2"; log_banner 295 certImport BadSignedCACert 296 crlImport BadSignedCACRL.crl 297 pkitsn $certs/InvalidCASignatureTest2EE.crt \ 298 $certs/BadSignedCACert.crt 299 restore_db 300 301 VFY_ACTION="Invalid EE Signature Test3"; log_banner 302 certImport GoodCACert 303 crlImport GoodCACRL.crl 304 pkitsn $certs/InvalidEESignatureTest3EE.crt $certs/GoodCACert.crt 305 restore_db 306 307 VFY_ACTION="Valid DSA Signatures Test4"; log_banner 308 certImport DSACACert 309 crlImport DSACACRL.crl 310 pkits $certs/ValidDSASignaturesTest4EE.crt $certs/DSACACert.crt 311 restore_db 312 313 # NSS doesn't support DSA parameter inheritance anymore (see bug 671097) 314 # VFY_ACTION="Valid DSA Parameter Inheritance Test5"; log_banner 315 # certImport DSACACert 316 # crlImport DSACACRL.crl 317 # certImport DSAParametersInheritedCACert 318 # crlImport DSAParametersInheritedCACRL.crl 319 # pkits $certs/ValidDSAParameterInheritanceTest5EE.crt \ 320 # $certs/DSAParametersInheritedCACert.crt \ 321 # $certs/DSACACert.crt 322 # restore_db 323 324 VFY_ACTION="Invalid DSA Signature Test6"; log_banner 325 certImport DSACACert 326 crlImport DSACACRL.crl 327 pkitsn $certs/InvalidDSASignatureTest6EE.crt $certs/DSACACert.crt 328 restore_db 329 } 330 331 pkits_ValidityPeriods() 332 { 333 break_table "NIST PKITS Section 4.2: Validity Periods" 334 335 VFY_ACTION="Invalid CA notBefore Date Test1"; log_banner 336 certImport BadnotBeforeDateCACert 337 crlImportn BadnotBeforeDateCACRL.crl 338 if [ $RET -eq 0 ] ; then 339 pkitsn $certs/InvalidCAnotBeforeDateTest1EE.crt \ 340 $certs/BadnotBeforeDateCACert.crt 341 fi 342 restore_db 343 344 VFY_ACTION="Invalid EE notBefore Date Test2"; log_banner 345 certImport GoodCACert 346 crlImport GoodCACRL.crl 347 pkitsn $certs/InvalidEEnotBeforeDateTest2EE.crt \ 348 $certs/GoodCACert.crt 349 restore_db 350 351 VFY_ACTION="Valid pre2000 UTC notBefore Date Test3"; log_banner 352 certImport GoodCACert 353 crlImport GoodCACRL.crl 354 pkits $certs/Validpre2000UTCnotBeforeDateTest3EE.crt \ 355 $certs/GoodCACert.crt 356 restore_db 357 358 VFY_ACTION="Valid GeneralizedTime notBefore Date Test4"; log_banner 359 certImport GoodCACert 360 crlImport GoodCACRL.crl 361 pkits $certs/ValidGeneralizedTimenotBeforeDateTest4EE.crt \ 362 $certs/GoodCACert.crt 363 restore_db 364 365 VFY_ACTION="Invalid CA notAfter Date Test5"; log_banner 366 certImport BadnotAfterDateCACert 367 crlImportn BadnotAfterDateCACRL.crl 368 if [ $RET -eq 0 ] ; then 369 pkitsn $certs/InvalidCAnotAfterDateTest5EE.crt \ 370 $certs/BadnotAfterDateCACert.crt 371 fi 372 restore_db 373 374 VFY_ACTION="Invalid EE notAfter Date Test6"; log_banner 375 certImport GoodCACert 376 crlImport GoodCACRL.crl 377 pkitsn $certs/InvalidEEnotAfterDateTest6EE.crt \ 378 $certs/GoodCACert.crt 379 restore_db 380 381 VFY_ACTION="Invalid pre2000 UTC EE notAfter Date Test7"; log_banner 382 certImport GoodCACert 383 crlImport GoodCACRL.crl 384 pkitsn $certs/Invalidpre2000UTCEEnotAfterDateTest7EE.crt \ 385 $certs/GoodCACert.crt 386 restore_db 387 388 VFY_ACTION="ValidGeneralizedTime notAfter Date Test8"; log_banner 389 certImport GoodCACert 390 crlImport GoodCACRL.crl 391 pkits $certs/ValidGeneralizedTimenotAfterDateTest8EE.crt \ 392 $certs/GoodCACert.crt 393 restore_db 394 } 395 396 pkits_NameChaining() 397 { 398 break_table "NIST PKITS Section 4.3: Verifying NameChaining" 399 400 VFY_ACTION="Invalid Name Chaining EE Test1"; log_banner 401 certImport GoodCACert 402 crlImport GoodCACRL.crl 403 pkitsn $certs/InvalidNameChainingTest1EE.crt \ 404 $certs/GoodCACert.crt 405 restore_db 406 407 VFY_ACTION="Invalid Name Chaining Order Test2"; log_banner 408 certImport NameOrderingCACert 409 crlImport NameOrderCACRL.crl 410 pkitsn $certs/InvalidNameChainingOrderTest2EE.crt \ 411 $certs/NameOrderingCACert.crt 412 restore_db 413 414 ### bug 216123 ### 415 if [ -n "${KNOWN_BUG}" ]; then 416 VFY_ACTION="Valid Name Chaining Whitespace Test3"; log_banner 417 certImport GoodCACert 418 crlImport GoodCACRL.crl 419 pkits $certs/ValidNameChainingWhitespaceTest3EE.crt \ 420 $certs/GoodCACert.crt 421 restore_db 422 423 VFY_ACTION="Valid Name Chaining Whitespace Test4"; log_banner 424 certImport GoodCACert 425 crlImport GoodCACRL.crl 426 pkits $certs/ValidNameChainingWhitespaceTest4EE.crt \ 427 $certs/GoodCACert.crt 428 restore_db 429 430 VFY_ACTION="Valid Name Chaining Capitalization Test5"; log_banner 431 certImport GoodCACert 432 crlImport GoodCACRL.crl 433 pkits $certs/ValidNameChainingCapitalizationTest5EE.crt \ 434 $certs/GoodCACert.crt 435 restore_db 436 fi 437 438 VFY_ACTION="Valid Name Chaining UIDs Test6"; log_banner 439 certImport UIDCACert 440 crlImport UIDCACRL.crl 441 pkits $certs/ValidNameUIDsTest6EE.crt $certs/UIDCACert.crt 442 restore_db 443 444 VFY_ACTION="Valid RFC3280 Mandatory Attribute Types Test7"; log_banner 445 certImport RFC3280MandatoryAttributeTypesCACert 446 crlImport RFC3280MandatoryAttributeTypesCACRL.crl 447 pkits $certs/ValidRFC3280MandatoryAttributeTypesTest7EE.crt \ 448 $certs/RFC3280MandatoryAttributeTypesCACert.crt 449 restore_db 450 451 VFY_ACTION="Valid RFC3280 Optional Attribute Types Test8"; log_banner 452 certImport RFC3280OptionalAttributeTypesCACert 453 crlImport RFC3280OptionalAttributeTypesCACRL.crl 454 pkits $certs/ValidRFC3280OptionalAttributeTypesTest8EE.crt \ 455 $certs/RFC3280OptionalAttributeTypesCACert.crt 456 restore_db 457 458 VFY_ACTION="Valid UTF8String Encoded Names Test9"; log_banner 459 certImport UTF8StringEncodedNamesCACert 460 crlImport UTF8StringEncodedNamesCACRL.crl 461 pkits $certs/ValidUTF8StringEncodedNamesTest9EE.crt \ 462 $certs/UTF8StringEncodedNamesCACert.crt 463 restore_db 464 465 ### bug 216123 ### 466 if [ -n "${KNOWN_BUG}" ]; then 467 VFY_ACTION="Valid Rollover from PrintableString to UTF8String Test10"; log_banner 468 certImport RolloverfromPrintableStringtoUTF8StringCACert 469 crlImport RolloverfromPrintableStringtoUTF8StringCACRL.crl 470 pkits $certs/ValidRolloverfromPrintableStringtoUTF8StringTest10EE.crt \ 471 $certs/RolloverfromPrintableStringtoUTF8StringCACert.crt 472 restore_db 473 474 VFY_ACTION="Valid UTF8String case Insensitive Match Test11"; log_banner 475 certImport UTF8StringCaseInsensitiveMatchCACert 476 crlImport UTF8StringCaseInsensitiveMatchCACRL.crl 477 pkits $certs/ValidUTF8StringCaseInsensitiveMatchTest11EE.crt \ 478 $certs/UTF8StringCaseInsensitiveMatchCACert.crt 479 restore_db 480 fi 481 } 482 483 pkits_BasicCertRevocation() 484 { 485 break_table "NIST PKITS Section 4.4: Basic Certificate Revocation Tests" 486 487 ### bug 414556 ### 488 if [ -n "${KNOWN_BUG}" ]; then 489 VFY_ACTION="Missing CRL Test1"; log_banner 490 pkitsn $certs/InvalidMissingCRLTest1EE.crt \ 491 $certs/NoCRLCACert.crt 492 fi 493 494 VFY_ACTION="Invalid Revoked CA Test2"; log_banner 495 certImport RevokedsubCACert 496 crlImport RevokedsubCACRL.crl 497 certImport GoodCACert 498 crlImport GoodCACRL.crl 499 pkitsn $certs/InvalidRevokedCATest2EE.crt \ 500 $certs/RevokedsubCACert.crt $certs/GoodCACert.crt 501 restore_db 502 503 VFY_ACTION="Invalid Revoked EE Test3"; log_banner 504 certImport GoodCACert 505 crlImport GoodCACRL.crl 506 pkitsn $certs/InvalidRevokedEETest3EE.crt \ 507 $certs/GoodCACert.crt 508 restore_db 509 510 VFY_ACTION="Invalid Bad CRL Signature Test4"; log_banner 511 certImport BadCRLSignatureCACert 512 crlImportn BadCRLSignatureCACRL.crl 513 if [ $RET -eq 0 ] ; then 514 pkitsn $certs/InvalidBadCRLSignatureTest4EE.crt \ 515 $certs/BadCRLSignatureCACert.crt 516 fi 517 restore_db 518 519 VFY_ACTION="Invalid Bad CRL Issuer Name Test5"; log_banner 520 certImport BadCRLIssuerNameCACert 521 crlImportn BadCRLIssuerNameCACRL.crl 522 if [ $RET -eq 0 ] ; then 523 pkitsn $certs/InvalidBadCRLIssuerNameTest5EE.crt \ 524 $certs/BadCRLIssuerNameCACert.crt 525 fi 526 restore_db 527 528 ### bug 414556 ### 529 if [ -n "${KNOWN_BUG}" ]; then 530 VFY_ACTION="Invalid Wrong CRL Test6"; log_banner 531 certImport WrongCRLCACert 532 crlImport WrongCRLCACRL.crl 533 pkitsn $certs/InvalidWrongCRLTest6EE.crt \ 534 $certs/WrongCRLCACert.crt 535 restore_db 536 fi 537 538 VFY_ACTION="Valid Two CRLs Test7"; log_banner 539 certImport TwoCRLsCACert 540 crlImport TwoCRLsCAGoodCRL.crl 541 crlImportn TwoCRLsCABadCRL.crl 542 pkits $certs/ValidTwoCRLsTest7EE.crt \ 543 $certs/TwoCRLsCACert.crt 544 restore_db 545 546 VFY_ACTION="Invalid Unknown CRL Entry Extension Test8"; log_banner 547 certImport UnknownCRLEntryExtensionCACert 548 crlImportn UnknownCRLEntryExtensionCACRL.crl 549 if [ $RET -eq 0 ] ; then 550 pkitsn $certs/InvalidUnknownCRLEntryExtensionTest8EE.crt \ 551 $certs/UnknownCRLEntryExtensionCACert.crt 552 fi 553 restore_db 554 555 VFY_ACTION="Invalid Unknown CRL Extension Test9"; log_banner 556 certImport UnknownCRLExtensionCACert 557 crlImportn UnknownCRLExtensionCACRL.crl 558 if [ $RET -eq 0 ] ; then 559 pkitsn $certs/InvalidUnknownCRLExtensionTest9EE.crt \ 560 $certs/UnknownCRLExtensionCACert.crt 561 fi 562 restore_db 563 564 VFY_ACTION="Invalid Unknown CRL Extension Test10"; log_banner 565 certImport UnknownCRLExtensionCACert 566 crlImportn UnknownCRLExtensionCACRL.crl 567 if [ $RET -eq 0 ] ; then 568 pkitsn $certs/InvalidUnknownCRLExtensionTest10EE.crt \ 569 $certs/UnknownCRLExtensionCACert.crt 570 fi 571 restore_db 572 573 ### bug 414563 ### 574 if [ -n "${KNOWN_BUG}" ]; then 575 VFY_ACTION="Invalid Old CRL nextUpdate Test11"; log_banner 576 certImport OldCRLnextUpdateCACert 577 crlImport OldCRLnextUpdateCACRL.crl 578 pkitsn $certs/InvalidOldCRLnextUpdateTest11EE.crt \ 579 $certs/OldCRLnextUpdateCACert.crt 580 restore_db 581 582 VFY_ACTION="Invalid pre2000 CRL nextUpdate Test12"; log_banner 583 certImport pre2000CRLnextUpdateCACert 584 crlImport pre2000CRLnextUpdateCACRL.crl 585 pkitsn $certs/Invalidpre2000CRLnextUpdateTest12EE.crt \ 586 $certs/pre2000CRLnextUpdateCACert.crt 587 restore_db 588 fi 589 590 VFY_ACTION="Valid GeneralizedTime CRL nextUpdate Test13"; log_banner 591 certImport GeneralizedTimeCRLnextUpdateCACert 592 crlImport GeneralizedTimeCRLnextUpdateCACRL.crl 593 pkits $certs/ValidGeneralizedTimeCRLnextUpdateTest13EE.crt \ 594 $certs/GeneralizedTimeCRLnextUpdateCACert.crt 595 restore_db 596 597 VFY_ACTION="Valid Negative Serial Number Test14"; log_banner 598 certImport NegativeSerialNumberCACert 599 crlImport NegativeSerialNumberCACRL.crl 600 pkits $certs/ValidNegativeSerialNumberTest14EE.crt \ 601 $certs/NegativeSerialNumberCACert.crt 602 restore_db 603 604 VFY_ACTION="Invalid Negative Serial Number Test15"; log_banner 605 certImport NegativeSerialNumberCACert 606 crlImport NegativeSerialNumberCACRL.crl 607 pkitsn $certs/InvalidNegativeSerialNumberTest15EE.crt \ 608 $certs/NegativeSerialNumberCACert.crt 609 restore_db 610 611 VFY_ACTION="Valid Long Serial Number Test16"; log_banner 612 certImport LongSerialNumberCACert 613 crlImport LongSerialNumberCACRL.crl 614 pkits $certs/ValidLongSerialNumberTest16EE.crt \ 615 $certs/LongSerialNumberCACert.crt 616 restore_db 617 618 VFY_ACTION="Valid Long Serial Number Test17"; log_banner 619 certImport LongSerialNumberCACert 620 crlImport LongSerialNumberCACRL.crl 621 pkits $certs/ValidLongSerialNumberTest17EE.crt \ 622 $certs/LongSerialNumberCACert.crt 623 restore_db 624 625 VFY_ACTION="Invalid Long Serial Number Test18"; log_banner 626 certImport LongSerialNumberCACert 627 crlImport LongSerialNumberCACRL.crl 628 pkitsn $certs/InvalidLongSerialNumberTest18EE.crt \ 629 $certs/LongSerialNumberCACert.crt 630 restore_db 631 632 ### bug 232737 ### 633 if [ -n "${KNOWN_BUG}" ]; then 634 VFY_ACTION="Valid Separate Certificate and CRL Keys Test19"; log_banner 635 certImport SeparateCertificateandCRLKeysCertificateSigningCACert 636 certImport SeparateCertificateandCRLKeysCRLSigningCert 637 crlImport SeparateCertificateandCRLKeysCRL.crl 638 pkits $certs/ValidSeparateCertificateandCRLKeysTest19EE.crt \ 639 $certs/SeparateCertificateandCRLKeysCRLSigningCert.crt 640 restore_db 641 642 VFY_ACTION="Invalid Separate Certificate and CRL Keys Test20"; log_banner 643 certImport SeparateCertificateandCRLKeysCertificateSigningCACert 644 certImport SeparateCertificateandCRLKeysCRLSigningCert 645 crlImport SeparateCertificateandCRLKeysCRL.crl 646 pkits $certs/InvalidSeparateCertificateandCRLKeysTest20EE.crt \ 647 $certs/SeparateCertificateandCRLKeysCRLSigningCert.crt 648 restore_db 649 650 VFY_ACTION="Invalid Separate Certificate and CRL Keys Test21"; log_banner 651 certImport SeparateCertificateandCRLKeysCA2CertificateSigningCACert 652 certImport SeparateCertificateandCRLKeysCA2CRLSigningCert 653 crlImport SeparateCertificateandCRLKeysCA2CRL.crl 654 pkits $certs/InvalidSeparateCertificateandCRLKeysTest21EE.crt \ 655 $certs/SeparateCertificateandCRLKeysCA2CRLSigningCert.crt 656 restore_db 657 fi 658 } 659 660 pkits_PathVerificWithSelfIssuedCerts() 661 { 662 break_table "NIST PKITS Section 4.5: Self-Issued Certificates" 663 664 ### bug 232737 ### 665 if [ -n "${KNOWN_BUG}" ]; then 666 VFY_ACTION="Valid Basic Self-Issued Old With New Test1"; log_banner 667 certImport BasicSelfIssuedNewKeyCACert 668 crlImport BasicSelfIssuedNewKeyCACRL.crl 669 pkits $certs/ValidBasicSelfIssuedOldWithNewTest1EE.crt \ 670 $certs/BasicSelfIssuedNewKeyOldWithNewCACert.crt \ 671 $certs/BasicSelfIssuedNewKeyCACert.crt 672 restore_db 673 674 VFY_ACTION="Invalid Basic Self-Issued Old With New Test2"; log_banner 675 certImport BasicSelfIssuedNewKeyCACert 676 crlImport BasicSelfIssuedNewKeyCACRL.crl 677 pkitsn $certs/InvalidBasicSelfIssuedOldWithNewTest2EE.crt \ 678 $certs/BasicSelfIssuedNewKeyOldWithNewCACert.crt \ 679 $certs/BasicSelfIssuedNewKeyCACert.crt 680 restore_db 681 fi 682 683 ### bugs 321755 & 418769 ### 684 if [ -n "${KNOWN_BUG}" ]; then 685 VFY_ACTION="Valid Basic Self-Issued New With Old Test3"; log_banner 686 certImport BasicSelfIssuedOldKeyCACert 687 crlImport BasicSelfIssuedOldKeyCACRL.crl 688 pkits $certs/ValidBasicSelfIssuedNewWithOldTest3EE.crt \ 689 $certs/BasicSelfIssuedOldKeyNewWithOldCACert.crt \ 690 $certs/BasicSelfIssuedOldKeyCACert.crt 691 restore_db 692 693 VFY_ACTION="Valid Basic Self-Issued New With Old Test4"; log_banner 694 certImport BasicSelfIssuedOldKeyCACert 695 crlImport BasicSelfIssuedOldKeyCACRL.crl 696 pkits $certs/ValidBasicSelfIssuedNewWithOldTest4EE.crt \ 697 $certs/BasicSelfIssuedOldKeyNewWithOldCACert.crt \ 698 $certs/BasicSelfIssuedOldKeyCACert.crt 699 restore_db 700 701 VFY_ACTION="Invalid Basic Self-Issued New With Old Test5"; log_banner 702 certImport BasicSelfIssuedOldKeyCACert 703 crlImport BasicSelfIssuedOldKeyCACRL.crl 704 pkitsn $certs/InvalidBasicSelfIssuedNewWithOldTest5EE.crt \ 705 $certs/BasicSelfIssuedOldKeyNewWithOldCACert.crt \ 706 $certs/BasicSelfIssuedOldKeyCACert.crt 707 restore_db 708 709 VFY_ACTION="Valid Basic Self-Issued CRL Signing Key Test6"; log_banner 710 certImport BasicSelfIssuedCRLSigningKeyCACert 711 crlImport BasicSelfIssuedOldKeyCACRL.crl 712 pkits $certs/ValidBasicSelfIssuedCRLSigningKeyTest6EE.crt \ 713 $certs/BasicSelfIssuedCRLSigningKeyCRLCert.crt \ 714 $certs/BasicSelfIssuedCRLSigningKeyCACert.crt 715 restore_db 716 717 VFY_ACTION="Invalid Basic Self-Issued CRL Signing Key Test7"; log_banner 718 certImport BasicSelfIssuedCRLSigningKeyCACert 719 crlImport BasicSelfIssuedOldKeyCACRL.crl 720 pkitsn $certs/InvalidBasicSelfIssuedCRLSigningKeyTest7EE.crt \ 721 $certs/BasicSelfIssuedCRLSigningKeyCRLCert.crt \ 722 $certs/BasicSelfIssuedCRLSigningKeyCACert.crt 723 restore_db 724 725 VFY_ACTION="Invalid Basic Self-Issued CRL Signing Key Test8"; log_banner 726 certImport BasicSelfIssuedCRLSigningKeyCACert 727 crlImport BasicSelfIssuedOldKeyCACRL.crl 728 pkitsn $certs/InvalidBasicSelfIssuedCRLSigningKeyTest8EE.crt \ 729 $certs/BasicSelfIssuedCRLSigningKeyCRLCert.crt \ 730 $certs/BasicSelfIssuedCRLSigningKeyCACert.crt 731 restore_db 732 fi 733 } 734 735 pkits_BasicConstraints() 736 { 737 break_table "NIST PKITS Section 4.6: Verifying Basic Constraints" 738 739 VFY_ACTION="Invalid Missing basicConstraints Test1"; log_banner 740 certImport MissingbasicConstraintsCACert 741 crlImport MissingbasicConstraintsCACRL.crl 742 pkitsn $certs/InvalidMissingbasicConstraintsTest1EE.crt \ 743 $certs/MissingbasicConstraintsCACert.crt 744 restore_db 745 746 VFY_ACTION="Invalid cA False Test2"; log_banner 747 certImport basicConstraintsCriticalcAFalseCACert 748 crlImport basicConstraintsCriticalcAFalseCACRL.crl 749 pkitsn $certs/InvalidcAFalseTest2EE.crt \ 750 $certs/basicConstraintsCriticalcAFalseCACert.crt 751 restore_db 752 753 VFY_ACTION="Invalid cA False Test3"; log_banner 754 certImport basicConstraintsNotCriticalcAFalseCACert 755 crlImport basicConstraintsNotCriticalcAFalseCACRL.crl 756 pkitsn $certs/InvalidcAFalseTest3EE.crt \ 757 $certs/basicConstraintsNotCriticalcAFalseCACert.crt 758 restore_db 759 760 VFY_ACTION="Valid basicConstraints Not Critical Test4"; log_banner 761 certImport basicConstraintsNotCriticalCACert 762 crlImport basicConstraintsNotCriticalCACRL.crl 763 pkits $certs/ValidbasicConstraintsNotCriticalTest4EE.crt \ 764 $certs/basicConstraintsNotCriticalCACert.crt 765 restore_db 766 767 VFY_ACTION="Invalid pathLenConstraint Test5"; log_banner 768 certImport pathLenConstraint0CACert 769 crlImport pathLenConstraint0CACRL.crl 770 certImport pathLenConstraint0subCACert 771 crlImport pathLenConstraint0subCACRL.crl 772 pkitsn $certs/InvalidpathLenConstraintTest5EE.crt \ 773 $certs/pathLenConstraint0subCACert.crt \ 774 $certs/pathLenConstraint0CACert.crt 775 restore_db 776 777 VFY_ACTION="Invalid pathLenConstraint Test6"; log_banner 778 certImport pathLenConstraint0CACert 779 crlImport pathLenConstraint0CACRL.crl 780 certImport pathLenConstraint0subCACert 781 crlImport pathLenConstraint0subCACRL.crl 782 pkitsn $certs/InvalidpathLenConstraintTest6EE.crt \ 783 $certs/pathLenConstraint0subCACert.crt \ 784 $certs/pathLenConstraint0CACert.crt 785 restore_db 786 787 VFY_ACTION="Valid pathLenConstraint Test7"; log_banner 788 certImport pathLenConstraint0CACert 789 crlImport pathLenConstraint0CACRL.crl 790 pkits $certs/ValidpathLenConstraintTest7EE.crt \ 791 $certs/pathLenConstraint0CACert.crt 792 restore_db 793 794 VFY_ACTION="Valid pathLenConstraint test8"; log_banner 795 certImport pathLenConstraint0CACert 796 crlImport pathLenConstraint0CACRL.crl 797 pkits $certs/ValidpathLenConstraintTest8EE.crt \ 798 $certs/pathLenConstraint0CACert.crt 799 restore_db 800 801 VFY_ACTION="Invalid pathLenConstraint Test9"; log_banner 802 certImport pathLenConstraint6CACert 803 crlImport pathLenConstraint6CACRL.crl 804 certImport pathLenConstraint6subCA0Cert 805 crlImport pathLenConstraint6subCA0CRL.crl 806 certImport pathLenConstraint6subsubCA00Cert 807 crlImport pathLenConstraint6subsubCA00CRL.crl 808 pkitsn $certs/InvalidpathLenConstraintTest9EE.crt \ 809 $certs/pathLenConstraint6subsubCA00Cert.crt \ 810 $certs/pathLenConstraint6subCA0Cert.crt \ 811 $certs/pathLenConstraint6CACert.crt 812 restore_db 813 814 VFY_ACTION="Invalid pathLenConstraint Test10"; log_banner 815 certImport pathLenConstraint6CACert 816 crlImport pathLenConstraint6CACRL.crl 817 certImport pathLenConstraint6subCA0Cert 818 crlImport pathLenConstraint6subCA0CRL.crl 819 certImport pathLenConstraint6subsubCA00Cert 820 crlImport pathLenConstraint6subsubCA00CRL.crl 821 pkitsn $certs/InvalidpathLenConstraintTest10EE.crt \ 822 $certs/pathLenConstraint6subsubCA00Cert.crt \ 823 $certs/pathLenConstraint6subCA0Cert.crt \ 824 $certs/pathLenConstraint6CACert.crt 825 restore_db 826 827 VFY_ACTION="Invalid pathLenConstraint Test11"; log_banner 828 certImport pathLenConstraint6CACert 829 crlImport pathLenConstraint6CACRL.crl 830 certImport pathLenConstraint6subCA1Cert 831 crlImport pathLenConstraint6subCA1CRL.crl 832 certImport pathLenConstraint6subsubCA11Cert 833 crlImport pathLenConstraint6subsubCA11CRL.crl 834 certImport pathLenConstraint6subsubsubCA11XCert 835 crlImport pathLenConstraint6subsubsubCA11XCRL.crl 836 pkitsn $certs/InvalidpathLenConstraintTest11EE.crt \ 837 $certs/pathLenConstraint6subsubsubCA11XCert.crt \ 838 $certs/pathLenConstraint6subsubCA11Cert.crt \ 839 $certs/pathLenConstraint6subCA1Cert.crt \ 840 $certs/pathLenConstraint6CACert.crt 841 restore_db 842 843 VFY_ACTION="Invalid pathLenConstraint test12"; log_banner 844 certImport pathLenConstraint6CACert 845 crlImport pathLenConstraint6CACRL.crl 846 certImport pathLenConstraint6subCA1Cert 847 crlImport pathLenConstraint6subCA1CRL.crl 848 certImport pathLenConstraint6subsubCA11Cert 849 crlImport pathLenConstraint6subsubCA11CRL.crl 850 certImport pathLenConstraint6subsubsubCA11XCert 851 crlImport pathLenConstraint6subsubsubCA11XCRL.crl 852 pkitsn $certs/InvalidpathLenConstraintTest12EE.crt \ 853 $certs/pathLenConstraint6subsubsubCA11XCert.crt \ 854 $certs/pathLenConstraint6subsubCA11Cert.crt \ 855 $certs/pathLenConstraint6subCA1Cert.crt \ 856 $certs/pathLenConstraint6CACert.crt 857 restore_db 858 859 VFY_ACTION="Valid pathLenConstraint Test13"; log_banner 860 certImport pathLenConstraint6CACert 861 crlImport pathLenConstraint6CACRL.crl 862 certImport pathLenConstraint6subCA4Cert 863 crlImport pathLenConstraint6subCA4CRL.crl 864 certImport pathLenConstraint6subsubCA41Cert 865 crlImport pathLenConstraint6subsubCA41CRL.crl 866 certImport pathLenConstraint6subsubsubCA41XCert 867 crlImport pathLenConstraint6subsubsubCA41XCRL.crl 868 pkits $certs/ValidpathLenConstraintTest13EE.crt \ 869 $certs/pathLenConstraint6subsubsubCA41XCert.crt \ 870 $certs/pathLenConstraint6subsubCA41Cert.crt \ 871 $certs/pathLenConstraint6subCA4Cert.crt \ 872 $certs/pathLenConstraint6CACert.crt 873 restore_db 874 875 VFY_ACTION="Valid pathLenConstraint Test14"; log_banner 876 certImport pathLenConstraint6CACert 877 crlImport pathLenConstraint6CACRL.crl 878 certImport pathLenConstraint6subCA4Cert 879 crlImport pathLenConstraint6subCA4CRL.crl 880 certImport pathLenConstraint6subsubCA41Cert 881 crlImport pathLenConstraint6subsubCA41CRL.crl 882 certImport pathLenConstraint6subsubsubCA41XCert 883 crlImport pathLenConstraint6subsubsubCA41XCRL.crl 884 pkits $certs/ValidpathLenConstraintTest14EE.crt \ 885 $certs/pathLenConstraint6subsubsubCA41XCert.crt \ 886 $certs/pathLenConstraint6subsubCA41Cert.crt \ 887 $certs/pathLenConstraint6subCA4Cert.crt \ 888 $certs/pathLenConstraint6CACert.crt 889 restore_db 890 891 ### bug 232737 ### 892 if [ -n "${KNOWN_BUG}" ]; then 893 VFY_ACTION="Valid Self-Issued pathLenConstraint Test15"; log_banner 894 certImport pathLenConstraint0CACert 895 crlImport pathLenConstraint0CACRL.crl 896 pkits $certs/ValidSelfIssuedpathLenConstraintTest15EE.crt \ 897 $certs/pathLenConstraint0SelfIssuedCACert.crt \ 898 $certs/pathLenConstraint0CACert.crt 899 restore_db 900 fi 901 902 VFY_ACTION="Invalid Self-Issued pathLenConstraint Test16"; log_banner 903 certImport pathLenConstraint0CACert 904 crlImport pathLenConstraint0CACRL.crl 905 certImport pathLenConstraint0subCA2Cert 906 crlImport pathLenConstraint0subCA2CRL.crl 907 pkitsn $certs/InvalidSelfIssuedpathLenConstraintTest16EE.crt \ 908 $certs/pathLenConstraint0subCA2Cert.crt \ 909 $certs/pathLenConstraint0SelfIssuedCACert.crt \ 910 $certs/pathLenConstraint0CACert.crt 911 restore_db 912 913 ### bug 232737 ### 914 if [ -n "${KNOWN_BUG}" ]; then 915 VFY_ACTION="Valid Self-Issued pathLenConstraint Test17"; log_banner 916 certImport pathLenConstraint1CACert 917 crlImport pathLenConstraint1CACRL.crl 918 certImport pathLenConstraint1subCACert 919 crlImport pathLenConstraint1subCACRL.crl 920 pkits $certs/ValidSelfIssuedpathLenConstraintTest17EE.crt \ 921 $certs/pathLenConstraint1SelfIssuedsubCACert.crt \ 922 $certs/pathLenConstraint1subCACert.crt \ 923 $certs/pathLenConstraint1SelfIssuedCACert.crt \ 924 $certs/pathLenConstraint1CACert.crt 925 restore_db 926 fi 927 } 928 929 pkits_KeyUsage() 930 { 931 break_table "NIST PKITS Section 4.7: Key Usage" 932 933 VFY_ACTION="Invalid keyUsage Critical keyCertSign False Test1"; log_banner 934 certImport keyUsageCriticalkeyCertSignFalseCACert 935 crlImport keyUsageCriticalkeyCertSignFalseCACRL.crl 936 pkitsn $certs/InvalidkeyUsageCriticalkeyCertSignFalseTest1EE.crt \ 937 $certs/keyUsageCriticalkeyCertSignFalseCACert.crt 938 restore_db 939 940 VFY_ACTION="Invalid keyUsage Not Critical keyCertSign False Test2"; log_banner 941 certImport keyUsageNotCriticalkeyCertSignFalseCACert 942 crlImport keyUsageNotCriticalkeyCertSignFalseCACRL.crl 943 pkitsn $certs/InvalidkeyUsageNotCriticalkeyCertSignFalseTest2EE.crt \ 944 $certs/keyUsageNotCriticalkeyCertSignFalseCACert.crt 945 restore_db 946 947 VFY_ACTION="Valid keyUsage Not Critical Test3"; log_banner 948 certImport keyUsageNotCriticalCACert 949 crlImport keyUsageNotCriticalCACRL.crl 950 pkits $certs/ValidkeyUsageNotCriticalTest3EE.crt \ 951 $certs/keyUsageNotCriticalCACert.crt 952 restore_db 953 954 VFY_ACTION="Invalid keyUsage Critical cRLSign False Test4"; log_banner 955 certImport keyUsageCriticalcRLSignFalseCACert 956 crlImportn keyUsageCriticalcRLSignFalseCACRL.crl 957 if [ $RET -eq 0 ] ; then 958 pkitsn $certs/InvalidkeyUsageCriticalcRLSignFalseTest4EE.crt \ 959 $certs/keyUsageCriticalcRLSignFalseCACert.crt 960 fi 961 restore_db 962 963 VFY_ACTION="Invalid keyUsage Not Critical cRLSign False Test5"; log_banner 964 certImport keyUsageNotCriticalcRLSignFalseCACert 965 crlImportn keyUsageNotCriticalcRLSignFalseCACRL.crl 966 if [ $RET -eq 0 ] ; then 967 pkitsn $certs/InvalidkeyUsageNotCriticalcRLSignFalseTest5EE.crt \ 968 $certs/keyUsageNotCriticalcRLSignFalseCACert.crt 969 fi 970 restore_db 971 } 972 973 pkits_CertificatePolicies() 974 { 975 break_table "NIST PKITS Section 4.8: Certificate Policies" 976 977 VFY_ACTION="All Certificates Same Policy Test1"; log_banner 978 certImport GoodCACert 979 crlImport GoodCACRL.crl 980 pkits $certs/ValidCertificatePathTest1EE.crt \ 981 $certs/GoodCACert.crt 982 restore_db 983 984 VFY_ACTION="All Certificates No Policies Test2"; log_banner 985 certImport NoPoliciesCACert 986 crlImport NoPoliciesCACRL.crl 987 pkits $certs/AllCertificatesNoPoliciesTest2EE.crt \ 988 $certs/NoPoliciesCACert.crt 989 restore_db 990 991 VFY_ACTION="Different Policies Test3"; log_banner 992 certImport GoodCACert 993 crlImport GoodCACRL.crl 994 certImport PoliciesP2subCACert 995 crlImport PoliciesP2subCACRL.crl 996 pkits $certs/DifferentPoliciesTest3EE.crt \ 997 $certs/PoliciesP2subCACert.crt \ 998 $certs/GoodCACert.crt 999 restore_db 1000 1001 VFY_ACTION="Different Policies Test4"; log_banner 1002 certImport GoodCACert 1003 crlImport GoodCACRL.crl 1004 certImport GoodsubCACert 1005 crlImport GoodsubCACRL.crl 1006 pkits $certs/DifferentPoliciesTest4EE.crt \ 1007 $certs/GoodsubCACert.crt \ 1008 $certs/GoodCACert.crt 1009 restore_db 1010 1011 VFY_ACTION="Different Policies Test5"; log_banner 1012 certImport GoodCACert 1013 crlImport GoodCACRL.crl 1014 certImport PoliciesP2subCA2Cert 1015 crlImport PoliciesP2subCA2CRL.crl 1016 pkits $certs/DifferentPoliciesTest5EE.crt \ 1017 $certs/PoliciesP2subCA2Cert.crt \ 1018 $certs/GoodCACert.crt 1019 restore_db 1020 1021 VFY_ACTION="Overlapping Policies Test6"; log_banner 1022 certImport PoliciesP1234CACert 1023 crlImport PoliciesP1234CACRL.crl 1024 certImport PoliciesP1234subCAP123Cert 1025 crlImport PoliciesP1234subCAP123CRL.crl 1026 certImport PoliciesP1234subsubCAP123P12Cert 1027 crlImport PoliciesP1234subsubCAP123P12CRL.crl 1028 pkits $certs/OverlappingPoliciesTest6EE.crt \ 1029 $certs/PoliciesP1234subsubCAP123P12Cert.crt \ 1030 $certs/PoliciesP1234subCAP123Cert.crt \ 1031 $certs/PoliciesP1234CACert.crt 1032 restore_db 1033 1034 VFY_ACTION="Different Policies Test7"; log_banner 1035 certImport PoliciesP123CACert 1036 crlImport PoliciesP123CACRL.crl 1037 certImport PoliciesP123subCAP12Cert 1038 crlImport PoliciesP123subCAP12CRL.crl 1039 certImport PoliciesP123subsubCAP12P1Cert 1040 crlImport PoliciesP123subsubCAP12P1CRL.crl 1041 pkits $certs/DifferentPoliciesTest7EE.crt \ 1042 $certs/PoliciesP123subsubCAP12P1Cert.crt \ 1043 $certs/PoliciesP123subCAP12Cert.crt \ 1044 $certs/PoliciesP123CACert.crt 1045 restore_db 1046 1047 VFY_ACTION="Different Policies Test8"; log_banner 1048 certImport PoliciesP12CACert 1049 crlImport PoliciesP12CACRL.crl 1050 certImport PoliciesP12subCAP1Cert 1051 crlImport PoliciesP12subCAP1CRL.crl 1052 certImport PoliciesP12subsubCAP1P2Cert 1053 crlImport PoliciesP12subsubCAP1P2CRL.crl 1054 pkits $certs/DifferentPoliciesTest8EE.crt \ 1055 $certs/PoliciesP123subsubCAP12P1Cert.crt \ 1056 $certs/PoliciesP12subCAP1Cert.crt \ 1057 $certs/PoliciesP12CACert.crt 1058 restore_db 1059 1060 VFY_ACTION="Different Policies Test9"; log_banner 1061 certImport PoliciesP123CACert 1062 crlImport PoliciesP123CACRL.crl 1063 certImport PoliciesP123subCAP12Cert 1064 crlImport PoliciesP123subCAP12CRL.crl 1065 certImport PoliciesP123subsubCAP12P2Cert 1066 crlImport PoliciesP123subsubCAP2P2CRL.crl 1067 certImport PoliciesP123subsubsubCAP12P2P1Cert 1068 crlImport PoliciesP123subsubsubCAP12P2P1CRL.crl 1069 pkits $certs/DifferentPoliciesTest9EE.crt \ 1070 $certs/PoliciesP123subsubsubCAP12P2P1Cert.crt \ 1071 $certs/PoliciesP123subsubCAP12P1Cert.crt \ 1072 $certs/PoliciesP12subCAP1Cert.crt \ 1073 $certs/PoliciesP12CACert.crt 1074 restore_db 1075 1076 VFY_ACTION="All Certificates Same Policies Test10"; log_banner 1077 certImport PoliciesP12CACert 1078 crlImport PoliciesP12CACRL.crl 1079 pkits $certs/AllCertificatesSamePoliciesTest10EE.crt \ 1080 $certs/NoPoliciesCACert.crt 1081 restore_db 1082 1083 VFY_ACTION="All Certificates AnyPolicy Test11"; log_banner 1084 certImport anyPolicyCACert 1085 crlImport anyPolicyCACRL.crl 1086 pkits $certs/AllCertificatesanyPolicyTest11EE.crt \ 1087 $certs/anyPolicyCACert.crt 1088 restore_db 1089 1090 VFY_ACTION="Different Policies Test12"; log_banner 1091 certImport PoliciesP3CACert 1092 crlImport PoliciesP3CACRL.crl 1093 pkits $certs/DifferentPoliciesTest12EE.crt \ 1094 $certs/PoliciesP3CACert.crt 1095 restore_db 1096 1097 VFY_ACTION="All Certificates Same Policies Test13"; log_banner 1098 certImport PoliciesP123CACert 1099 crlImport PoliciesP123CACRL.crl 1100 pkits $certs/AllCertificatesSamePoliciesTest13EE.crt \ 1101 $certs/PoliciesP123CACert.crt 1102 restore_db 1103 1104 VFY_ACTION="AnyPolicy Test14"; log_banner 1105 certImport anyPolicyCACert 1106 crlImport anyPolicyCACRL.crl 1107 pkits $certs/AnyPolicyTest14EE.crt \ 1108 $certs/anyPolicyCACert.crt 1109 restore_db 1110 1111 VFY_ACTION="User Notice Qualifier Test15"; log_banner 1112 pkits $certs/UserNoticeQualifierTest15EE.crt 1113 1114 VFY_ACTION="User Notice Qualifier Test16"; log_banner 1115 certImport GoodCACert 1116 crlImport GoodCACRL.crl 1117 pkits $certs/UserNoticeQualifierTest16EE.crt \ 1118 $certs/GoodCACert.crt 1119 1120 VFY_ACTION="User Notice Qualifier Test17"; log_banner 1121 certImport GoodCACert 1122 crlImport GoodCACRL.crl 1123 pkits $certs/UserNoticeQualifierTest17EE.crt \ 1124 $certs/GoodCACert.crt 1125 restore_db 1126 1127 VFY_ACTION="User Notice Qualifier Test18"; log_banner 1128 certImport PoliciesP12CACert 1129 crlImport PoliciesP12CACRL.crl 1130 pkits $certs/UserNoticeQualifierTest18EE.crt \ 1131 $certs/PoliciesP12CACert.crt 1132 restore_db 1133 1134 VFY_ACTION="User Notice Qualifier Test19"; log_banner 1135 pkits $certs/UserNoticeQualifierTest19EE.crt 1136 1137 VFY_ACTION="CPS Pointer Qualifier Test20"; log_banner 1138 certImport GoodCACert 1139 crlImport GoodCACRL.crl 1140 pkits $certs/CPSPointerQualifierTest20EE.crt \ 1141 $certs/GoodCACert.crt 1142 restore_db 1143 } 1144 1145 pkits_RequireExplicitPolicy() 1146 { 1147 break_table "NIST PKITS Section 4.9: Require Explicit Policy" 1148 1149 VFY_ACTION="Valid RequireExplicitPolicy Test1"; log_banner 1150 certImportn requireExplicitPolicy10CACert 1151 crlImportn requireExplicitPolicy10CACRL.crl 1152 certImport requireExplicitPolicy10subCACert 1153 crlImport requireExplicitPolicy10subCACRL.crl 1154 certImport requireExplicitPolicy10subsubCACert 1155 crlImport requireExplicitPolicy10subsubCACRL.crl 1156 certImport requireExplicitPolicy10subsubsubCACert 1157 crlImport requireExplicitPolicy10subsubsubCACRL.crl 1158 pkits $certs/ValidrequireExplicitPolicyTest1EE.crt \ 1159 $certs/requireExplicitPolicy10subsubsubCACert.crt \ 1160 $certs/requireExplicitPolicy10subsubCACert.crt \ 1161 $certs/requireExplicitPolicy10subCACert.crt \ 1162 $certs/requireExplicitPolicy10CACert.crt 1163 restore_db 1164 1165 VFY_ACTION="Valid RequireExplicitPolicy Test2"; log_banner 1166 certImportn requireExplicitPolicy5CACert 1167 crlImportn requireExplicitPolicy5CACRL.crl 1168 certImport requireExplicitPolicy5subCACert 1169 crlImport requireExplicitPolicy5subCACRL.crl 1170 certImport requireExplicitPolicy5subsubCACert 1171 crlImport requireExplicitPolicy5subsubCACRL.crl 1172 certImport requireExplicitPolicy5subsubsubCACert 1173 crlImport requireExplicitPolicy5subsubsubCACRL.crl 1174 pkits $certs/ValidrequireExplicitPolicyTest2EE.crt \ 1175 $certs/requireExplicitPolicy5subsubsubCACert.crt \ 1176 $certs/requireExplicitPolicy5subsubCACert.crt \ 1177 $certs/requireExplicitPolicy5subCACert.crt \ 1178 $certs/requireExplicitPolicy5CACert.crt 1179 restore_db 1180 1181 VFY_ACTION="Invalid RequireExplicitPolicy Test3"; log_banner 1182 certImportn requireExplicitPolicy4CACert 1183 crlImportn requireExplicitPolicy4CACRL.crl 1184 certImport requireExplicitPolicy4subCACert 1185 crlImport requireExplicitPolicy4subCACRL.crl 1186 certImport requireExplicitPolicy4subsubCACert 1187 crlImport requireExplicitPolicy4subsubCACRL.crl 1188 certImport requireExplicitPolicy4subsubsubCACert 1189 crlImport requireExplicitPolicy4subsubsubCACRL.crl 1190 pkitsn $certs/InvalidrequireExplicitPolicyTest3EE.crt \ 1191 $certs/requireExplicitPolicy4subsubsubCACert.crt \ 1192 $certs/requireExplicitPolicy4subsubCACert.crt \ 1193 $certs/requireExplicitPolicy4subCACert.crt \ 1194 $certs/requireExplicitPolicy4CACert.crt 1195 restore_db 1196 1197 VFY_ACTION="Valid RequireExplicitPolicy Test4"; log_banner 1198 certImportn requireExplicitPolicy0CACert 1199 crlImportn requireExplicitPolicy0CACRL.crl 1200 certImport requireExplicitPolicy0subCACert 1201 crlImport requireExplicitPolicy0subCACRL.crl 1202 certImport requireExplicitPolicy0subsubCACert 1203 crlImport requireExplicitPolicy0subsubCACRL.crl 1204 certImport requireExplicitPolicy0subsubsubCACert 1205 crlImport requireExplicitPolicy0subsubsubCACRL.crl 1206 pkits $certs/ValidrequireExplicitPolicyTest4EE.crt \ 1207 $certs/requireExplicitPolicy0subsubsubCACert.crt \ 1208 $certs/requireExplicitPolicy0subsubCACert.crt \ 1209 $certs/requireExplicitPolicy0subCACert.crt \ 1210 $certs/requireExplicitPolicy0CACert.crt 1211 restore_db 1212 1213 VFY_ACTION="Invalid RequireExplicitPolicy Test5"; log_banner 1214 certImportn requireExplicitPolicy7CACert 1215 crlImportn requireExplicitPolicy7CACRL.crl 1216 certImportn requireExplicitPolicy7subCARE2Cert 1217 crlImportn requireExplicitPolicy7subCARE2CRL.crl 1218 certImportn requireExplicitPolicy7subsubCARE2RE4Cert 1219 crlImportn requireExplicitPolicy7subsubCARE2RE4CRL.crl 1220 certImport requireExplicitPolicy7subsubsubCARE2RE4Cert 1221 crlImport requireExplicitPolicy7subsubsubCARE2RE4CRL.crl 1222 pkitsn $certs/InvalidrequireExplicitPolicyTest5EE.crt \ 1223 $certs/requireExplicitPolicy7subsubsubCARE2RE4Cert.crt \ 1224 $certs/requireExplicitPolicy7subsubCARE2RE4Cert.crt \ 1225 $certs/requireExplicitPolicy7subCARE2Cert.crt \ 1226 $certs/requireExplicitPolicy7CACert.crt 1227 restore_db 1228 1229 VFY_ACTION="Valid Self-Issued RequireExplicitPolicy Test6"; log_banner 1230 certImportn requireExplicitPolicy2CACert 1231 crlImportn requireExplicitPolicy2CACRL.crl 1232 pkits $certs/ValidSelfIssuedrequireExplicitPolicyTest6EE.crt \ 1233 $certs/requireExplicitPolicy2SelfIssuedCACert.crt \ 1234 $certs/requireExplicitPolicy2CACert.crt 1235 restore_db 1236 1237 VFY_ACTION="Invalid Self-Issued RequireExplicitPolicy Test7"; log_banner 1238 certImportn requireExplicitPolicy2CACert 1239 crlImportn requireExplicitPolicy2CACRL.crl 1240 certImport requireExplicitPolicy2subCACert 1241 crlImport requireExplicitPolicy2subCACRL.crl 1242 pkitsn $certs/InvalidSelfIssuedrequireExplicitPolicyTest7EE.crt \ 1243 $certs/requireExplicitPolicy2subCACert.crt \ 1244 $certs/requireExplicitPolicy2SelfIssuedCACert.crt \ 1245 $certs/requireExplicitPolicy2CACert.crt 1246 restore_db 1247 1248 VFY_ACTION="Invalid Self-Issued RequireExplicitPolicy Test8"; log_banner 1249 certImportn requireExplicitPolicy2CACert 1250 crlImportn requireExplicitPolicy2CACRL.crl 1251 certImport requireExplicitPolicy2subCACert 1252 crlImport requireExplicitPolicy2subCACRL.crl 1253 pkitsn $certs/InvalidSelfIssuedrequireExplicitPolicyTest8EE.crt \ 1254 $certs/requireExplicitPolicy2SelfIssuedsubCACert.crt \ 1255 $certs/requireExplicitPolicy2subCACert.crt \ 1256 $certs/requireExplicitPolicy2SelfIssuedCACert.crt \ 1257 $certs/requireExplicitPolicy2CACert.crt 1258 restore_db 1259 } 1260 1261 pkits_PolicyMappings() 1262 { 1263 break_table "NIST PKITS Section 4.10: Policy Mappings" 1264 1265 VFY_ACTION="Valid Policy Mapping Test1"; log_banner 1266 certImportn Mapping1to2CACert 1267 crlImportn Mapping1to2CACRL.crl 1268 pkits $certs/ValidPolicyMappingTest1EE.crt \ 1269 $certs/Mapping1to2CACert.crt 1270 restore_db 1271 1272 VFY_ACTION="Invalid Policy Mapping Test2"; log_banner 1273 certImportn Mapping1to2CACert 1274 crlImportn Mapping1to2CACRL.crl 1275 pkitsn $certs/InvalidPolicyMappingTest2EE.crt \ 1276 $certs/Mapping1to2CACert.crt 1277 restore_db 1278 1279 VFY_ACTION="Valid Policy Mapping Test3"; log_banner 1280 certImportn P12Mapping1to3CACert 1281 crlImportn P12Mapping1to3CACRL.crl 1282 certImportn P12Mapping1to3subCACert 1283 crlImportn P12Mapping1to3subCACRL.crl 1284 certImportn P12Mapping1to3subsubCACert 1285 crlImportn P12Mapping1to3subsubCACRL.crl 1286 pkits $certs/ValidPolicyMappingTest3EE.crt \ 1287 $certs/P12Mapping1to3subsubCACert.crt \ 1288 $certs/P12Mapping1to3subCACert.crt \ 1289 $certs/P12Mapping1to3CA.crt 1290 restore_db 1291 1292 VFY_ACTION="Invalid Policy Mapping Test4"; log_banner 1293 certImportn P12Mapping1to3CACert 1294 crlImportn P12Mapping1to3CACRL.crl 1295 certImportn P12Mapping1to3subCACert 1296 crlImportn P12Mapping1to3subCACRL.crl 1297 certImportn P12Mapping1to3subsubCACert 1298 crlImportn P12Mapping1to3subsubCACRL.crl 1299 pkitsn $certs/InvalidPolicyMappingTest4EE.crt \ 1300 $certs/P12Mapping1to3subsubCACert.crt \ 1301 $certs/P12Mapping1to3subCACert.crt \ 1302 $certs/P12Mapping1to3CA.crt 1303 restore_db 1304 1305 VFY_ACTION="Valid Policy Mapping Test5"; log_banner 1306 certImportn P1Mapping1to234CACert 1307 crlImportn P1Mapping1to234CACRL.crl 1308 certImportn P1Mapping1to234subCACert 1309 crlImportn P1Mapping1to234subCACRL.crl 1310 pkits $certs/ValidPolicyMappingTest5EE.crt \ 1311 $certs/P1Mapping1to234subCACert.crt \ 1312 $certs/P1Mapping1to234CA.crt 1313 restore_db 1314 1315 VFY_ACTION="Valid Policy Mapping Test6"; log_banner 1316 certImportn P1Mapping1to234CACert 1317 crlImportn P1Mapping1to234CACRL.crl 1318 certImportn P1Mapping1to234subCACert 1319 crlImportn P1Mapping1to234subCACRL.crl 1320 pkits $certs/ValidPolicyMappingTest6EE.crt \ 1321 $certs/P1Mapping1to234subCACert.crt \ 1322 $certs/P1Mapping1to234CA.crt 1323 restore_db 1324 1325 VFY_ACTION="Invalid Mapping from anyPolicy Test7"; log_banner 1326 certImportn MappingFromanyPolicyCACert 1327 crlImportn MappingFromanyPolicyCACRL.crl 1328 pkitsn $certs/InvalidMappingFromanyPolicyTest7EE.crt \ 1329 $certs/MappingFromanyPolicyCACert.crt 1330 restore_db 1331 1332 VFY_ACTION="Invalid Mapping to anyPolicy Test8"; log_banner 1333 certImportn MappingToanyPolicyCACert 1334 crlImportn MappingToanyPolicyCACRL.crl 1335 pkitsn $certs/InvalidMappingToanyPolicyTest8EE.crt \ 1336 $certs/MappingToanyPolicyCACert.crt 1337 restore_db 1338 1339 VFY_ACTION="Valid Policy Mapping Test9"; log_banner 1340 certImport PanyPolicyMapping1to2CACert 1341 crlImport PanyPolicyMapping1to2CACRL.crl 1342 pkits $certs/ValidPolicyMappingTest9EE.crt \ 1343 $certs/PanyPolicyMapping1to2CACert.crt 1344 restore_db 1345 1346 VFY_ACTION="Invalid Policy Mapping Test10"; log_banner 1347 certImport GoodCACert 1348 crlImport GoodCACRL.crl 1349 certImportn GoodsubCAPanyPolicyMapping1to2CACert 1350 crlImportn GoodsubCAPanyPolicyMapping1to2CACRL.crl 1351 pkitsn $certs/InvalidPolicyMappingTest10EE.crt \ 1352 $certs/GoodsubCAPanyPolicyMapping1to2CACert.crt \ 1353 $certs/GoodCACert.crt 1354 restore_db 1355 1356 VFY_ACTION="Valid Policy Mapping Test11"; log_banner 1357 certImport GoodCACert 1358 crlImport GoodCACRL.crl 1359 certImportn GoodsubCAPanyPolicyMapping1to2CACert 1360 crlImportn GoodsubCAPanyPolicyMapping1to2CACRL.crl 1361 pkits $certs/ValidPolicyMappingTest11EE.crt \ 1362 $certs/GoodsubCAPanyPolicyMapping1to2CACert.crt \ 1363 $certs/GoodCACert.crt 1364 restore_db 1365 1366 VFY_ACTION="Valid Policy Mapping Test12"; log_banner 1367 certImportn P12Mapping1to3CACert 1368 crlImportn P12Mapping1to3CACRL.crl 1369 pkits $certs/ValidPolicyMappingTest12EE.crt \ 1370 $certs/P12Mapping1to3CACert.crt 1371 restore_db 1372 1373 VFY_ACTION="Valid Policy Mapping Test13"; log_banner 1374 certImportn P1anyPolicyMapping1to2CACert 1375 crlImportn P1anyPolicyMapping1to2CACRL.crl 1376 pkits $certs/ValidPolicyMappingTest13EE.crt \ 1377 $certs/P1anyPolicyMapping1to2CACert.crt 1378 restore_db 1379 1380 VFY_ACTION="Valid Policy Mapping Test14"; log_banner 1381 certImportn P1anyPolicyMapping1to2CACert 1382 crlImportn P1anyPolicyMapping1to2CACRL.crl 1383 pkits $certs/ValidPolicyMappingTest14EE.crt \ 1384 $certs/P1anyPolicyMapping1to2CACert.crt 1385 restore_db 1386 } 1387 1388 1389 pkits_InhibitPolicyMapping() 1390 { 1391 break_table "NIST PKITS Section 4.11: Inhibit Policy Mapping" 1392 1393 VFY_ACTION="Invalid inhibitPolicyMapping Test1"; log_banner 1394 certImportn inhibitPolicyMapping0CACert 1395 crlImportn inhibitPolicyMapping0CACRL.crl 1396 certImportn inhibitPolicyMapping0subCACert 1397 crlImportn inhibitPolicyMapping0subCACRL.crl 1398 pkitsn $certs/InvalidinhibitPolicyMappingTest1EE.crt \ 1399 $certs/inhibitPolicyMapping0CACert.crt \ 1400 $certs/inhibitPolicyMapping0subCACert.crt 1401 restore_db 1402 1403 VFY_ACTION="Valid inhibitPolicyMapping Test2"; log_banner 1404 certImportn inhibitPolicyMapping1P12CACert 1405 crlImportn inhibitPolicyMapping1P12CACRL.crl 1406 certImportn inhibitPolicyMapping1P12subCACert 1407 crlImportn inhibitPolicyMapping1P12subCACRL.crl 1408 pkits $certs/ValidinhibitPolicyMappingTest2EE.crt \ 1409 $certs/inhibitPolicyMapping1P12CACert.crt \ 1410 $certs/inhibitPolicyMapping1P12subCACert.crt 1411 restore_db 1412 1413 VFY_ACTION="Invalid inhibitPolicyMapping Test3"; log_banner 1414 certImportn inhibitPolicyMapping1P12CACert 1415 crlImportn inhibitPolicyMapping1P12CACRL.crl 1416 certImportn inhibitPolicyMapping1P12subCACert 1417 crlImportn inhibitPolicyMapping1P12subCACRL.crl 1418 certImportn inhibitPolicyMapping1P12subsubCACert 1419 crlImportn inhibitPolicyMapping1P12subsubCACRL.crl 1420 pkitsn $certs/InvalidinhibitPolicyMappingTest3EE.crt \ 1421 $certs/inhibitPolicyMapping1P12subsubCACert.crt \ 1422 $certs/inhibitPolicyMapping1P12subCACert.crt \ 1423 $certs/inhibitPolicyMapping1P12CACert.crt 1424 restore_db 1425 1426 VFY_ACTION="Valid inhibitPolicyMapping Test4"; log_banner 1427 certImportn inhibitPolicyMapping1P12CACert 1428 crlImportn inhibitPolicyMapping1P12CACRL.crl 1429 certImportn inhibitPolicyMapping1P12subCACert 1430 crlImportn inhibitPolicyMapping1P12subCACRL.crl 1431 certImportn inhibitPolicyMapping1P12subsubCACert 1432 crlImportn inhibitPolicyMapping1P12subsubCACRL.crl 1433 pkits $certs/ValidinhibitPolicyMappingTest4EE.crt \ 1434 $certs/inhibitPolicyMapping1P12CACert.crt \ 1435 $certs/inhibitPolicyMapping1P12subCACert.crt 1436 restore_db 1437 1438 VFY_ACTION="Invalid inhibitPolicyMapping Test5"; log_banner 1439 certImportn inhibitPolicyMapping5CACert 1440 crlImportn inhibitPolicyMapping5CACRL.crl 1441 certImportn inhibitPolicyMapping5subCACert 1442 crlImportn inhibitPolicyMapping5subCACRL.crl 1443 certImport inhibitPolicyMapping5subsubCACert 1444 crlImport inhibitPolicyMapping5subsubCACRL.crl 1445 pkitsn $certs/InvalidinhibitPolicyMappingTest5EE.crt \ 1446 $certs/inhibitPolicyMapping5subsubCACert.crt \ 1447 $certs/inhibitPolicyMapping5subCACert.crt \ 1448 $certs/inhibitPolicyMapping5CACert.crt 1449 restore_db 1450 1451 VFY_ACTION="Invalid inhibitPolicyMapping Test6"; log_banner 1452 certImportn inhibitPolicyMapping1P12CACert 1453 crlImportn inhibitPolicyMapping1P12CACRL.crl 1454 certImportn inhibitPolicyMapping1P12subCAIPM5Cert 1455 crlImportn inhibitPolicyMapping1P12subCAIPM5CRL.crl 1456 certImport inhibitPolicyMapping1P12subsubCAIPM5Cert 1457 crlImportn inhibitPolicyMapping1P12subsubCAIPM5CRL.crl 1458 pkitsn $certs/InvalidinhibitPolicyMappingTest6EE.crt \ 1459 $certs/inhibitPolicyMapping1P12subsubCAIPM5Cert.crt \ 1460 $certs/inhibitPolicyMapping1P12subCAIPM5Cert.crt \ 1461 $certs/inhibitPolicyMapping1P12CACert.crt 1462 restore_db 1463 1464 VFY_ACTION="Valid Self-Issued inhibitPolicyMapping Test7"; log_banner 1465 certImportn inhibitPolicyMapping1P1CACert 1466 crlImportn inhibitPolicyMapping1P1CACRL.crl 1467 certImportn inhibitPolicyMapping1P1subCACert 1468 crlImportn inhibitPolicyMapping1P1subCACRL.crl 1469 pkits $certs/ValidSelfIssuedinhibitPolicyMappingTest7EE.crt \ 1470 $certs/inhibitPolicyMapping1P1subCACert.crt \ 1471 $certs/inhibitPolicyMapping1P1SelfIssuedCACert.crt \ 1472 $certs/inhibitPolicyMapping1P1CACert.crt 1473 restore_db 1474 1475 VFY_ACTION="Invalid Self-Issued inhibitPolicyMapping Test8"; log_banner 1476 certImportn inhibitPolicyMapping1P1CACert 1477 crlImportn inhibitPolicyMapping1P1CACRL.crl 1478 certImportn inhibitPolicyMapping1P1subCACert 1479 crlImportn inhibitPolicyMapping1P1subCACRL.crl 1480 certImport inhibitPolicyMapping1P1subsubCACert 1481 crlImportn inhibitPolicyMapping1P1subsubCACRL.crl 1482 pkitsn $certs/InvalidSelfIssuedinhibitPolicyMappingTest8EE.crt \ 1483 $certs/inhibitPolicyMapping1P1subsubCACert.crt \ 1484 $certs/inhibitPolicyMapping1P1subCACert.crt \ 1485 $certs/inhibitPolicyMapping1P1SelfIssuedCACert.crt \ 1486 $certs/inhibitPolicyMapping1P1CACert.crt 1487 restore_db 1488 1489 VFY_ACTION="Invalid Self-Issued inhibitPolicyMapping Test9"; log_banner 1490 certImportn inhibitPolicyMapping1P1CACert 1491 crlImportn inhibitPolicyMapping1P1CACRL.crl 1492 certImportn inhibitPolicyMapping1P1subCACert 1493 crlImportn inhibitPolicyMapping1P1subCACRL.crl 1494 certImportn inhibitPolicyMapping1P1subsubCACert 1495 crlImportn inhibitPolicyMapping1P1subsubCACRL.crl 1496 pkitsn $certs/InvalidSelfIssuedinhibitPolicyMappingTest9EE.crt \ 1497 $certs/inhibitPolicyMapping1P1subsubCACert.crt \ 1498 $certs/inhibitPolicyMapping1P1subCACert.crt \ 1499 $certs/inhibitPolicyMapping1P1SelfIssuedCACert.crt \ 1500 $certs/inhibitPolicyMapping1P1CACert.crt 1501 restore_db 1502 1503 VFY_ACTION="Invalid Self-Issued inhibitPolicyMapping Test10"; log_banner 1504 certImportn inhibitPolicyMapping1P1CACert 1505 crlImportn inhibitPolicyMapping1P1CACRL.crl 1506 certImportn inhibitPolicyMapping1P1subCACert 1507 crlImportn inhibitPolicyMapping1P1subCACRL.crl 1508 pkitsn $certs/InvalidSelfIssuedinhibitPolicyMappingTest10EE.crt \ 1509 $certs/inhibitPolicyMapping1P1SelfIssuedsubCACert.crt \ 1510 $certs/inhibitPolicyMapping1P1subCACert.crt \ 1511 $certs/inhibitPolicyMapping1P1SelfIssuedCACert.crt \ 1512 $certs/inhibitPolicyMapping1P1CACert.crt 1513 restore_db 1514 1515 VFY_ACTION="Invalid Self-Issued inhibitPolicyMapping Test11"; log_banner 1516 certImportn inhibitPolicyMapping1P1CACert 1517 crlImportn inhibitPolicyMapping1P1CACRL.crl 1518 certImportn inhibitPolicyMapping1P1subCACert 1519 crlImportn inhibitPolicyMapping1P1subCACRL.crl 1520 pkitsn $certs/InvalidSelfIssuedinhibitPolicyMappingTest11EE.crt \ 1521 $certs/inhibitPolicyMapping1P1SelfIssuedsubCACert.crt \ 1522 $certs/inhibitPolicyMapping1P1subCACert.crt \ 1523 $certs/inhibitPolicyMapping1P1SelfIssuedCACert.crt \ 1524 $certs/inhibitPolicyMapping1P1CACert.crt 1525 restore_db 1526 } 1527 1528 1529 pkits_InhibitAnyPolicy() 1530 { 1531 break_table "NIST PKITS Section 4.12: Inhibit Any Policy" 1532 1533 VFY_ACTION="Invalid inhibitAnyPolicy Test1"; log_banner 1534 certImportn inhibitAnyPolicy0CACert 1535 crlImportn inhibitAnyPolicy0CACRL.crl 1536 pkitsn $certs/InvalidinhibitAnyPolicyTest1EE.crt \ 1537 $certs/inhibitAnyPolicy0CACert.crt 1538 restore_db 1539 1540 VFY_ACTION="Valid inhibitAnyPolicy Test2"; log_banner 1541 certImportn inhibitAnyPolicy0CACert 1542 crlImportn inhibitAnyPolicy0CACRL.crl 1543 pkits $certs/ValidinhibitAnyPolicyTest2EE.crt \ 1544 $certs/inhibitAnyPolicy0CACert.crt 1545 restore_db 1546 1547 VFY_ACTION="inhibitAnyPolicy Test3"; log_banner 1548 certImportn inhibitAnyPolicy1CACert 1549 crlImportn inhibitAnyPolicy1CACRL.crl 1550 certImport inhibitAnyPolicy1subCA1Cert 1551 crlImport inhibitAnyPolicy1subCA1CRL.crl 1552 pkits $certs/inhibitAnyPolicyTest3EE.crt \ 1553 $certs/inhibitAnyPolicy1CACert.crt \ 1554 $certs/inhibitAnyPolicy1subCA1Cert.crt 1555 restore_db 1556 1557 VFY_ACTION="Invalid inhibitAnyPolicy Test4"; log_banner 1558 certImportn inhibitAnyPolicy1CACert 1559 crlImportn inhibitAnyPolicy1CACRL.crl 1560 certImport inhibitAnyPolicy1subCA1Cert 1561 crlImport inhibitAnyPolicy1subCA1CRL.crl 1562 pkitsn $certs/InvalidinhibitAnyPolicyTest4EE.crt \ 1563 $certs/inhibitAnyPolicy1CACert.crt \ 1564 $certs/inhibitAnyPolicy1subCA1Cert.crt 1565 restore_db 1566 1567 VFY_ACTION="Invalid inhibitAnyPolicy Test5"; log_banner 1568 certImportn inhibitAnyPolicy5CACert 1569 crlImportn inhibitAnyPolicy5CACRL.crl 1570 certImportn inhibitAnyPolicy5subCACert 1571 crlImportn inhibitAnyPolicy5subCACRL.crl 1572 certImport inhibitAnyPolicy5subsubCACert 1573 crlImport inhibitAnyPolicy5subsubCACRL.crl 1574 pkitsn $certs/InvalidinhibitAnyPolicyTest5EE.crt \ 1575 $certs/inhibitAnyPolicy5CACert.crt \ 1576 $certs/inhibitAnyPolicy5subCACert.crt \ 1577 $certs/inhibitAnyPolicy5subsubCACert.crt 1578 restore_db 1579 1580 VFY_ACTION="Invalid inhibitAnyPolicy Test6"; log_banner 1581 certImportn inhibitAnyPolicy1CACert 1582 crlImportn inhibitAnyPolicy1CACRL.crl 1583 certImportn inhibitAnyPolicy1subCAIAP5Cert 1584 crlImportn inhibitAnyPolicy1subCAIAP5CRL.crl 1585 pkitsn $certs/InvalidinhibitAnyPolicyTest5EE.crt \ 1586 $certs/inhibitAnyPolicy1CACert.crt \ 1587 $certs/inhibitAnyPolicy5subCACert.crt \ 1588 $certs/inhibitAnyPolicy5subsubCACert.crt 1589 restore_db 1590 1591 VFY_ACTION="Valid Self-Issued inhibitAnyPolicy Test7"; log_banner 1592 certImportn inhibitAnyPolicy1CACert 1593 crlImportn inhibitAnyPolicy1CACRL.crl 1594 certImport inhibitAnyPolicy1subCA2Cert 1595 crlImport inhibitAnyPolicy1subCA2CRL.crl 1596 pkits $certs/ValidSelfIssuedinhibitAnyPolicyTest7EE.crt \ 1597 $certs/inhibitAnyPolicy1CACert.crt \ 1598 $certs/inhibitAnyPolicy1SelfIssuedCACert.crt \ 1599 $certs/inhibitAnyPolicy1subCA2Cert.crt 1600 restore_db 1601 1602 VFY_ACTION="Invalid Self-Issued inhibitAnyPolicy Test8"; log_banner 1603 certImportn inhibitAnyPolicy1CACert 1604 crlImportn inhibitAnyPolicy1CACRL.crl 1605 certImport inhibitAnyPolicy1subCA2Cert 1606 crlImport inhibitAnyPolicy1subCA2CRL.crl 1607 certImport inhibitAnyPolicy1subsubCA2Cert 1608 crlImport inhibitAnyPolicy1subsubCA2CRL.crl 1609 pkitsn $certs/InvalidSelfIssuedinhibitAnyPolicyTest8EE.crt \ 1610 $certs/inhibitAnyPolicy1CACert.crt \ 1611 $certs/inhibitAnyPolicy1SelfIssuedCACert.crt \ 1612 $certs/inhibitAnyPolicy1subCA2Cert.crt \ 1613 $certs/inhibitAnyPolicy1subsubCA2Cert.crt 1614 restore_db 1615 1616 VFY_ACTION="Valid Self-Issued inhibitAnyPolicy Test9"; log_banner 1617 certImportn inhibitAnyPolicy1CACert 1618 crlImportn inhibitAnyPolicy1CACRL.crl 1619 certImport inhibitAnyPolicy1subCA2Cert 1620 crlImport inhibitAnyPolicy1subCA2CRL.crl 1621 pkits $certs/ValidSelfIssuedinhibitAnyPolicyTest9EE.crt \ 1622 $certs/inhibitAnyPolicy1CACert.crt \ 1623 $certs/inhibitAnyPolicy1SelfIssuedCACert.crt \ 1624 $certs/inhibitAnyPolicy1subCA2Cert.crt \ 1625 $certs/inhibitAnyPolicy1SelfIssuedsubCA2Cert.crt 1626 restore_db 1627 1628 VFY_ACTION="Invalid Self-Issued inhibitAnyPolicy Test10"; log_banner 1629 certImportn inhibitAnyPolicy1CACert 1630 crlImportn inhibitAnyPolicy1CACRL.crl 1631 certImport inhibitAnyPolicy1subCA2Cert 1632 crlImport inhibitAnyPolicy1subCA2CRL.crl 1633 pkitsn $certs/InvalidSelfIssuedinhibitAnyPolicyTest10EE.crt \ 1634 $certs/inhibitAnyPolicy1CACert.crt \ 1635 $certs/inhibitAnyPolicy1SelfIssuedCACert.crt \ 1636 $certs/inhibitAnyPolicy1subCA2Cert.crt 1637 restore_db 1638 } 1639 1640 1641 pkits_NameConstraints() 1642 { 1643 break_table "NIST PKITS Section 4.13: Name Constraints" 1644 1645 VFY_ACTION="Valid DN nameConstraints Test1"; log_banner 1646 certImport nameConstraintsDN1CACert 1647 crlImport nameConstraintsDN1CACRL.crl 1648 pkits $certs/ValidDNnameConstraintsTest1EE.crt \ 1649 $certs/nameConstraintsDN1CACert.crt 1650 restore_db 1651 1652 VFY_ACTION="Invalid DN nameConstraints Test2"; log_banner 1653 certImport nameConstraintsDN1CACert 1654 crlImport nameConstraintsDN1CACRL.crl 1655 pkitsn $certs/InvalidDNnameConstraintsTest2EE.crt \ 1656 $certs/nameConstraintsDN1CACert.crt 1657 restore_db 1658 1659 VFY_ACTION="Invalid DN nameConstraints Test3"; log_banner 1660 certImport nameConstraintsDN1CACert 1661 crlImport nameConstraintsDN1CACRL.crl 1662 pkitsn $certs/InvalidDNnameConstraintsTest3EE.crt \ 1663 $certs/nameConstraintsDN1CACert.crt 1664 restore_db 1665 1666 VFY_ACTION="Valid DN nameConstraints Test4"; log_banner 1667 certImport nameConstraintsDN1CACert 1668 crlImport nameConstraintsDN1CACRL.crl 1669 pkits $certs/ValidDNnameConstraintsTest4EE.crt \ 1670 $certs/nameConstraintsDN1CACert.crt 1671 restore_db 1672 1673 VFY_ACTION="Valid DN nameConstraints Test5"; log_banner 1674 certImport nameConstraintsDN2CACert 1675 crlImport nameConstraintsDN2CACRL.crl 1676 pkits $certs/ValidDNnameConstraintsTest5EE.crt \ 1677 $certs/nameConstraintsDN2CACert.crt 1678 restore_db 1679 1680 VFY_ACTION="Valid DN nameConstraints Test6"; log_banner 1681 certImport nameConstraintsDN3CACert 1682 crlImport nameConstraintsDN3CACRL.crl 1683 pkits $certs/ValidDNnameConstraintsTest6EE.crt \ 1684 $certs/nameConstraintsDN3CACert.crt 1685 restore_db 1686 1687 VFY_ACTION="Invalid DN nameConstraints Test7"; log_banner 1688 certImport nameConstraintsDN3CACert 1689 crlImport nameConstraintsDN3CACRL.crl 1690 pkitsn $certs/InvalidDNnameConstraintsTest7EE.crt \ 1691 $certs/nameConstraintsDN3CACert.crt 1692 restore_db 1693 1694 VFY_ACTION="Invalid DN nameConstraints Test8"; log_banner 1695 certImport nameConstraintsDN4CACert 1696 crlImport nameConstraintsDN4CACRL.crl 1697 pkitsn $certs/InvalidDNnameConstraintsTest8EE.crt \ 1698 $certs/nameConstraintsDN4CACert.crt 1699 restore_db 1700 1701 VFY_ACTION="Invalid DN nameConstraints Test9"; log_banner 1702 certImport nameConstraintsDN4CACert 1703 crlImport nameConstraintsDN4CACRL.crl 1704 pkitsn $certs/InvalidDNnameConstraintsTest9EE.crt \ 1705 $certs/nameConstraintsDN4CACert.crt 1706 restore_db 1707 1708 VFY_ACTION="Invalid DN nameConstraints Test10"; log_banner 1709 certImport nameConstraintsDN5CACert 1710 crlImport nameConstraintsDN5CACRL.crl 1711 pkitsn $certs/InvalidDNnameConstraintsTest10EE.crt \ 1712 $certs/nameConstraintsDN5CACert.crt 1713 restore_db 1714 1715 VFY_ACTION="Valid DN nameConstraints Test11"; log_banner 1716 certImport nameConstraintsDN5CACert 1717 crlImport nameConstraintsDN5CACRL.crl 1718 pkits $certs/ValidDNnameConstraintsTest11EE.crt \ 1719 $certs/nameConstraintsDN5CACert.crt 1720 restore_db 1721 1722 VFY_ACTION="Invalid DN nameConstraints Test12"; log_banner 1723 certImport nameConstraintsDN1CACert 1724 crlImport nameConstraintsDN1CACRL.crl 1725 certImport nameConstraintsDN1subCA1Cert 1726 crlImport nameConstraintsDN1subCA1CRL.crl 1727 pkitsn $certs/InvalidDNnameConstraintsTest12EE.crt \ 1728 $certs/nameConstraintsDN1subCA1Cert.crt \ 1729 $certs/nameConstraintsDN1CACert.crt 1730 restore_db 1731 1732 VFY_ACTION="Invalid DN nameConstraints Test13"; log_banner 1733 certImport nameConstraintsDN1CACert 1734 crlImport nameConstraintsDN1CACRL.crl 1735 certImport nameConstraintsDN1subCA2Cert 1736 crlImport nameConstraintsDN1subCA2CRL.crl 1737 pkitsn $certs/InvalidDNnameConstraintsTest13EE.crt \ 1738 $certs/nameConstraintsDN1subCA2Cert.crt \ 1739 $certs/nameConstraintsDN1CACert.crt 1740 restore_db 1741 1742 VFY_ACTION="Valid DN nameConstraints Test14"; log_banner 1743 certImport nameConstraintsDN1CACert 1744 crlImport nameConstraintsDN1CACRL.crl 1745 certImport nameConstraintsDN1subCA2Cert 1746 crlImport nameConstraintsDN1subCA2CRL.crl 1747 pkits $certs/ValidDNnameConstraintsTest14EE.crt \ 1748 $certs/nameConstraintsDN1subCA2Cert.crt \ 1749 $certs/nameConstraintsDN1CACert.crt 1750 restore_db 1751 1752 VFY_ACTION="Invalid DN nameConstraints Test15"; log_banner 1753 certImport nameConstraintsDN3CACert 1754 crlImport nameConstraintsDN3CACRL.crl 1755 certImport nameConstraintsDN3subCA1Cert 1756 crlImport nameConstraintsDN3subCA1CRL.crl 1757 pkitsn $certs/InvalidDNnameConstraintsTest15EE.crt \ 1758 $certs/nameConstraintsDN3subCA1Cert.crt \ 1759 $certs/nameConstraintsDN3CACert.crt 1760 restore_db 1761 1762 VFY_ACTION="Invalid DN nameConstraints Test16"; log_banner 1763 certImport nameConstraintsDN3CACert 1764 crlImport nameConstraintsDN3CACRL.crl 1765 certImport nameConstraintsDN3subCA1Cert 1766 crlImport nameConstraintsDN3subCA1CRL.crl 1767 pkitsn $certs/InvalidDNnameConstraintsTest16EE.crt \ 1768 $certs/nameConstraintsDN3subCA1Cert.crt \ 1769 $certs/nameConstraintsDN3CACert.crt 1770 restore_db 1771 1772 VFY_ACTION="Invalid DN nameConstraints Test17"; log_banner 1773 certImport nameConstraintsDN3CACert 1774 crlImport nameConstraintsDN3CACRL.crl 1775 certImport nameConstraintsDN3subCA2Cert 1776 crlImport nameConstraintsDN3subCA2CRL.crl 1777 pkitsn $certs/InvalidDNnameConstraintsTest17EE.crt \ 1778 $certs/nameConstraintsDN3subCA2Cert.crt \ 1779 $certs/nameConstraintsDN3CACert.crt 1780 restore_db 1781 1782 VFY_ACTION="Valid DN nameConstraints Test18"; log_banner 1783 certImport nameConstraintsDN3CACert 1784 crlImport nameConstraintsDN3CACRL.crl 1785 certImport nameConstraintsDN3subCA2Cert 1786 crlImport nameConstraintsDN3subCA2CRL.crl 1787 pkits $certs/ValidDNnameConstraintsTest18EE.crt \ 1788 $certs/nameConstraintsDN3subCA2Cert.crt \ 1789 $certs/nameConstraintsDN3CACert.crt 1790 restore_db 1791 1792 ### bug 232737 ### 1793 if [ -n "${KNOWN_BUG}" ]; then 1794 VFY_ACTION="Valid Self-Issued DN nameConstraints Test19"; log_banner 1795 certImport nameConstraintsDN1CACert 1796 crlImport nameConstraintsDN1CACRL.crl 1797 pkits $certs/ValidDNnameConstraintsTest19EE.crt \ 1798 $certs/nameConstraintsDN1SelfIssuedCACert.crt \ 1799 $certs/nameConstraintsDN1CACert.crt 1800 restore_db 1801 fi 1802 1803 VFY_ACTION="Invalid Self-Issued DN nameConstraints Test20"; log_banner 1804 certImport nameConstraintsDN1CACert 1805 crlImport nameConstraintsDN1CACRL.crl 1806 pkitsn $certs/InvalidDNnameConstraintsTest20EE.crt \ 1807 $certs/nameConstraintsDN1CACert.crt 1808 restore_db 1809 1810 VFY_ACTION="Valid RFC822 nameConstraints Test21"; log_banner 1811 certImport nameConstraintsRFC822CA1Cert 1812 crlImport nameConstraintsRFC822CA1CRL.crl 1813 pkits $certs/ValidRFC822nameConstraintsTest21EE.crt \ 1814 $certs/nameConstraintsRFC822CA1Cert.crt 1815 restore_db 1816 1817 VFY_ACTION="Invalid RFC822 nameConstraints Test22"; log_banner 1818 certImport nameConstraintsRFC822CA1Cert 1819 crlImport nameConstraintsRFC822CA1CRL.crl 1820 pkitsn $certs/InvalidRFC822nameConstraintsTest22EE.crt \ 1821 $certs/nameConstraintsRFC822CA1Cert.crt 1822 restore_db 1823 1824 VFY_ACTION="Valid RFC822 nameConstraints Test23"; log_banner 1825 certImport nameConstraintsRFC822CA2Cert 1826 crlImport nameConstraintsRFC822CA2CRL.crl 1827 pkits $certs/ValidRFC822nameConstraintsTest23EE.crt \ 1828 $certs/nameConstraintsRFC822CA2Cert.crt 1829 restore_db 1830 1831 VFY_ACTION="Invalid RFC822 nameConstraints Test24"; log_banner 1832 certImport nameConstraintsRFC822CA2Cert 1833 crlImport nameConstraintsRFC822CA2CRL.crl 1834 pkitsn $certs/InvalidRFC822nameConstraintsTest24EE.crt \ 1835 $certs/nameConstraintsRFC822CA2Cert.crt 1836 restore_db 1837 1838 VFY_ACTION="Valid RFC822 nameConstraints Test25"; log_banner 1839 certImport nameConstraintsRFC822CA3Cert 1840 crlImport nameConstraintsRFC822CA3CRL.crl 1841 pkits $certs/ValidRFC822nameConstraintsTest25EE.crt \ 1842 $certs/nameConstraintsRFC822CA3Cert.crt 1843 restore_db 1844 1845 VFY_ACTION="Invalid RFC822 nameConstraints Test26"; log_banner 1846 certImport nameConstraintsRFC822CA3Cert 1847 crlImport nameConstraintsRFC822CA3CRL.crl 1848 pkitsn $certs/InvalidRFC822nameConstraintsTest26EE.crt \ 1849 $certs/nameConstraintsRFC822CA3Cert.crt 1850 restore_db 1851 1852 VFY_ACTION="Valid DN and RFC822 nameConstraints Test27"; log_banner 1853 certImport nameConstraintsDN1CACert 1854 crlImport nameConstraintsDN1CACRL.crl 1855 certImport nameConstraintsDN1subCA3Cert 1856 crlImport nameConstraintsDN1subCA3CRL.crl 1857 pkits $certs/ValidDNandRFC822nameConstraintsTest27EE.crt \ 1858 $certs/nameConstraintsDN1subCA3Cert.crt \ 1859 $certs/nameConstraintsDN1CACert.crt 1860 restore_db 1861 1862 VFY_ACTION="Invalid DN and RFC822 nameConstraints Test28"; log_banner 1863 certImport nameConstraintsDN1CACert 1864 crlImport nameConstraintsDN1CACRL.crl 1865 certImport nameConstraintsDN1subCA3Cert 1866 crlImport nameConstraintsDN1subCA3CRL.crl 1867 pkitsn $certs/InvalidDNandRFC822nameConstraintsTest28EE.crt \ 1868 $certs/nameConstraintsDN1subCA3Cert.crt \ 1869 $certs/nameConstraintsDN1CACert.crt 1870 restore_db 1871 1872 VFY_ACTION="Invalid DN and RFC822 nameConstraints Test29"; log_banner 1873 certImport nameConstraintsDN1CACert 1874 crlImport nameConstraintsDN1CACRL.crl 1875 certImport nameConstraintsDN1subCA3Cert 1876 crlImport nameConstraintsDN1subCA3CRL.crl 1877 pkitsn $certs/InvalidDNandRFC822nameConstraintsTest29EE.crt \ 1878 $certs/nameConstraintsDN1subCA3Cert.crt \ 1879 $certs/nameConstraintsDN1CACert.crt 1880 restore_db 1881 1882 VFY_ACTION="Valid DNS nameConstraints Test30"; log_banner 1883 certImport nameConstraintsDNS1CACert 1884 crlImport nameConstraintsDNS1CACRL.crl 1885 pkits $certs/ValidDNSnameConstraintsTest30EE.crt \ 1886 $certs/nameConstraintsDNS1CACert.crt 1887 restore_db 1888 1889 VFY_ACTION="Invalid DNS nameConstraints Test31"; log_banner 1890 certImport nameConstraintsDNS1CACert 1891 crlImport nameConstraintsDNS1CACRL.crl 1892 pkitsn $certs/InvalidDNSnameConstraintsTest31EE.crt \ 1893 $certs/nameConstraintsDNS1CACert.crt 1894 restore_db 1895 1896 VFY_ACTION="Valid DNS nameConstraints Test32"; log_banner 1897 certImport nameConstraintsDNS2CACert 1898 crlImport nameConstraintsDNS2CACRL.crl 1899 pkits $certs/ValidDNSnameConstraintsTest32EE.crt \ 1900 $certs/nameConstraintsDNS2CACert.crt 1901 restore_db 1902 1903 VFY_ACTION="Invalid DNS nameConstraints Test33"; log_banner 1904 certImport nameConstraintsDNS2CACert 1905 crlImport nameConstraintsDNS2CACRL.crl 1906 pkitsn $certs/InvalidDNSnameConstraintsTest33EE.crt \ 1907 $certs/nameConstraintsDNS2CACert.crt 1908 restore_db 1909 1910 VFY_ACTION="Valid URI nameConstraints Test34"; log_banner 1911 certImport nameConstraintsURI1CACert 1912 crlImport nameConstraintsURI1CACRL.crl 1913 pkits $certs/ValidURInameConstraintsTest34EE.crt \ 1914 $certs/nameConstraintsURI1CACert.crt 1915 restore_db 1916 1917 VFY_ACTION="Invalid URI nameConstraints Test35"; log_banner 1918 certImport nameConstraintsURI1CACert 1919 crlImport nameConstraintsURI1CACRL.crl 1920 pkitsn $certs/InvalidURInameConstraintsTest35EE.crt \ 1921 $certs/nameConstraintsURI1CACert.crt 1922 restore_db 1923 1924 VFY_ACTION="Valid URI nameConstraints Test36"; log_banner 1925 certImport nameConstraintsURI2CACert 1926 crlImport nameConstraintsURI2CACRL.crl 1927 pkits $certs/ValidURInameConstraintsTest36EE.crt \ 1928 $certs/nameConstraintsURI2CACert.crt 1929 restore_db 1930 1931 VFY_ACTION="Invalid URI nameConstraints Test37"; log_banner 1932 certImport nameConstraintsURI2CACert 1933 crlImport nameConstraintsURI2CACRL.crl 1934 pkitsn $certs/InvalidURInameConstraintsTest37EE.crt \ 1935 $certs/nameConstraintsURI2CACert.crt 1936 restore_db 1937 1938 VFY_ACTION="Invalid DNS nameConstraints Test38"; log_banner 1939 certImport nameConstraintsDNS1CACert 1940 crlImport nameConstraintsDNS1CACRL.crl 1941 pkitsn $certs/InvalidDNSnameConstraintsTest38EE.crt \ 1942 $certs/nameConstraintsDNS1CACert.crt 1943 restore_db 1944 } 1945 1946 pkits_PvtCertExtensions() 1947 { 1948 break_table "NIST PKITS Section 4.16: Private Certificate Extensions" 1949 1950 VFY_ACTION="Valid Unknown Not Critical Certificate Extension Test1"; log_banner 1951 pkits $certs/ValidUnknownNotCriticalCertificateExtensionTest1EE.crt 1952 1953 VFY_ACTION="Invalid Unknown Critical Certificate Extension Test2"; log_banner 1954 pkitsn $certs/InvalidUnknownCriticalCertificateExtensionTest2EE.crt 1955 } 1956 1957 ############################## pkits_cleanup ########################### 1958 # local shell function to finish this script (no exit since it might be 1959 # sourced) 1960 ######################################################################## 1961 pkits_cleanup() 1962 { 1963 html "</TABLE><BR>" 1964 cd ${QADIR} 1965 . common/cleanup.sh 1966 } 1967 1968 1969 ################################## main ################################ 1970 pkits_init 1971 pkits_SignatureVerification | tee -a $PKITS_LOG 1972 pkits_ValidityPeriods | tee -a $PKITS_LOG 1973 pkits_NameChaining | tee -a $PKITS_LOG 1974 pkits_BasicCertRevocation | tee -a $PKITS_LOG 1975 pkits_PathVerificWithSelfIssuedCerts | tee -a $PKITS_LOG 1976 pkits_BasicConstraints | tee -a $PKITS_LOG 1977 pkits_KeyUsage | tee -a $PKITS_LOG 1978 if [ -n "$NSS_PKITS_POLICIES" ]; then 1979 pkits_CertificatePolicies | tee -a $PKITS_LOG 1980 pkits_RequireExplicitPolicy | tee -a $PKITS_LOG 1981 pkits_PolicyMappings | tee -a $PKITS_LOG 1982 pkits_InhibitPolicyMapping | tee -a $PKITS_LOG 1983 pkits_InhibitAnyPolicy | tee -a $PKITS_LOG 1984 fi 1985 pkits_NameConstraints | tee -a $PKITS_LOG 1986 pkits_PvtCertExtensions | tee -a $PKITS_LOG 1987 pkits_cleanup