xref: /openssl-master/test/recipes/25-test_verify.t

20 sub verify {
35 ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),
39 ok(!verify("ee-cert", "sslserver", [qw(root-nonca)], [qw(ca-cert)]),
41 ok(!verify("ee-cert", "sslserver", [qw(nroot+serverAuth)], [qw(ca-cert)]),
43 ok(!verify("ee-cert", "sslserver", [qw(nroot+anyEKU)], [qw(ca-cert)]),
45 ok(!verify("ee-cert", "sslserver", [qw(root-cert2)], [qw(ca-cert)]),
47 ok(!verify("ee-cert", "sslserver", [qw(root-name2)], [qw(ca-cert)]),
52 ok(verify("ee-cert-noncrit-unknown-ext", "", ["root-cert"], ["ca-cert"]),
54 ok(!verify("ee-cert-crit-unknown-ext", "", ["root-cert"], ["ca-cert"]),
56 ok(verify("ee-cert-ocsp-nocheck", "", ["root-cert"], ["ca-cert"]),
61 ok(verify("ee-cert", "sslserver", [qw(sroot-cert)], [qw(ca-cert)]),
63 ok(!verify("ee-cert", "sslserver", [qw(croot-cert)], [qw(ca-cert)]),
65 ok(verify("ee-cert", "sslserver", [qw(root+serverAuth)], [qw(ca-cert)]),
67 ok(verify("ee-cert", "sslserver", [qw(sroot+serverAuth)], [qw(ca-cert)]),
69 ok(verify("ee-cert", "sslserver", [qw(croot+serverAuth)], [qw(ca-cert)]),
72 ok(verify("ee-cert", "sslserver", [qw(root+anyEKU)], [qw(ca-cert)]),
74 ok(verify("ee-cert", "sslserver", [qw(sroot+anyEKU)], [qw(ca-cert)]),
76 ok(verify("ee-cert", "sslserver", [qw(croot+anyEKU)], [qw(ca-cert)]),
79 ok(verify("ee-cert", "sslserver", [qw(root-clientAuth)], [qw(ca-cert)]),
81 ok(verify("ee-cert", "sslserver", [qw(sroot-clientAuth)], [qw(ca-cert)]),
83 ok(!verify("ee-cert", "sslserver", [qw(croot-clientAuth)], [qw(ca-cert)]),
86 ok(!verify("ee-cert", "sslserver", [qw(root+clientAuth)], [qw(ca-cert)]),
88 ok(!verify("ee-cert", "sslserver", [qw(sroot+clientAuth)], [qw(ca-cert)]),
90 ok(!verify("ee-cert", "sslserver", [qw(croot+clientAuth)], [qw(ca-cert)]),
93 ok(!verify("ee-cert", "sslserver", [qw(root-serverAuth)], [qw(ca-cert)]),
95 ok(!verify("ee-cert", "sslserver", [qw(sroot-serverAuth)], [qw(ca-cert)]),
97 ok(!verify("ee-cert", "sslserver", [qw(croot-serverAuth)], [qw(ca-cert)]),
100 ok(!verify("ee-cert", "sslserver", [qw(root-anyEKU)], [qw(ca-cert)]),
102 ok(!verify("ee-cert", "sslserver", [qw(sroot-anyEKU)], [qw(ca-cert)]),
104 ok(!verify("ee-cert", "sslserver", [qw(croot-anyEKU)], [qw(ca-cert)]),
110 ok(verify("ee-cert", "sslserver", [qw(root-serverAuth root-cert2 ca-root2)],
113 ok(verify("ee-cert", "sslserver", [qw(root-cert root2+serverAuth ca-root2)],
116 ok(!verify("ee-cert", "sslserver", [qw(root-cert root2-serverAuth ca-root2)],
119 ok(!verify("ee-cert", "sslserver", [qw(root-cert root2+clientAuth ca-root2)],
124 ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-nonca)]),
126 ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-nonbc)]),
128 ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-nonca)], []),
130 ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-nonbc)], []),
132 ok(!verify("ee-cert", "sslserver", [qw(root-cert nca+serverAuth)], []),
134 ok(!verify("ee-cert", "sslserver", [qw(root-cert nca+anyEKU)], []),
136 ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-cert2)]),
138 ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-name2)]),
140 ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-root2)]),
142 ok(!verify("ee-cert", "sslserver", [], [qw(ca-cert)], "-partial_chain"),
144 ok(verify("ee-cert", "sslserver", [qw(ca-cert)], [], "-partial_chain"),
146 ok(!verify("ee-cert", "sslserver", [qw(ca-expired)], [], "-partial_chain"),
148 ok(!verify("ee-cert", "sslserver", [qw(root-expired)], [qw(ca-cert)]),
150 ok(verify("ee-cert", "sslserver", [qw(sca-cert)], [], "-partial_chain"),
152 ok(!verify("ee-cert", "sslserver", [qw(cca-cert)], [], "-partial_chain"),
154 ok(verify("ee-cert", "sslserver", [qw(ca+serverAuth)], [], "-partial_chain"),
156 ok(verify("ee-cert", "sslserver", [qw(cca+serverAuth)], [], "-partial_chain"),
158 ok(verify("ee-cert", "sslserver", [qw(ca-clientAuth)], [], "-partial_chain"),
160 ok(verify("ee-cert", "sslserver", [qw(ca+anyEKU)], [], "-partial_chain"),
162 ok(!verify("ee-cert", "sslserver", [], [qw(ca+serverAuth)], "-partial_chain"),
164 ok(!verify("ee-cert", "sslserver", [qw(ca-serverAuth)], [], "-partial_chain"),
166 ok(!verify("ee-cert", "sslserver", [qw(ca+clientAuth)], [], "-partial_chain"),
168 ok(!verify("ee-cert", "sslserver", [qw(ca-anyEKU)], [], "-partial_chain"),
174 ok(verify("ee-cert", "sslserver", [qw(root-cert ca+serverAuth)], [qw(ca-cert)]),
176 ok(verify("ee-cert", "sslserver", [qw(root-cert ca+anyEKU)], [qw(ca-cert)]),
178 ok(verify("ee-cert", "sslserver", [qw(root-cert sca-cert)], [qw(ca-cert)]),
180 ok(verify("ee-cert", "sslserver", [qw(root-cert sca+serverAuth)], [qw(ca-cert)]),
182 ok(verify("ee-cert", "sslserver", [qw(root-cert sca+anyEKU)], [qw(ca-cert)]),
184 ok(verify("ee-cert", "sslserver", [qw(root-cert sca-clientAuth)], [qw(ca-cert)]),
186 ok(verify("ee-cert", "sslserver", [qw(root-cert cca+serverAuth)], [qw(ca-cert)]),
188 ok(verify("ee-cert", "sslserver", [qw(root-cert cca+anyEKU)], [qw(ca-cert)]),
190 ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-cert)], [qw(ca-cert)]),
192 ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-anyEKU)], [qw(ca-cert)]),
194 ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-serverAuth)], [qw(ca-cert)]),
196 ok(!verify("ee-cert", "sslserver", [qw(root-cert ca+clientAuth)], [qw(ca-cert)]),
198 ok(!verify("ee-cert", "sslserver", [qw(root-cert sca+clientAuth)], [qw(ca-cert)]),
200 ok(!verify("ee-cert", "sslserver", [qw(root-cert cca+clientAuth)], [qw(ca-cert)]),
202 ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-serverAuth)], [qw(ca-cert)]),
204 ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-clientAuth)], [qw(ca-cert)]),
206 ok(!verify("ee-cert", "sslserver", [qw(root-cert sca-serverAuth)], [qw(ca-cert)]),
208 ok(!verify("ee-cert", "sslserver", [qw(root-cert sca-anyEKU)], [qw(ca-cert)]),
210 ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-anyEKU)], [qw(ca-cert)]),
214 ok(verify("ee-client", "sslclient", [qw(root-cert)], [qw(ca-cert)]),
216 ok(!verify("ee-client", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
218 ok(!verify("ee-cert", "sslclient", [qw(root-cert)], [qw(ca-cert)]),
220 ok(!verify("ee-cert2", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
222 ok(!verify("ee-name2", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
224 ok(!verify("ee-expired", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
226 ok(verify("ee-cert", "sslserver", [qw(ee-cert)], [], "-partial_chain"),
228 ok(verify("ee-client", "sslclient", [qw(ee-client)], [], "-partial_chain"),
230 ok(!verify("ee-cert", "sslserver", [qw(ee-client)], [], "-partial_chain"),
232 ok(verify("ee-cert", "sslserver", [qw(ee+serverAuth)], [], "-partial_chain"),
234 ok(!verify("ee-cert", "sslserver", [qw(ee-serverAuth)], [], "-partial_chain"),
236 ok(verify("ee-client", "sslclient", [qw(ee+clientAuth)], [], "-partial_chain"),
238 ok(!verify("ee-client", "sslclient", [qw(ee-clientAuth)], [], "-partial_chain"),
240 ok(verify("ee-pathlen", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
242 ok(!verify("ee-pathlen", "sslserver", [qw(root-cert)], [qw(ca-cert)], "-x509_strict"),
246 ok(!verify("pc1-cert", "sslclient", [qw(root-cert)], [qw(ee-client ca-cert)]),
248 ok(verify("pc1-cert", "sslclient", [qw(root-cert)], [qw(ee-client ca-cert)],
251 ok(verify("pc2-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],
254 ok(!verify("bad-pc3-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],
257 ok(!verify("bad-pc4-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],
260 ok(verify("pc5-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],
263 ok(!verify("pc6-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],
268 ok(verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
270 ok(!verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "3"),
272 ok(verify("ee-cert", "", ["root-cert-768"], ["ca-cert-768i"], "-auth_level", "0"),
274 ok(!verify("ee-cert", "", ["root-cert-768"], ["ca-cert-768i"]),
276 ok(verify("ee-cert-768i", "", ["root-cert"], ["ca-cert-768"], "-auth_level", "0"),
278 ok(!verify("ee-cert-768i", "", ["root-cert"], ["ca-cert-768"]),
280 ok(verify("ee-cert-768", "", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
282 ok(!verify("ee-cert-768", "", ["root-cert"], ["ca-cert"]),
285 ok(verify("ee-cert", "", ["root-cert-md5"], ["ca-cert"], "-auth_level", "2"),
287 ok(verify("ee-cert", "", ["ca-cert-md5-any"], [], "-auth_level", "2"),
289 ok(verify("ee-cert", "", ["root-cert"], ["ca-cert-md5"], "-auth_level", "0"),
291 ok(!verify("ee-cert", "", ["root-cert"], ["ca-cert-md5"]),
293 ok(verify("ee-cert-md5", "", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
295 ok(!verify("ee-cert-md5", "", ["root-cert"], ["ca-cert"]),
302     ok(!verify("ee-cert-ec-explicit", "", ["root-cert"],
305     ok(!verify("ee-cert-ec-named-explicit", "", ["root-cert"],
308     ok(verify("ee-cert-ec-named-named", "", ["root-cert"],
317 ok(verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-verify_depth", "2"),
319 ok(verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-verify_depth", "1"),
321 ok(!verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-verify_depth", "0"),
323 ok(verify("ee-cert", "", ["ca-cert-md5-any"], [], "-verify_depth", "0"),
328 ok(verify("alt1-cert", "", ["root-cert"], ["ncca1-cert"], ),
331 ok(verify("alt2-cert", "", ["root-cert"], ["ncca2-cert"], ),
334 ok(verify("alt3-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
337 ok(verify("goodcn1-cert", "", ["root-cert"], ["ncca1-cert"], ),
340 ok(!verify("badcn1-cert", "", ["root-cert"], ["ncca1-cert"], ),
343 ok(!verify("badalt1-cert", "", ["root-cert"], ["ncca1-cert"], ),
346 ok(!verify("badalt2-cert", "", ["root-cert"], ["ncca2-cert"], ),
349 ok(!verify("badalt3-cert", "", ["root-cert"], ["ncca1-cert"], ),
352 ok(!verify("badalt4-cert", "", ["root-cert"], ["ncca1-cert"], ),
355 ok(!verify("badalt5-cert", "", ["root-cert"], ["ncca1-cert"], ),
358 ok(!verify("badalt6-cert", "", ["root-cert"], ["ncca1-cert"], ),
361 ok(!verify("badalt7-cert", "", ["root-cert"], ["ncca1-cert"], ),
364 ok(!verify("badalt8-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
367 ok(!verify("badalt9-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
370 ok(!verify("badalt10-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
376          ok(verify("bad-othername-namec", "", ["bad-othername-namec-inter"], [],
381 ok(verify("ee-pss-sha1-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
384 ok(verify("ee-pss-sha256-cert", "", ["root-cert"], ["ca-cert"], ),
387 ok(!verify("ee-pss-sha1-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "1"),
390 ok(verify("ee-pss-sha256-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
393 ok(verify("ee-pss-cert", "", ["root-cert"], ["ca-pss-cert"], ),
395 ok(!verify("ee-pss-wrong1.5-cert", "", ["root-cert"], ["ca-pss-cert"], ),
398 ok(!verify("many-names1", "", ["many-constraints"], ["many-constraints"], ),
400 ok(!verify("many-names2", "", ["many-constraints"], ["many-constraints"], ),
402 ok(!verify("many-names3", "", ["many-constraints"], ["many-constraints"], ),
405 ok(verify("some-names1", "", ["many-constraints"], ["many-constraints"], ),
407 ok(verify("some-names2", "", ["many-constraints"], ["many-constraints"], ),
409 ok(verify("some-names2", "", ["many-constraints"], ["many-constraints"], ),
411 ok(verify("root-cert-rsa2", "", ["root-cert-rsa2"], [], "-check_ss_sig"),
414 ok(verify("ee-self-signed", "", ["ee-self-signed"], [], "-attime", "1593565200"),
416 ok(verify("ee-ss-with-keyCertSign", "", ["ee-ss-with-keyCertSign"], []),
424     ok(verify("ee-ed25519", "", ["root-ed25519"], []),
427     ok(!verify("ee-ed25519", "", ["root-ed25519"], [], "-x509_strict"),
430     ok(!verify("root-ed25519", "", ["ee-ed25519"], []),
433     ok(verify("root-ed25519", "", ["root-ed25519"], []),
436     ok(!verify("ee-ed25519", "", ["ee-ed25519"], []),
439     ok(verify("ee-ed25519", "", ["ee-ed25519"], [], "-partial_chain"),
447    ok_nofips(verify("sm2", "", ["sm2-ca-cert"], [], "-vfyopt", "distid:1234567812345678"),
449 …ok_nofips(verify("sm2", "", ["sm2-ca-cert"], [], "-vfyopt", "hexdistid:313233343536373831323334353…

Last Index update Sun Aug 20 00:18:20 CST 2023