diff options
| author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2019-12-23 20:15:49 +0100 |
|---|---|---|
| committer | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-07-01 11:14:54 +0200 |
| commit | 4acd484d55ac3c86091e42f81479f514d0cf8b17 (patch) | |
| tree | 2e1fb69cc6590d10c086e37075ff3edfc3c93d74 /test/recipes | |
| parent | 023697870bcd4372a142a606546253d719a81024 (diff) | |
| download | openssl-4acd484d55ac3c86091e42f81479f514d0cf8b17.tar.gz | |
Make x509 -force_pubkey test case with self-issued cert more realistic
by adding CA basic constraints, CA key usage, and key IDs to the cert
and by add -partial_chain to the verify call that trusts this cert
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/10587)
Diffstat (limited to 'test/recipes')
| -rw-r--r-- | test/recipes/25-test_x509.t | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/test/recipes/25-test_x509.t b/test/recipes/25-test_x509.t index 427c6b7fea..250738487a 100644 --- a/test/recipes/25-test_x509.t +++ b/test/recipes/25-test_x509.t @@ -41,6 +41,7 @@ SKIP: { # producing and checking self-issued (but not self-signed) cert my @path = qw(test certs); my $subj = "/CN=CA"; # using same DN as in issuer of ee-cert.pem + my $extfile = srctop_file("test", "v3_ca_exts.cnf"); my $pkey = srctop_file(@path, "ca-key.pem"); # issuer private key my $pubkey = "ca-pubkey.pem"; # the corresponding issuer public key # use any (different) key for signing our self-issued cert: @@ -50,10 +51,13 @@ SKIP: { ok(run(app(["openssl", "pkey", "-in", $pkey, "-pubout", "-out", $pubkey])) && run(app(["openssl", "x509", "-new", "-force_pubkey", $pubkey, - "-subj", $subj, "-signkey", $signkey, "-out", $selfout])) + "-subj", $subj, "-extfile", $extfile, + "-signkey", $signkey, "-out", $selfout])) && run(app(["openssl", "verify", "-no_check_time", - "-trusted", $selfout, $testcert]))); + "-trusted", $selfout, "-partial_chain", $testcert]))); + unlink $pubkey; + unlink $selfout; } subtest 'x509 -- x.509 v1 certificate' => sub { |