diff options
author | Ben Laurie <ben@openssl.org> | 2012-12-07 18:47:47 +0000 |
---|---|---|
committer | Ben Laurie <ben@openssl.org> | 2012-12-07 18:47:47 +0000 |
commit | 30c278aa6bb614f4cfc5a26c7cbe66ad090f6896 (patch) | |
tree | 2b944cd0b8d7b29691ce91b67ce14634d4972964 /test/tocsp | |
parent | 083bec780da2573fe790d96faf2b1cc0f8363816 (diff) | |
download | openssl-30c278aa6bb614f4cfc5a26c7cbe66ad090f6896.tar.gz |
Fix OCSP checking.
Diffstat (limited to 'test/tocsp')
-rw-r--r-- | test/tocsp | 394 |
1 files changed, 394 insertions, 0 deletions
diff --git a/test/tocsp b/test/tocsp new file mode 100644 index 0000000000..eabaf8765c --- /dev/null +++ b/test/tocsp @@ -0,0 +1,394 @@ +#!/bin/sh + +cmd='../util/shlib_wrap.sh ../apps/openssl' +ocspdir="ocsp-tests" +stdparams="-trust_other -CApath /dev/null" + +for resp in `ls -1 $ocspdir/*.ors` +do + $cmd base64 -d -in $resp -out $resp.der +done + +echo "=== VALID OCSP RESPONSES ===" +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi + +echo "=== INVALID SIGNATURE on the OCSP RESPONSE ===" +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/ISOP_ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/ISOP_ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/ISOP_ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/ISOP_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/ISOP_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/ISOP_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi + +echo "=== WRONG RESPONDERID in the OCSP RESPONSE ===" +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/WRID_ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/WRID_ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/WRID_ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/WRID_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/WRID_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/WRID_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi + +echo "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/WINH_ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/WINH_ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/WINH_ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/WINH_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/WINH_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/WINH_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi + +echo "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/WIKH_ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/WIKH_ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/WIKH_ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/WIKH_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/WIKH_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/WIKH_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi + +echo "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/WKDOSC_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $std_params +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/WKDOSC_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $std_params +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/WKDOSC_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $std_params +if [ $? = 0 ]; then exit 1; fi + +echo "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/ISDOSC_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/ISDOSC_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/ISDOSC_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi + +echo "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/ND1.ors.der -verify_other $ocspdir/WSNIC_ND1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/ND2.ors.der -verify_other $ocspdir/WSNIC_ND2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/ND3.ors.der -verify_other $ocspdir/WSNIC_ND3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/D1.ors.der -verify_other $ocspdir/WSNIC_D1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/D2.ors.der -verify_other $ocspdir/WSNIC_D2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/D3.ors.der -verify_other $ocspdir/WSNIC_D3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi + +echo "=== WRONG KEY in the ISSUER CERTIFICATE ===" +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/ND1.ors.der -verify_other $ocspdir/WKIC_ND1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/ND2.ors.der -verify_other $ocspdir/WKIC_ND2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/ND3.ors.der -verify_other $ocspdir/WKIC_ND3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/D1.ors.der -verify_other $ocspdir/WKIC_D1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/D2.ors.der -verify_other $ocspdir/WKIC_D2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/D3.ors.der -verify_other $ocspdir/WKIC_D3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi + +echo "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" +# Expect success, because we're explicitly trusting the issuer certificate. +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/ND1.ors.der -verify_other $ocspdir/ISIC_ND1_Issuer_ICA.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/ND2.ors.der -verify_other $ocspdir/ISIC_ND2_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/ND3.ors.der -verify_other $ocspdir/ISIC_ND3_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/D1.ors.der -verify_other $ocspdir/ISIC_D1_Issuer_ICA.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/D2.ors.der -verify_other $ocspdir/ISIC_D2_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/D3.ors.der -verify_other $ocspdir/ISIC_D3_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi + +/bin/rm $ocspdir/*.ors.der +echo "ALL OCSP TESTS SUCCESSFUL" +exit 0 +#!/bin/sh + +cmd='../util/shlib_wrap.sh ../apps/openssl' +ocspdir="ocsp-tests" +stdparams="-trust_other -CApath /dev/null" + +for resp in `ls -1 $ocspdir/*.ors` +do + $cmd base64 -d -in $resp -out $resp.der +done + +echo "=== VALID OCSP RESPONSES ===" +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi + +echo "=== INVALID SIGNATURE on the OCSP RESPONSE ===" +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/ISOP_ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/ISOP_ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/ISOP_ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/ISOP_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/ISOP_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/ISOP_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi + +echo "=== WRONG RESPONDERID in the OCSP RESPONSE ===" +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/WRID_ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/WRID_ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/WRID_ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/WRID_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/WRID_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/WRID_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi + +echo "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/WINH_ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/WINH_ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/WINH_ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/WINH_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/WINH_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/WINH_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi + +echo "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/WIKH_ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/WIKH_ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/WIKH_ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/WIKH_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/WIKH_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/WIKH_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi + +echo "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/WKDOSC_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $std_params +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/WKDOSC_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $std_params +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/WKDOSC_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $std_params +if [ $? = 0 ]; then exit 1; fi + +echo "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/ISDOSC_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/ISDOSC_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/ISDOSC_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi + +echo "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/ND1.ors.der -verify_other $ocspdir/WSNIC_ND1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/ND2.ors.der -verify_other $ocspdir/WSNIC_ND2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/ND3.ors.der -verify_other $ocspdir/WSNIC_ND3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/D1.ors.der -verify_other $ocspdir/WSNIC_D1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/D2.ors.der -verify_other $ocspdir/WSNIC_D2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/D3.ors.der -verify_other $ocspdir/WSNIC_D3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi + +echo "=== WRONG KEY in the ISSUER CERTIFICATE ===" +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/ND1.ors.der -verify_other $ocspdir/WKIC_ND1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/ND2.ors.der -verify_other $ocspdir/WKIC_ND2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/ND3.ors.der -verify_other $ocspdir/WKIC_ND3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/D1.ors.der -verify_other $ocspdir/WKIC_D1_Issuer_ICA.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/D2.ors.der -verify_other $ocspdir/WKIC_D2_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/D3.ors.der -verify_other $ocspdir/WKIC_D3_Issuer_Root.pem $stdparams +if [ $? = 0 ]; then exit 1; fi + +echo "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" +# Expect success, because we're explicitly trusting the issuer certificate. +echo "NON-DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/ND1.ors.der -verify_other $ocspdir/ISIC_ND1_Issuer_ICA.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/ND2.ors.der -verify_other $ocspdir/ISIC_ND2_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "NON-DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/ND3.ors.der -verify_other $ocspdir/ISIC_ND3_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "DELEGATED; Intermediate CA -> EE" +$cmd ocsp -respin $ocspdir/D1.ors.der -verify_other $ocspdir/ISIC_D1_Issuer_ICA.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> Intermediate CA" +$cmd ocsp -respin $ocspdir/D2.ors.der -verify_other $ocspdir/ISIC_D2_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi +echo "DELEGATED; Root CA -> EE" +$cmd ocsp -respin $ocspdir/D3.ors.der -verify_other $ocspdir/ISIC_D3_Issuer_Root.pem $stdparams +if [ $? != 0 ]; then exit 1; fi + +/bin/rm $ocspdir/*.ors.der +echo "ALL OCSP TESTS SUCCESSFUL" +exit 0 |