mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-12-21 06:50:10 +08:00
Code Issues Packages Projects Releases Wiki Activity
fadb2ee6ec
curl/tests/certs/Server-localhost-sv.pem

163 lines
7.9 KiB
Plaintext
Raw Normal View History

- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
extensions = x509v3
CI: add whitespace checker Fix issues detected. Also: - One of the `.vc` files used LF EOLs, while the other didn't. Make that one also use LF EOLs, as this is apparently supported by `nmake`. - Drop `.dsw` and `.btn` types from `.gitattributes`. The repository doesn't use them. - Sync section order with the rest of files in `tests/certs/EdelCurlRoot-ca.prm`. - Indent/align `.prm` and `.pem` files. - Delete dummy `[something]` section from `.prm` and `.pem` files. Mental note: MSVC `.sln` files seem to accept spaces for indentation and also support LF line-endings. I cannot test this and I don't know what's more convenient when updating them, so left them as-is, with specific exclusions. Closes #14031
2024-06-27 08:38:38 +08:00
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
[ x509v3 ]
CI: add whitespace checker Fix issues detected. Also: - One of the `.vc` files used LF EOLs, while the other didn't. Make that one also use LF EOLs, as this is apparently supported by `nmake`. - Drop `.dsw` and `.btn` types from `.gitattributes`. The repository doesn't use them. - Sync section order with the rest of files in `tests/certs/EdelCurlRoot-ca.prm`. - Indent/align `.prm` and `.pem` files. - Delete dummy `[something]` section from `.prm` and `.pem` files. Mental note: MSVC `.sln` files seem to accept spaces for indentation and also support LF line-endings. I cannot test this and I don't know what's more convenient when updating them, so left them as-is, with specific exclusions. Closes #14031
2024-06-27 08:38:38 +08:00
subjectAltName = DNS:localhost
keyUsage = keyEncipherment,digitalSignature,keyAgreement
extendedKeyUsage = serverAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid
basicConstraints = CA:false
tests: add authorityInfoAccess to generated certs Generate stunnel.pem as well Closes #9980
2022-11-25 21:00:48 +08:00
authorityInfoAccess = @issuer_info
crlDistributionPoints = @crl_info
[ crl_ext ]
authorityKeyIdentifier = keyid:always
authorityInfoAccess = @issuer_info
[ issuer_info ]
caIssuers;URI.0 = http://test.curl.se/ca/EdelCurlRoot.cer
[ crl_info ]
URI.0 = http://test.curl.se/ca/EdelCurlRoot.crl
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
[ req ]
CI: add whitespace checker Fix issues detected. Also: - One of the `.vc` files used LF EOLs, while the other didn't. Make that one also use LF EOLs, as this is apparently supported by `nmake`. - Drop `.dsw` and `.btn` types from `.gitattributes`. The repository doesn't use them. - Sync section order with the rest of files in `tests/certs/EdelCurlRoot-ca.prm`. - Indent/align `.prm` and `.pem` files. - Delete dummy `[something]` section from `.prm` and `.pem` files. Mental note: MSVC `.sln` files seem to accept spaces for indentation and also support LF line-endings. I cannot test this and I don't know what's more convenient when updating them, so left them as-is, with specific exclusions. Closes #14031
2024-06-27 08:38:38 +08:00
default_bits = 1024
distinguished_name = req_DN
default_md = sha256
string_mask = utf8only
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
CI: add whitespace checker Fix issues detected. Also: - One of the `.vc` files used LF EOLs, while the other didn't. Make that one also use LF EOLs, as this is apparently supported by `nmake`. - Drop `.dsw` and `.btn` types from `.gitattributes`. The repository doesn't use them. - Sync section order with the rest of files in `tests/certs/EdelCurlRoot-ca.prm`. - Indent/align `.prm` and `.pem` files. - Delete dummy `[something]` section from `.prm` and `.pem` files. Mental note: MSVC `.sln` files seem to accept spaces for indentation and also support LF line-endings. I cannot test this and I don't know what's more convenient when updating them, so left them as-is, with specific exclusions. Closes #14031
2024-06-27 08:38:38 +08:00
[ req_DN ]
countryName = "Country Name is Northern Nowhere"
countryName_value = NN
organizationName = "Organization Name"
organizationName_value = Edel Curl Arctic Illudium Research Cloud
commonName = "Common Name"
commonName_value = localhost
tests: avoid use of sha1 in certificates The SHA-1 algorithm is deprecated (particularly for security-sensitive applications) in a variety of OS environments. This already affects RHEL-9 and derivatives, which are not willing to use certificates using that algorithm. The fix is to use sha256 instead, which is already used for most of the other certificates in the test suite. Fixes #10135 This gets rid of issues related to sha1 signatures. Manual steps after "make clean-certs" and "make build-certs": - Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem (make clean-certs does not remove the original tests/stunnel.pem) - Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey options of tests/data/test2041 and tests/data/test2087 Closes #10153
2022-12-23 20:34:49 +08:00
-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDGuAQ91voxoNf3
6YhLWl5vb9v0yUt+bCrPNHsquhpxrX94bPceygfQKQNJ5GOGTPZnP70yacu4FecO
zyg9npaRjk9zqSd3TCZhzdbnTjxkwxO6juwDD7zUg7OU8r7QGDDFUknLmmDP87nK
L2OdNO6HOljnoZnd3FaH4aDXazeuuxPbffoqPZw5efYBpuM65xgUy8dXuYPRurgs
WsSXL+6NaEg3+BfbMrnqJU8oVwE5E9zA99DMZfkruEyhWxHOROIouWNi/Qj6ts1J
1bn+nmicmrUaPsy/DnTbUj8lMM19AkHHyYpYEjUlIZXEa8P1ecIAy+9/15+Jyf/A
uXJZTDNHAgMBAAECggEAH48J3WhOw6LvqYeFBbKMXNY+8FknjCRRiCaliNuVZ4hO
PinP9SvQodZhl1KWG7YNS8hrm54BpHKWB1wO3/pXnzYimBO9GM0XK2EtR/68yKPS
dkZMZRASxQ1Fb9o9Q38T/8JZxeP2jBAA6YMtJsJJP2Cczex0Ky/a7il/CbcVWMJF
VCqHEWCBge59xZifsKiAiK/Yw5W6uyi9OZ9a2D7bzJh0sojPIY90d7EhW4u/QCzk
aXn78RbgxDkQyz5AQrIQzEMcOYr+AxiVT5S1v15FoaoWlm1IrNpEmf63PvwRKPZM
ZW1cqR8onTQBndzAdwn9qHjtuRvhoHMe5RWs4rzDAQKBgQDTq2NGbkNdK14oSu7/
t+z4Z3nGhHmY9pI1jF5/s3ialO/7YD4ul5MXaJt6dbklkPqsN0vmhPeeavAy6tsG
iU4SdTuptKg5aZMZnDa9zu9lM4raJpDf9AuncffjVFqy9EDII5Wi1UIRDTD8D1gp
LBYuFUTpo7R+JD3yqLXvbOw8UQKBgQDwVkgTqbAwbx35sKhpFo0VOAj3GVZkC6zt
nFS03MmHPjge69u3B3I6oavYtwROq+6S9rj3MLuj4DhVbO5Yxi+XqY5wXhFUPPSp
1ejXF8aAwWtZEeMTTsaN8jl3nfzdNul8G5mVfpY/VmZMhuAXclsAR9ke/x+FcmrQ
Furd0lxIFwKBgQDSXVobzEf817YLW3WuBbBorAY1ysFCyYND3s6oIcjx8KWU8fC6
w3+3WwpyqX8pm63V7Frtriaede9k2050b498/rAeGGK8NHWylTM+buQzcwdDieKg
AN54Ouc/Mj217tRXVC5KF6JCahbN274lpSAiCpdjkIQ4fXJnsU6ntlwOEQKBgQDr
rCAHsAkGpZ+mPlYWnreADC+2ZtExT8WmRvtFU5AHH7sWj0An7ZRU7D5AR89gefZ7
hJaCRvZpTzDOi//5a3Y16V200Hl7uj5M4GbvrO/JSGHEuOaMA15uyQ0TQAg6wGMa
gVIMp1IcD9RGzKeoNkoIL2w4mgJF8JnPLfnnxSUaxwKBgQCXP6btCbX7fryeIfUB
PC1TOtyNvNWeoPJNT9eeNHxPC5VW2AC78XKxbHsVec16KJsOgj4Elc3h8/+X0wAU
7Zo9CD7M2i1Tm5sKh90yBsZsU6jBWOBorLQnatDKVPXHLblVAEgK0qTJTAW8hLDn
myYsFbt36qBXf1dVvo+5yhCxAw==
-----END PRIVATE KEY-----
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
Certificate:
Data:
Version: 3 (0x2)
tests: avoid use of sha1 in certificates The SHA-1 algorithm is deprecated (particularly for security-sensitive applications) in a variety of OS environments. This already affects RHEL-9 and derivatives, which are not willing to use certificates using that algorithm. The fix is to use sha256 instead, which is already used for most of the other certificates in the test suite. Fixes #10135 This gets rid of issues related to sha1 signatures. Manual steps after "make clean-certs" and "make build-certs": - Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem (make clean-certs does not remove the original tests/stunnel.pem) - Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey options of tests/data/test2041 and tests/data/test2087 Closes #10153
2022-12-23 20:34:49 +08:00
Serial Number: 16717980969532 (0xf3475512a3c)
Signature Algorithm: sha256WithRSAEncryption
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
Issuer:
countryName = NN
organizationName = Edel Curl Arctic Illudium Research Cloud
tests/certs: rebuild certificates with modified key usage bits The certificates were missing the digitalSignature and keyAgreement usage types, of which at least digitalSignature was checked by CyaSSL. This caused the test server in test 310 (among others) to fail the startup verification and therefore run (see http://curl.haxx.se/mail/lib-2014-07/0303.html).
2015-03-21 23:20:34 +08:00
commonName = Northern Nowhere Trust Anchor
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
Validity
tests: avoid use of sha1 in certificates The SHA-1 algorithm is deprecated (particularly for security-sensitive applications) in a variety of OS environments. This already affects RHEL-9 and derivatives, which are not willing to use certificates using that algorithm. The fix is to use sha256 instead, which is already used for most of the other certificates in the test suite. Fixes #10135 This gets rid of issues related to sha1 signatures. Manual steps after "make clean-certs" and "make build-certs": - Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem (make clean-certs does not remove the original tests/stunnel.pem) - Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey options of tests/data/test2041 and tests/data/test2087 Closes #10153
2022-12-23 20:34:49 +08:00
Not Before: Dec 23 12:21:36 2022 GMT
Not After : Mar 11 12:21:36 2031 GMT
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
Subject:
countryName = NN
organizationName = Edel Curl Arctic Illudium Research Cloud
commonName = localhost
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
tests: add authorityInfoAccess to generated certs Generate stunnel.pem as well Closes #9980
2022-11-25 21:00:48 +08:00
Public-Key: (2048 bit)
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
Modulus:
tests: avoid use of sha1 in certificates The SHA-1 algorithm is deprecated (particularly for security-sensitive applications) in a variety of OS environments. This already affects RHEL-9 and derivatives, which are not willing to use certificates using that algorithm. The fix is to use sha256 instead, which is already used for most of the other certificates in the test suite. Fixes #10135 This gets rid of issues related to sha1 signatures. Manual steps after "make clean-certs" and "make build-certs": - Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem (make clean-certs does not remove the original tests/stunnel.pem) - Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey options of tests/data/test2041 and tests/data/test2087 Closes #10153
2022-12-23 20:34:49 +08:00
00:c6:b8:04:3d:d6:fa:31:a0:d7:f7:e9:88:4b:5a:
5e:6f:6f:db:f4:c9:4b:7e:6c:2a:cf:34:7b:2a:ba:
1a:71:ad:7f:78:6c:f7:1e:ca:07:d0:29:03:49:e4:
63:86:4c:f6:67:3f:bd:32:69:cb:b8:15:e7:0e:cf:
28:3d:9e:96:91:8e:4f:73:a9:27:77:4c:26:61:cd:
d6:e7:4e:3c:64:c3:13:ba:8e:ec:03:0f:bc:d4:83:
b3:94:f2:be:d0:18:30:c5:52:49:cb:9a:60:cf:f3:
b9:ca:2f:63:9d:34:ee:87:3a:58:e7:a1:99:dd:dc:
56:87:e1:a0:d7:6b:37:ae:bb:13:db:7d:fa:2a:3d:
9c:39:79:f6:01:a6:e3:3a:e7:18:14:cb:c7:57:b9:
83:d1:ba:b8:2c:5a:c4:97:2f:ee:8d:68:48:37:f8:
17:db:32:b9:ea:25:4f:28:57:01:39:13:dc:c0:f7:
d0:cc:65:f9:2b:b8:4c:a1:5b:11:ce:44:e2:28:b9:
63:62:fd:08:fa:b6:cd:49:d5:b9:fe:9e:68:9c:9a:
b5:1a:3e:cc:bf:0e:74:db:52:3f:25:30:cd:7d:02:
41:c7:c9:8a:58:12:35:25:21:95:c4:6b:c3:f5:79:
c2:00:cb:ef:7f:d7:9f:89:c9:ff:c0:b9:72:59:4c:
33:47
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:localhost
X509v3 Key Usage:
tests/certs: rebuild certificates with modified key usage bits The certificates were missing the digitalSignature and keyAgreement usage types, of which at least digitalSignature was checked by CyaSSL. This caused the test server in test 310 (among others) to fail the startup verification and therefore run (see http://curl.haxx.se/mail/lib-2014-07/0303.html).
2015-03-21 23:20:34 +08:00
Digital Signature, Key Encipherment, Key Agreement
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Subject Key Identifier:
tests: avoid use of sha1 in certificates The SHA-1 algorithm is deprecated (particularly for security-sensitive applications) in a variety of OS environments. This already affects RHEL-9 and derivatives, which are not willing to use certificates using that algorithm. The fix is to use sha256 instead, which is already used for most of the other certificates in the test suite. Fixes #10135 This gets rid of issues related to sha1 signatures. Manual steps after "make clean-certs" and "make build-certs": - Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem (make clean-certs does not remove the original tests/stunnel.pem) - Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey options of tests/data/test2041 and tests/data/test2087 Closes #10153
2022-12-23 20:34:49 +08:00
4A:F1:79:1B:13:71:A4:0F:F9:06:CC:B6:2C:CD:24:46:DF:E6:08:2D
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
X509v3 Authority Key Identifier:
tests: avoid use of sha1 in certificates The SHA-1 algorithm is deprecated (particularly for security-sensitive applications) in a variety of OS environments. This already affects RHEL-9 and derivatives, which are not willing to use certificates using that algorithm. The fix is to use sha256 instead, which is already used for most of the other certificates in the test suite. Fixes #10135 This gets rid of issues related to sha1 signatures. Manual steps after "make clean-certs" and "make build-certs": - Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem (make clean-certs does not remove the original tests/stunnel.pem) - Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey options of tests/data/test2041 and tests/data/test2087 Closes #10153
2022-12-23 20:34:49 +08:00
87:CB:B1:33:2E:C1:67:7E:71:E3:E5:2B:4C:4D:A4:B3:6E:D2:5B:A9
tests/certs: rebuild certificates with modified key usage bits The certificates were missing the digitalSignature and keyAgreement usage types, of which at least digitalSignature was checked by CyaSSL. This caused the test server in test 310 (among others) to fail the startup verification and therefore run (see http://curl.haxx.se/mail/lib-2014-07/0303.html).
2015-03-21 23:20:34 +08:00
X509v3 Basic Constraints:
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
CA:FALSE
tests: add authorityInfoAccess to generated certs Generate stunnel.pem as well Closes #9980
2022-11-25 21:00:48 +08:00
Authority Information Access:
CA Issuers - URI:http://test.curl.se/ca/EdelCurlRoot.cer
X509v3 CRL Distribution Points:
Full Name:
URI:http://test.curl.se/ca/EdelCurlRoot.crl
certs: generate tests certs with sha256 digest algorithm As OpenSSL 1.1.1 starts to complain and fail on sha1 CAs: "SSL certificate problem: CA signature digest algorithm too weak" Closes #3014
2018-09-19 15:04:48 +08:00
Signature Algorithm: sha256WithRSAEncryption
tests: avoid use of sha1 in certificates The SHA-1 algorithm is deprecated (particularly for security-sensitive applications) in a variety of OS environments. This already affects RHEL-9 and derivatives, which are not willing to use certificates using that algorithm. The fix is to use sha256 instead, which is already used for most of the other certificates in the test suite. Fixes #10135 This gets rid of issues related to sha1 signatures. Manual steps after "make clean-certs" and "make build-certs": - Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem (make clean-certs does not remove the original tests/stunnel.pem) - Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey options of tests/data/test2041 and tests/data/test2087 Closes #10153
2022-12-23 20:34:49 +08:00
Signature Value:
67:ef:ad:8f:fa:ee:f1:fd:33:67:62:06:5f:09:55:7c:cf:82:
1a:e8:fc:f5:97:ba:63:bd:d0:a0:8b:85:2c:fc:f0:34:4a:97:
b2:18:d7:63:34:63:f4:1f:50:c7:0e:13:d9:bc:3b:73:3d:41:
93:16:b3:30:95:88:cd:75:c8:8c:58:4b:ab:96:e6:78:68:15:
0f:84:e7:8e:17:94:1a:b3:f3:12:ab:26:fd:fa:73:31:33:36:
85:83:2d:e3:3a:f2:a6:29:c6:37:30:3d:17:d2:39:31:d1:56:
1b:8d:df:fb:07:ad:81:0b:91:e5:bd:7b:37:a0:a0:5a:2c:33:
2b:8d:69:8b:d7:c1:45:61:85:ef:32:45:dd:00:a2:81:98:44:
0d:eb:01:95:fc:ac:0f:b5:34:a4:5f:35:5c:68:63:50:5a:69:
56:f3:99:c4:67:70:89:13:30:c0:64:ff:f1:a6:77:68:69:63:
9e:6f:f8:3c:6f:cd:af:7f:de:0d:87:55:ae:39:b3:b2:f5:4f:
47:79:1f:32:ee:ae:8f:32:dc:88:30:cd:38:6c:4b:28:55:c3:
7d:74:6b:de:d0:49:c9:05:ea:62:71:a6:f8:1e:76:da:3c:a7:
17:cd:1a:92:a3:c4:e8:85:d1:ad:34:0c:71:37:3f:6c:d3:7f:
9a:d6:ca:de
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
-----BEGIN CERTIFICATE-----
tests: avoid use of sha1 in certificates The SHA-1 algorithm is deprecated (particularly for security-sensitive applications) in a variety of OS environments. This already affects RHEL-9 and derivatives, which are not willing to use certificates using that algorithm. The fix is to use sha256 instead, which is already used for most of the other certificates in the test suite. Fixes #10135 This gets rid of issues related to sha1 signatures. Manual steps after "make clean-certs" and "make build-certs": - Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem (make clean-certs does not remove the original tests/stunnel.pem) - Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey options of tests/data/test2041 and tests/data/test2087 Closes #10153
2022-12-23 20:34:49 +08:00
MIIERDCCAyygAwIBAgIGDzR1USo8MA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
tests/certs: rebuild certificates with modified key usage bits The certificates were missing the digitalSignature and keyAgreement usage types, of which at least digitalSignature was checked by CyaSSL. This caused the test server in test 310 (among others) to fail the startup verification and therefore run (see http://curl.haxx.se/mail/lib-2014-07/0303.html).
2015-03-21 23:20:34 +08:00
IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
tests: avoid use of sha1 in certificates The SHA-1 algorithm is deprecated (particularly for security-sensitive applications) in a variety of OS environments. This already affects RHEL-9 and derivatives, which are not willing to use certificates using that algorithm. The fix is to use sha256 instead, which is already used for most of the other certificates in the test suite. Fixes #10135 This gets rid of issues related to sha1 signatures. Manual steps after "make clean-certs" and "make build-certs": - Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem (make clean-certs does not remove the original tests/stunnel.pem) - Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey options of tests/data/test2041 and tests/data/test2087 Closes #10153
2022-12-23 20:34:49 +08:00
Fw0yMjEyMjMxMjIxMzZaFw0zMTAzMTExMjIxMzZaMFQxCzAJBgNVBAYTAk5OMTEw
tests/certs: rebuild certificates with modified key usage bits The certificates were missing the digitalSignature and keyAgreement usage types, of which at least digitalSignature was checked by CyaSSL. This caused the test server in test 310 (among others) to fail the startup verification and therefore run (see http://curl.haxx.se/mail/lib-2014-07/0303.html).
2015-03-21 23:20:34 +08:00
LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
tests/certs: rebuild certs with 2048-bit RSA keys The previous test certificates contained RSA keys of only 1024 bits. However, RSA claims that 1024-bit RSA keys are likely to become crackable some time before 2010. The NIST recommends at least 2048-bit keys for RSA for now. Better use full 2048 also for testing. Closes #2973
2018-09-11 02:32:23 +08:00
MRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
tests: avoid use of sha1 in certificates The SHA-1 algorithm is deprecated (particularly for security-sensitive applications) in a variety of OS environments. This already affects RHEL-9 and derivatives, which are not willing to use certificates using that algorithm. The fix is to use sha256 instead, which is already used for most of the other certificates in the test suite. Fixes #10135 This gets rid of issues related to sha1 signatures. Manual steps after "make clean-certs" and "make build-certs": - Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem (make clean-certs does not remove the original tests/stunnel.pem) - Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey options of tests/data/test2041 and tests/data/test2087 Closes #10153
2022-12-23 20:34:49 +08:00
AoIBAQDGuAQ91voxoNf36YhLWl5vb9v0yUt+bCrPNHsquhpxrX94bPceygfQKQNJ
5GOGTPZnP70yacu4FecOzyg9npaRjk9zqSd3TCZhzdbnTjxkwxO6juwDD7zUg7OU
8r7QGDDFUknLmmDP87nKL2OdNO6HOljnoZnd3FaH4aDXazeuuxPbffoqPZw5efYB
puM65xgUy8dXuYPRurgsWsSXL+6NaEg3+BfbMrnqJU8oVwE5E9zA99DMZfkruEyh
WxHOROIouWNi/Qj6ts1J1bn+nmicmrUaPsy/DnTbUj8lMM19AkHHyYpYEjUlIZXE
a8P1ecIAy+9/15+Jyf/AuXJZTDNHAgMBAAGjggEGMIIBAjAUBgNVHREEDTALggls
tests: add authorityInfoAccess to generated certs Generate stunnel.pem as well Closes #9980
2022-11-25 21:00:48 +08:00
b2NhbGhvc3QwCwYDVR0PBAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1Ud
tests: avoid use of sha1 in certificates The SHA-1 algorithm is deprecated (particularly for security-sensitive applications) in a variety of OS environments. This already affects RHEL-9 and derivatives, which are not willing to use certificates using that algorithm. The fix is to use sha256 instead, which is already used for most of the other certificates in the test suite. Fixes #10135 This gets rid of issues related to sha1 signatures. Manual steps after "make clean-certs" and "make build-certs": - Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem (make clean-certs does not remove the original tests/stunnel.pem) - Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey options of tests/data/test2041 and tests/data/test2087 Closes #10153
2022-12-23 20:34:49 +08:00
DgQWBBRK8XkbE3GkD/kGzLYszSRG3+YILTAfBgNVHSMEGDAWgBSHy7EzLsFnfnHj
5StMTaSzbtJbqTAJBgNVHRMEAjAAMEMGCCsGAQUFBwEBBDcwNTAzBggrBgEFBQcw
tests: add authorityInfoAccess to generated certs Generate stunnel.pem as well Closes #9980
2022-11-25 21:00:48 +08:00
AoYnaHR0cDovL3Rlc3QuY3VybC5zZS9jYS9FZGVsQ3VybFJvb3QuY2VyMDgGA1Ud
HwQxMC8wLaAroCmGJ2h0dHA6Ly90ZXN0LmN1cmwuc2UvY2EvRWRlbEN1cmxSb290
tests: avoid use of sha1 in certificates The SHA-1 algorithm is deprecated (particularly for security-sensitive applications) in a variety of OS environments. This already affects RHEL-9 and derivatives, which are not willing to use certificates using that algorithm. The fix is to use sha256 instead, which is already used for most of the other certificates in the test suite. Fixes #10135 This gets rid of issues related to sha1 signatures. Manual steps after "make clean-certs" and "make build-certs": - Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem (make clean-certs does not remove the original tests/stunnel.pem) - Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey options of tests/data/test2041 and tests/data/test2087 Closes #10153
2022-12-23 20:34:49 +08:00
LmNybDANBgkqhkiG9w0BAQsFAAOCAQEAZ++tj/ru8f0zZ2IGXwlVfM+CGuj89Ze6
Y73QoIuFLPzwNEqXshjXYzRj9B9Qxw4T2bw7cz1BkxazMJWIzXXIjFhLq5bmeGgV
D4TnjheUGrPzEqsm/fpzMTM2hYMt4zrypinGNzA9F9I5MdFWG43f+wetgQuR5b17
N6CgWiwzK41pi9fBRWGF7zJF3QCigZhEDesBlfysD7U0pF81XGhjUFppVvOZxGdw
iRMwwGT/8aZ3aGljnm/4PG/Nr3/eDYdVrjmzsvVPR3kfMu6ujzLciDDNOGxLKFXD
fXRr3tBJyQXqYnGm+B522jynF80akqPE6IXRrTQMcTc/bNN/mtbK3g==
- Peter Sylvester made the HTTPS test server use specific certificates for each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-12 05:48:58 +08:00
-----END CERTIFICATE-----
Reference in New Issue Copy Permalink