mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-12-27 06:21:43 +08:00
Code Issues Packages Projects Releases Wiki Activity
2e21539b2b
openssl/test/ssl-tests/04-client_auth.conf

916 lines
24 KiB
Plaintext
Raw Normal View History

Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
# Generated with generate_ssl_tests.pl
Port remaining old DTLS tests We already test DTLS protocol versions. For good measure, add some DTLS tests with client auth to the new test framework, so that we can remove the old tests without losing coverage. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-14 21:56:22 +08:00
num_tests = 30
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
test-0 = 0-server-auth-flex
test-1 = 1-client-auth-flex-request
test-2 = 2-client-auth-flex-require-fail
test-3 = 3-client-auth-flex-require
test-4 = 4-client-auth-flex-noroot
test-5 = 5-server-auth-TLSv1
test-6 = 6-client-auth-TLSv1-request
test-7 = 7-client-auth-TLSv1-require-fail
test-8 = 8-client-auth-TLSv1-require
test-9 = 9-client-auth-TLSv1-noroot
test-10 = 10-server-auth-TLSv1.1
test-11 = 11-client-auth-TLSv1.1-request
test-12 = 12-client-auth-TLSv1.1-require-fail
test-13 = 13-client-auth-TLSv1.1-require
test-14 = 14-client-auth-TLSv1.1-noroot
test-15 = 15-server-auth-TLSv1.2
test-16 = 16-client-auth-TLSv1.2-request
test-17 = 17-client-auth-TLSv1.2-require-fail
test-18 = 18-client-auth-TLSv1.2-require
test-19 = 19-client-auth-TLSv1.2-noroot
Port remaining old DTLS tests We already test DTLS protocol versions. For good measure, add some DTLS tests with client auth to the new test framework, so that we can remove the old tests without losing coverage. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-14 21:56:22 +08:00
test-20 = 20-server-auth-DTLSv1
test-21 = 21-client-auth-DTLSv1-request
test-22 = 22-client-auth-DTLSv1-require-fail
test-23 = 23-client-auth-DTLSv1-require
test-24 = 24-client-auth-DTLSv1-noroot
test-25 = 25-server-auth-DTLSv1.2
test-26 = 26-client-auth-DTLSv1.2-request
test-27 = 27-client-auth-DTLSv1.2-require-fail
test-28 = 28-client-auth-DTLSv1.2-require
test-29 = 29-client-auth-DTLSv1.2-noroot
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
# ===========================================================
[0-server-auth-flex]
ssl_conf = 0-server-auth-flex-ssl
[0-server-auth-flex-ssl]
server = 0-server-auth-flex-server
client = 0-server-auth-flex-client
[0-server-auth-flex-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-server-auth-flex-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-0]
ExpectedResult = Success
# ===========================================================
[1-client-auth-flex-request]
ssl_conf = 1-client-auth-flex-request-ssl
[1-client-auth-flex-request-ssl]
server = 1-client-auth-flex-request-server
client = 1-client-auth-flex-request-client
[1-client-auth-flex-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Request
[1-client-auth-flex-request-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-1]
ExpectedResult = Success
# ===========================================================
[2-client-auth-flex-require-fail]
ssl_conf = 2-client-auth-flex-require-fail-ssl
[2-client-auth-flex-require-fail-ssl]
server = 2-client-auth-flex-require-fail-server
client = 2-client-auth-flex-require-fail-client
[2-client-auth-flex-require-fail-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[2-client-auth-flex-require-fail-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-2]
ExpectedResult = ServerFail
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
ExpectedServerAlert = HandshakeFailure
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
# ===========================================================
[3-client-auth-flex-require]
ssl_conf = 3-client-auth-flex-require-ssl
[3-client-auth-flex-require-ssl]
server = 3-client-auth-flex-require-server
client = 3-client-auth-flex-require-client
[3-client-auth-flex-require-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[3-client-auth-flex-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-3]
Add client cert type tests Reviewed-by: Emilia Käsper <emilia@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2224)
2017-01-14 01:41:48 +08:00
ExpectedClientCertType = RSA
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
ExpectedResult = Success
# ===========================================================
[4-client-auth-flex-noroot]
ssl_conf = 4-client-auth-flex-noroot-ssl
[4-client-auth-flex-noroot-ssl]
server = 4-client-auth-flex-noroot-server
client = 4-client-auth-flex-noroot-client
[4-client-auth-flex-noroot-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[4-client-auth-flex-noroot-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-4]
ExpectedResult = ServerFail
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
ExpectedServerAlert = UnknownCA
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
# ===========================================================
[5-server-auth-TLSv1]
ssl_conf = 5-server-auth-TLSv1-ssl
[5-server-auth-TLSv1-ssl]
server = 5-server-auth-TLSv1-server
client = 5-server-auth-TLSv1-client
[5-server-auth-TLSv1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1
MinProtocol = TLSv1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[5-server-auth-TLSv1-client]
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1
MinProtocol = TLSv1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-5]
ExpectedResult = Success
# ===========================================================
[6-client-auth-TLSv1-request]
ssl_conf = 6-client-auth-TLSv1-request-ssl
[6-client-auth-TLSv1-request-ssl]
server = 6-client-auth-TLSv1-request-server
client = 6-client-auth-TLSv1-request-client
[6-client-auth-TLSv1-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1
MinProtocol = TLSv1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Request
[6-client-auth-TLSv1-request-client]
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1
MinProtocol = TLSv1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-6]
ExpectedResult = Success
# ===========================================================
[7-client-auth-TLSv1-require-fail]
ssl_conf = 7-client-auth-TLSv1-require-fail-ssl
[7-client-auth-TLSv1-require-fail-ssl]
server = 7-client-auth-TLSv1-require-fail-server
client = 7-client-auth-TLSv1-require-fail-client
[7-client-auth-TLSv1-require-fail-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1
MinProtocol = TLSv1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[7-client-auth-TLSv1-require-fail-client]
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1
MinProtocol = TLSv1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-7]
ExpectedResult = ServerFail
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
ExpectedServerAlert = HandshakeFailure
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
# ===========================================================
[8-client-auth-TLSv1-require]
ssl_conf = 8-client-auth-TLSv1-require-ssl
[8-client-auth-TLSv1-require-ssl]
server = 8-client-auth-TLSv1-require-server
client = 8-client-auth-TLSv1-require-client
[8-client-auth-TLSv1-require-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1
MinProtocol = TLSv1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[8-client-auth-TLSv1-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1
MinProtocol = TLSv1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-8]
Add client cert type tests Reviewed-by: Emilia Käsper <emilia@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2224)
2017-01-14 01:41:48 +08:00
ExpectedClientCertType = RSA
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
ExpectedResult = Success
# ===========================================================
[9-client-auth-TLSv1-noroot]
ssl_conf = 9-client-auth-TLSv1-noroot-ssl
[9-client-auth-TLSv1-noroot-ssl]
server = 9-client-auth-TLSv1-noroot-server
client = 9-client-auth-TLSv1-noroot-client
[9-client-auth-TLSv1-noroot-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1
MinProtocol = TLSv1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[9-client-auth-TLSv1-noroot-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1
MinProtocol = TLSv1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-9]
ExpectedResult = ServerFail
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
ExpectedServerAlert = UnknownCA
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
# ===========================================================
[10-server-auth-TLSv1.1]
ssl_conf = 10-server-auth-TLSv1.1-ssl
[10-server-auth-TLSv1.1-ssl]
server = 10-server-auth-TLSv1.1-server
client = 10-server-auth-TLSv1.1-client
[10-server-auth-TLSv1.1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-server-auth-TLSv1.1-client]
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-10]
ExpectedResult = Success
# ===========================================================
[11-client-auth-TLSv1.1-request]
ssl_conf = 11-client-auth-TLSv1.1-request-ssl
[11-client-auth-TLSv1.1-request-ssl]
server = 11-client-auth-TLSv1.1-request-server
client = 11-client-auth-TLSv1.1-request-client
[11-client-auth-TLSv1.1-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Request
[11-client-auth-TLSv1.1-request-client]
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-11]
ExpectedResult = Success
# ===========================================================
[12-client-auth-TLSv1.1-require-fail]
ssl_conf = 12-client-auth-TLSv1.1-require-fail-ssl
[12-client-auth-TLSv1.1-require-fail-ssl]
server = 12-client-auth-TLSv1.1-require-fail-server
client = 12-client-auth-TLSv1.1-require-fail-client
[12-client-auth-TLSv1.1-require-fail-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[12-client-auth-TLSv1.1-require-fail-client]
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-12]
ExpectedResult = ServerFail
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
ExpectedServerAlert = HandshakeFailure
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
# ===========================================================
[13-client-auth-TLSv1.1-require]
ssl_conf = 13-client-auth-TLSv1.1-require-ssl
[13-client-auth-TLSv1.1-require-ssl]
server = 13-client-auth-TLSv1.1-require-server
client = 13-client-auth-TLSv1.1-require-client
[13-client-auth-TLSv1.1-require-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[13-client-auth-TLSv1.1-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-13]
Add client cert type tests Reviewed-by: Emilia Käsper <emilia@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2224)
2017-01-14 01:41:48 +08:00
ExpectedClientCertType = RSA
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
ExpectedResult = Success
# ===========================================================
[14-client-auth-TLSv1.1-noroot]
ssl_conf = 14-client-auth-TLSv1.1-noroot-ssl
[14-client-auth-TLSv1.1-noroot-ssl]
server = 14-client-auth-TLSv1.1-noroot-server
client = 14-client-auth-TLSv1.1-noroot-client
[14-client-auth-TLSv1.1-noroot-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[14-client-auth-TLSv1.1-noroot-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-14]
ExpectedResult = ServerFail
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
ExpectedServerAlert = UnknownCA
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
# ===========================================================
[15-server-auth-TLSv1.2]
ssl_conf = 15-server-auth-TLSv1.2-ssl
[15-server-auth-TLSv1.2-ssl]
server = 15-server-auth-TLSv1.2-server
client = 15-server-auth-TLSv1.2-client
[15-server-auth-TLSv1.2-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-server-auth-TLSv1.2-client]
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-15]
ExpectedResult = Success
# ===========================================================
[16-client-auth-TLSv1.2-request]
ssl_conf = 16-client-auth-TLSv1.2-request-ssl
[16-client-auth-TLSv1.2-request-ssl]
server = 16-client-auth-TLSv1.2-request-server
client = 16-client-auth-TLSv1.2-request-client
[16-client-auth-TLSv1.2-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Request
[16-client-auth-TLSv1.2-request-client]
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-16]
ExpectedResult = Success
# ===========================================================
[17-client-auth-TLSv1.2-require-fail]
ssl_conf = 17-client-auth-TLSv1.2-require-fail-ssl
[17-client-auth-TLSv1.2-require-fail-ssl]
server = 17-client-auth-TLSv1.2-require-fail-server
client = 17-client-auth-TLSv1.2-require-fail-client
[17-client-auth-TLSv1.2-require-fail-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[17-client-auth-TLSv1.2-require-fail-client]
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-17]
ExpectedResult = ServerFail
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
ExpectedServerAlert = HandshakeFailure
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
# ===========================================================
[18-client-auth-TLSv1.2-require]
ssl_conf = 18-client-auth-TLSv1.2-require-ssl
[18-client-auth-TLSv1.2-require-ssl]
server = 18-client-auth-TLSv1.2-require-server
client = 18-client-auth-TLSv1.2-require-client
[18-client-auth-TLSv1.2-require-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Add signing hash tests Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2235)
2017-01-15 23:59:48 +08:00
ClientSignatureAlgorithms = SHA256+RSA
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[18-client-auth-TLSv1.2-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-18]
Add client cert type tests Reviewed-by: Emilia Käsper <emilia@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2224)
2017-01-14 01:41:48 +08:00
ExpectedClientCertType = RSA
Add signing hash tests Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2235)
2017-01-15 23:59:48 +08:00
ExpectedClientSignHash = SHA256
Add tests for client and server signature type Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2301)
2017-01-27 23:56:47 +08:00
ExpectedClientSignType = RSA
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
ExpectedResult = Success
# ===========================================================
[19-client-auth-TLSv1.2-noroot]
ssl_conf = 19-client-auth-TLSv1.2-noroot-ssl
[19-client-auth-TLSv1.2-noroot-ssl]
server = 19-client-auth-TLSv1.2-noroot-server
client = 19-client-auth-TLSv1.2-noroot-client
[19-client-auth-TLSv1.2-noroot-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[19-client-auth-TLSv1.2-noroot-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 23:34:26 +08:00
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-19]
ExpectedResult = ServerFail
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
ExpectedServerAlert = UnknownCA
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 22:42:58 +08:00
Port remaining old DTLS tests We already test DTLS protocol versions. For good measure, add some DTLS tests with client auth to the new test framework, so that we can remove the old tests without losing coverage. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-14 21:56:22 +08:00
# ===========================================================
[20-server-auth-DTLSv1]
ssl_conf = 20-server-auth-DTLSv1-ssl
[20-server-auth-DTLSv1-ssl]
server = 20-server-auth-DTLSv1-server
client = 20-server-auth-DTLSv1-client
[20-server-auth-DTLSv1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[20-server-auth-DTLSv1-client]
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-20]
ExpectedResult = Success
Method = DTLS
# ===========================================================
[21-client-auth-DTLSv1-request]
ssl_conf = 21-client-auth-DTLSv1-request-ssl
[21-client-auth-DTLSv1-request-ssl]
server = 21-client-auth-DTLSv1-request-server
client = 21-client-auth-DTLSv1-request-client
[21-client-auth-DTLSv1-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Request
[21-client-auth-DTLSv1-request-client]
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-21]
ExpectedResult = Success
Method = DTLS
# ===========================================================
[22-client-auth-DTLSv1-require-fail]
ssl_conf = 22-client-auth-DTLSv1-require-fail-ssl
[22-client-auth-DTLSv1-require-fail-ssl]
server = 22-client-auth-DTLSv1-require-fail-server
client = 22-client-auth-DTLSv1-require-fail-client
[22-client-auth-DTLSv1-require-fail-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[22-client-auth-DTLSv1-require-fail-client]
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-22]
ExpectedResult = ServerFail
ExpectedServerAlert = HandshakeFailure
Method = DTLS
# ===========================================================
[23-client-auth-DTLSv1-require]
ssl_conf = 23-client-auth-DTLSv1-require-ssl
[23-client-auth-DTLSv1-require-ssl]
server = 23-client-auth-DTLSv1-require-server
client = 23-client-auth-DTLSv1-require-client
[23-client-auth-DTLSv1-require-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[23-client-auth-DTLSv1-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-23]
ExpectedClientCertType = RSA
ExpectedResult = Success
Method = DTLS
# ===========================================================
[24-client-auth-DTLSv1-noroot]
ssl_conf = 24-client-auth-DTLSv1-noroot-ssl
[24-client-auth-DTLSv1-noroot-ssl]
server = 24-client-auth-DTLSv1-noroot-server
client = 24-client-auth-DTLSv1-noroot-client
[24-client-auth-DTLSv1-noroot-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[24-client-auth-DTLSv1-noroot-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-24]
ExpectedResult = ServerFail
ExpectedServerAlert = UnknownCA
Method = DTLS
# ===========================================================
[25-server-auth-DTLSv1.2]
ssl_conf = 25-server-auth-DTLSv1.2-ssl
[25-server-auth-DTLSv1.2-ssl]
server = 25-server-auth-DTLSv1.2-server
client = 25-server-auth-DTLSv1.2-client
[25-server-auth-DTLSv1.2-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[25-server-auth-DTLSv1.2-client]
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-25]
ExpectedResult = Success
Method = DTLS
# ===========================================================
[26-client-auth-DTLSv1.2-request]
ssl_conf = 26-client-auth-DTLSv1.2-request-ssl
[26-client-auth-DTLSv1.2-request-ssl]
server = 26-client-auth-DTLSv1.2-request-server
client = 26-client-auth-DTLSv1.2-request-client
[26-client-auth-DTLSv1.2-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Request
[26-client-auth-DTLSv1.2-request-client]
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-26]
ExpectedResult = Success
Method = DTLS
# ===========================================================
[27-client-auth-DTLSv1.2-require-fail]
ssl_conf = 27-client-auth-DTLSv1.2-require-fail-ssl
[27-client-auth-DTLSv1.2-require-fail-ssl]
server = 27-client-auth-DTLSv1.2-require-fail-server
client = 27-client-auth-DTLSv1.2-require-fail-client
[27-client-auth-DTLSv1.2-require-fail-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[27-client-auth-DTLSv1.2-require-fail-client]
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-27]
ExpectedResult = ServerFail
ExpectedServerAlert = HandshakeFailure
Method = DTLS
# ===========================================================
[28-client-auth-DTLSv1.2-require]
ssl_conf = 28-client-auth-DTLSv1.2-require-ssl
[28-client-auth-DTLSv1.2-require-ssl]
server = 28-client-auth-DTLSv1.2-require-server
client = 28-client-auth-DTLSv1.2-require-client
[28-client-auth-DTLSv1.2-require-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[28-client-auth-DTLSv1.2-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-28]
ExpectedClientCertType = RSA
ExpectedResult = Success
Method = DTLS
# ===========================================================
[29-client-auth-DTLSv1.2-noroot]
ssl_conf = 29-client-auth-DTLSv1.2-noroot-ssl
[29-client-auth-DTLSv1.2-noroot-ssl]
server = 29-client-auth-DTLSv1.2-noroot-server
client = 29-client-auth-DTLSv1.2-noroot-client
[29-client-auth-DTLSv1.2-noroot-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[29-client-auth-DTLSv1.2-noroot-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-29]
ExpectedResult = ServerFail
ExpectedServerAlert = UnknownCA
Method = DTLS
Reference in New Issue Copy Permalink