mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-12-27 06:21:43 +08:00
Code Issues Packages Projects Releases Wiki Activity
f377e58fde
openssl/test/ssl-tests/12-ct.cnf

192 lines
5.0 KiB
Plaintext
Raw Normal View History

SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
# Generated with generate_ssl_tests.pl
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
num_tests = 6
test-0 = 0-ct-permissive-without-scts
test-1 = 1-ct-permissive-with-scts
test-2 = 2-ct-strict-without-scts
test-3 = 3-ct-strict-with-scts
test-4 = 4-ct-permissive-resumption
test-5 = 5-ct-strict-resumption
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
# ===========================================================
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[0-ct-permissive-without-scts]
ssl_conf = 0-ct-permissive-without-scts-ssl
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[0-ct-permissive-without-scts-ssl]
server = 0-ct-permissive-without-scts-server
client = 0-ct-permissive-without-scts-client
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[0-ct-permissive-without-scts-server]
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[0-ct-permissive-without-scts-client]
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-0]
ExpectedResult = Success
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
client = 0-ct-permissive-without-scts-client-extra
[0-ct-permissive-without-scts-client-extra]
CTValidation = Permissive
# ===========================================================
[1-ct-permissive-with-scts]
ssl_conf = 1-ct-permissive-with-scts-ssl
[1-ct-permissive-with-scts-ssl]
server = 1-ct-permissive-with-scts-server
client = 1-ct-permissive-with-scts-client
[1-ct-permissive-with-scts-server]
Certificate = ${ENV::TEST_CERTS_DIR}/embeddedSCTs1.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/embeddedSCTs1-key.pem
[1-ct-permissive-with-scts-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/embeddedSCTs1_issuer.pem
VerifyMode = Peer
[test-1]
ExpectedResult = Success
client = 1-ct-permissive-with-scts-client-extra
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[1-ct-permissive-with-scts-client-extra]
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
CTValidation = Permissive
# ===========================================================
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[2-ct-strict-without-scts]
ssl_conf = 2-ct-strict-without-scts-ssl
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[2-ct-strict-without-scts-ssl]
server = 2-ct-strict-without-scts-server
client = 2-ct-strict-without-scts-client
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[2-ct-strict-without-scts-server]
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[2-ct-strict-without-scts-client]
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[test-2]
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
ExpectedClientAlert = HandshakeFailure
ExpectedResult = ClientFail
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
client = 2-ct-strict-without-scts-client-extra
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[2-ct-strict-without-scts-client-extra]
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
CTValidation = Strict
# ===========================================================
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[3-ct-strict-with-scts]
ssl_conf = 3-ct-strict-with-scts-ssl
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[3-ct-strict-with-scts-ssl]
server = 3-ct-strict-with-scts-server
client = 3-ct-strict-with-scts-client
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[3-ct-strict-with-scts-server]
Certificate = ${ENV::TEST_CERTS_DIR}/embeddedSCTs1.pem
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
CipherString = DEFAULT
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/embeddedSCTs1-key.pem
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[3-ct-strict-with-scts-client]
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
CipherString = DEFAULT
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/embeddedSCTs1_issuer.pem
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
VerifyMode = Peer
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[test-3]
ExpectedResult = Success
client = 3-ct-strict-with-scts-client-extra
[3-ct-strict-with-scts-client-extra]
CTValidation = Strict
# ===========================================================
[4-ct-permissive-resumption]
ssl_conf = 4-ct-permissive-resumption-ssl
[4-ct-permissive-resumption-ssl]
server = 4-ct-permissive-resumption-server
client = 4-ct-permissive-resumption-client
resume-server = 4-ct-permissive-resumption-server
resume-client = 4-ct-permissive-resumption-client
[4-ct-permissive-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/embeddedSCTs1.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/embeddedSCTs1-key.pem
[4-ct-permissive-resumption-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/embeddedSCTs1_issuer.pem
VerifyMode = Peer
[test-4]
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
ExpectedResult = Success
HandshakeMode = Resume
ResumptionExpected = Yes
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
client = 4-ct-permissive-resumption-client-extra
resume-client = 4-ct-permissive-resumption-client-extra
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[4-ct-permissive-resumption-client-extra]
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
CTValidation = Permissive
# ===========================================================
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[5-ct-strict-resumption]
ssl_conf = 5-ct-strict-resumption-ssl
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[5-ct-strict-resumption-ssl]
server = 5-ct-strict-resumption-server
client = 5-ct-strict-resumption-client
resume-server = 5-ct-strict-resumption-server
resume-client = 5-ct-strict-resumption-resume-client
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[5-ct-strict-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/embeddedSCTs1.pem
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
CipherString = DEFAULT
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
PrivateKey = ${ENV::TEST_CERTS_DIR}/embeddedSCTs1-key.pem
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[5-ct-strict-resumption-client]
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
CipherString = DEFAULT
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/embeddedSCTs1_issuer.pem
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
VerifyMode = Peer
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[5-ct-strict-resumption-resume-client]
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[test-5]
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
ExpectedResult = Success
HandshakeMode = Resume
ResumptionExpected = Yes
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
client = 5-ct-strict-resumption-client-extra
resume-client = 5-ct-strict-resumption-resume-client-extra
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[5-ct-strict-resumption-client-extra]
CTValidation = Strict
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
Add SSL tests for certificates with embedded SCTs The only SSL tests prior to this tested using certificates with no embedded Signed Certificate Timestamps (SCTs), which meant they couldn't confirm whether Certificate Transparency checks in "strict" mode were working. These tests reveal a bug in the validation of SCT timestamps, which is fixed by the next commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3138)
2017-04-06 20:21:27 +08:00
[5-ct-strict-resumption-resume-client-extra]
SSL tests: port CT tests, add a few more This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-09 22:47:26 +08:00
CTValidation = Strict
Reference in New Issue Copy Permalink