openssl/test/recipes
Dr. David von Oheimb 3bed88a397 x509_vfy.c: Restore rejection of expired trusted (root) certificate
The certificate path validation procedure specified in RFC 5280 does not
include checking the validity period of the trusted (root) certificate.
Still it is common good practice to perform this check.
Also OpenSSL did this until commit 0e7b1383e, which accidentally killed it.

The current commit restores the previous behavior.
It also removes the cause of that bug, namely counter-intuitive design
of the internal function check_issued(), which was complicated by checks
that actually belong to some other internal function, namely find_issuer().

Moreover, this commit adds a regression check and proper documentation of
the root cert validity period check feature, which had been missing so far.

Fixes #13427

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/13590)
2020-12-03 14:06:49 +01:00
..
04-test_conf_data
04-test_params_conversion_data
04-test_pem_data
04-test_pem_read_depr_data Test various deprecated PEM_read_bio_* APIs 2020-11-25 10:02:59 +00:00
10-test_bn_data
15-test_ecparam_data
15-test_mp_rsa_data
15-test_rsaoaep_data
20-test_dhparam_data Add a test for the dhparam CLI application 2020-11-23 09:01:07 +00:00
25-test_eai_data
25-test_rusext_data Some OIDs used in Russian X.509 certificates. 2020-10-05 12:14:17 +03:00
30-test_evp_data Add EVP_KDF-X942 to the fips module 2020-12-02 12:15:05 +10:00
30-test_evp_pkey_provided Update test data for DSA public key text 2020-08-31 14:49:16 +10:00
61-test_bio_prefix_data
65-test_cmp_client_data
65-test_cmp_msg_data
65-test_cmp_protect_data
65-test_cmp_server_data
65-test_cmp_vfy_data
66-test_ossl_store_data Test that OSSL_STORE can load various types of params 2020-11-25 10:02:59 +00:00
80-test_ca_data apps/ca: allow CRL lastUpdate/nextUpdate fields to be specified 2020-09-11 14:32:27 +03:00
80-test_cms_data
80-test_ocsp_data
80-test_ssl_old_data Re-enable testing of ciphersuites 2020-11-25 10:14:43 +00:00
81-test_cmp_cli_data re-encrypt 81-test_cmp_cli_data/Mock/signer.p12 with AES-256-CBC (avoiding DES) 2020-11-25 13:33:50 +01:00
90-test_gost_data
90-test_includes_data
90-test_sslapi_data
90-test_store_data
95-test_external_gost_engine_data
95-test_external_krb5_data
95-test_external_pyca_data
01-test_abort.t
01-test_sanity.t
01-test_symbol_presence.t Update copyright year 2020-10-15 14:10:06 +01:00
01-test_test.t
02-test_errstr.t TEST: skip POSIX errcode zero in tesst/recipes/02-test_errstr.t 2020-09-12 03:51:21 +02:00
02-test_internal_context.t
02-test_internal_ctype.t
02-test_internal_keymgmt.t
02-test_internal_provider.t
02-test_lhash.t
02-test_ordinals.t
02-test_sparse_array.t
02-test_stack.t
03-test_exdata.t
03-test_fipsinstall.t Add self tests for rsa encryption 2020-09-16 14:10:23 +10:00
03-test_internal_asn1_dsa.t
03-test_internal_asn1.t
03-test_internal_bn.t
03-test_internal_chacha.t
03-test_internal_curve448.t
03-test_internal_ec.t
03-test_internal_ffc.t
03-test_internal_mdc2.t
03-test_internal_modes.t
03-test_internal_namemap.t
03-test_internal_poly1305.t
03-test_internal_rsa_sp800_56b.t
03-test_internal_siphash.t
03-test_internal_sm2.t
03-test_internal_sm4.t
03-test_internal_ssl_cert_table.t
03-test_internal_x509.t
03-test_params_api.t
03-test_property.t
03-test_ui.t
04-test_asn1_decode.t
04-test_asn1_encode.t
04-test_asn1_string_table.t
04-test_bio_callback.t
04-test_bioprint.t
04-test_conf.t
04-test_encoder_decoder_legacy.t Deprecate the DHparams and DHxparams PEM routines 2020-11-27 11:04:54 +00:00
04-test_encoder_decoder.t
04-test_err.t
04-test_hexstring.t
04-test_param_build.t
04-test_params_conversion.t
04-test_params.t
04-test_pem_read_depr.t Update copyright year 2020-11-26 14:18:57 +00:00
04-test_pem.t
04-test_provider_fallback.t
04-test_provider.t
05-test_bf.t
05-test_cast.t
05-test_cmac.t
05-test_des.t
05-test_hmac.t
05-test_idea.t
05-test_rand.t
05-test_rc2.t
05-test_rc4.t
05-test_rc5.t
06-test-rdrand.t
10-test_bn.t
10-test_exp.t
15-test_dh.t
15-test_dsa.t TEST: modify tconversion.pl for forensics 2020-10-16 19:07:20 +02:00
15-test_ec.t TEST: modify tconversion.pl for forensics 2020-10-16 19:07:20 +02:00
15-test_ecdsa.t
15-test_ecparam.t
15-test_gendh.t Fix crash in genpkey app when -pkeyopt digest:name is used for DH or DSA. 2020-11-20 11:59:23 +10:00
15-test_gendsa.t Fix crash in genpkey app when -pkeyopt digest:name is used for DH or DSA. 2020-11-20 11:59:23 +10:00
15-test_genec.t
15-test_genrsa.t TEST: Ensure that the base provider i activated when needed 2020-09-03 17:48:33 +02:00
15-test_mp_rsa.t
15-test_out_option.t
15-test_rsa.t TEST: modify tconversion.pl for forensics 2020-10-16 19:07:20 +02:00
15-test_rsaoaep.t Add 'fips-securitychecks' option and plumb this into the actual fips checks 2020-09-18 14:20:39 +01:00
15-test_rsapss.t
20-test_app.t
20-test_cli_fips.t Fix dsa securitycheck for fips. 2020-11-16 17:21:57 +10:00
20-test_dgst.t openssl dgst: add option to specify output length for XOF 2020-12-02 16:46:46 +01:00
20-test_dhparam.t Add a test for the dhparam CLI application 2020-11-23 09:01:07 +00:00
20-test_enc_more.t
20-test_enc.t
20-test_kdf.t
20-test_mac.t
20-test_passwd.t apps/passwd: remove the -crypt option. 2020-11-12 08:35:47 +10:00
20-test_pkeyutl.t TEST: Make our test data binary 2020-11-24 11:01:58 +01:00
20-test_rand_config.t rand: add a test case for configuration based random 2020-09-23 15:28:30 +10:00
25-test_crl.t TEST: modify tconversion.pl for forensics 2020-10-16 19:07:20 +02:00
25-test_d2i.t
25-test_eai_data.t Update copyright year 2020-10-15 14:10:06 +01:00
25-test_pkcs7.t Update copyright year 2020-11-05 13:37:26 +00:00
25-test_req.t TEST: modify tconversion.pl for forensics 2020-10-16 19:07:20 +02:00
25-test_rusext.t
25-test_sid.t Update copyright year 2020-11-05 13:37:26 +00:00
25-test_verify_store.t
25-test_verify.t x509_vfy.c: Restore rejection of expired trusted (root) certificate 2020-12-03 14:06:49 +01:00
25-test_x509.t 25-test_x509.t: Re-add and improve a test on non-existence of ASN.1 parse errors 2020-11-11 10:54:22 +01:00
30-test_acvp.t
30-test_aesgcm.t
30-test_afalg.t
30-test_defltfips.t
30-test_engine.t
30-test_evp_extra.t
30-test_evp_fetch_prov.t
30-test_evp_kdf.t
30-test_evp_libctx.t test/recipes/30-test_evp_libctx.t: use fips-and-base.cnf 2020-11-11 12:43:27 +01:00
30-test_evp_pkey_dparam.t
30-test_evp_pkey_provided.t
30-test_evp.t Add EVP_KDF-X942 to the fips module 2020-12-02 12:15:05 +10:00
30-test_pbelu.t
30-test_pkey_meth_kdf.t
30-test_pkey_meth.t
30-test_provider_status.t
40-test_rehash.t
60-test_x509_check_cert_pkey.t
60-test_x509_dup_cert.t
60-test_x509_store.t
60-test_x509_time.t
61-test_bio_prefix.t
65-test_cmp_asn.t
65-test_cmp_client.t TEST: Ensure that the base provider i activated when needed 2020-09-03 17:48:33 +02:00
65-test_cmp_ctx.t
65-test_cmp_hdr.t
65-test_cmp_msg.t Update copyright year 2020-10-15 14:10:06 +01:00
65-test_cmp_protect.t Update copyright year 2020-10-15 14:10:06 +01:00
65-test_cmp_server.t
65-test_cmp_status.t
65-test_cmp_vfy.t
66-test_ossl_store.t Test that OSSL_STORE can load various types of params 2020-11-25 10:02:59 +00:00
70-test_asyncio.t
70-test_bad_dtls.t
70-test_clienthello.t
70-test_comp.t
70-test_key_share.t
70-test_packet.t
70-test_recordlen.t
70-test_renegotiation.t
70-test_servername.t
70-test_sslcbcpadding.t
70-test_sslcertstatus.t
70-test_sslextension.t
70-test_sslmessages.t
70-test_sslrecords.t
70-test_sslsessiontick.t
70-test_sslsigalgs.t
70-test_sslsignature.t
70-test_sslskewith0p.t
70-test_sslversions.t
70-test_sslvertol.t
70-test_tls13alerts.t
70-test_tls13cookie.t
70-test_tls13downgrade.t
70-test_tls13hrr.t
70-test_tls13kexmodes.t
70-test_tls13messages.t
70-test_tls13psk.t
70-test_tlsextms.t
70-test_verify_extra.t
70-test_wpacket.t
71-test_ssl_ctx.t
80-test_ca.t Fix test/recipes/80-test_ca.t to skip_all properly in a subtest 2020-11-07 12:24:49 +01:00
80-test_cipherbytes.t
80-test_cipherlist.t
80-test_ciphername.t
80-test_cms.t Tests for processing zero-length content in SMIME format 2020-10-08 18:17:44 +03:00
80-test_cmsapi.t
80-test_ct.t
80-test_dane.t
80-test_dtls_mtu.t
80-test_dtls.t
80-test_dtlsv1listen.t
80-test_http.t
80-test_ocsp.t
80-test_pkcs12.t Fix no-rc2 2020-11-25 17:07:01 +00:00
80-test_ssl_new.t TEST: Ensure that the base provider i activated when needed 2020-09-03 17:48:33 +02:00
80-test_ssl_old.t test cleanup: move helper .c and .h files to test/helpers/ 2020-12-01 07:49:38 +01:00
80-test_ssl_test_ctx.t
80-test_sslcorrupt.t
80-test_tsa.t
80-test_x509aux.t
81-test_cmp_cli.t Move CMP CLI test output files to BLDTOP/test-runs/test_cmp_cli/ 2020-10-06 21:45:25 +02:00
90-test_asn1_time.t
90-test_async.t
90-test_bio_enc.t
90-test_bio_memleak.t
90-test_constant_time.t
90-test_fatalerr.t
90-test_fipsload.t TEST: Add a simple module loader, and test the FIPS module with it 2020-12-01 11:06:03 +01:00
90-test_gmdiff.t
90-test_gost.t
90-test_ige.t
90-test_includes.t
90-test_memleak.t
90-test_overhead.t
90-test_secmem.t
90-test_shlibload.t test/recipes/90-test_shlibload.t: Skip when address sanitizer enabled 2020-11-01 06:01:09 +01:00
90-test_srp.t
90-test_sslapi.t TEST: Ensure that the base provider i activated when needed 2020-09-03 17:48:33 +02:00
90-test_sslbuffers.t
90-test_store.t Add test to demonstrate the app's new engine key loading 2020-12-02 20:19:41 +01:00
90-test_sysdefault.t
90-test_threads.t
90-test_time_offset.t
90-test_tls13ccs.t
90-test_tls13encryption.t
90-test_tls13secrets.t
90-test_v3name.t
95-test_external_boringssl.t
95-test_external_gost_engine.t
95-test_external_krb5.t
95-test_external_pyca.t
99-test_ecstress.t
99-test_fuzz_asn1.t [test/recipes] Split test_fuzz into separate recipes 2020-11-12 16:27:17 +02:00
99-test_fuzz_asn1parse.t [test/recipes] Split test_fuzz into separate recipes 2020-11-12 16:27:17 +02:00
99-test_fuzz_bignum.t [test/recipes] Split test_fuzz into separate recipes 2020-11-12 16:27:17 +02:00
99-test_fuzz_bndiv.t [test/recipes] Split test_fuzz into separate recipes 2020-11-12 16:27:17 +02:00
99-test_fuzz_client.t [test/recipes] Split test_fuzz into separate recipes 2020-11-12 16:27:17 +02:00
99-test_fuzz_cmp.t [test/recipes] Split test_fuzz into separate recipes 2020-11-12 16:27:17 +02:00
99-test_fuzz_cms.t [test/recipes] Split test_fuzz into separate recipes 2020-11-12 16:27:17 +02:00
99-test_fuzz_conf.t [test/recipes] Split test_fuzz into separate recipes 2020-11-12 16:27:17 +02:00
99-test_fuzz_crl.t [test/recipes] Split test_fuzz into separate recipes 2020-11-12 16:27:17 +02:00
99-test_fuzz_ct.t [test/recipes] Split test_fuzz into separate recipes 2020-11-12 16:27:17 +02:00
99-test_fuzz_server.t [test/recipes] Split test_fuzz into separate recipes 2020-11-12 16:27:17 +02:00
99-test_fuzz_x509.t [test/recipes] Split test_fuzz into separate recipes 2020-11-12 16:27:17 +02:00
fuzz.pl [test/recipes] Split test_fuzz into separate recipes 2020-11-12 16:27:17 +02:00
ocsp-response.der
tconversion.pl TEST: modify tconversion.pl for forensics 2020-10-16 19:07:20 +02:00