SecurityTests/clxutils/certcrl/testSubjects/ocspFromSsl/ocspsslNew.scr

   1 #
   2 # OCSP verfication of certs obtained from SSL sites
   3 #
   4 globals
   5 certNetFetchEnable = false
   6 useSystemAnchors = true
   7 # alternate these two on successful runs, flip either one for failure
   8 allowUnverified = true
   9 requireOcspIfPresent = false
  10 cacheDisable = false
  11 end
  12 ###
  13 ### all these (until further notice) do OCSP via ocsp.verisign.com
  14 ###
  15 echo "================================="
  16 test = "www.amazon.com"
  17 revokePolicy = ocsp
  18 cert = amazon_v3.100.cer
  19 sslHost = www.amazon.com
  20 requireOcspIfPresent = true
  21 end
  22 echo "================================="
  23 test = "www.cduniverse.com"
  24 revokePolicy = ocsp
  25 cert = cduniverse_v3.000.cer
  26 sslHost = www.cduniverse.com
  27 allowUnverified = false
  28 end
  29 echo "================================="
  30 test = "store.apple.com, allowing unverified"
  31 revokePolicy = ocsp
  32 # leaf has ocsp accessMethod in AIA, intermediate doesn't
  33 allowUnverified = true
  34 cert = apple_v3.000.cer
  35 cert = apple_v3.001.cer
  36 sslHost = store.apple.com
  37 certerror = 1:APPLETP_OCSP_UNAVAILABLE
  38 end
  39 echo "================================="
  40 test = "store.apple.com, require OCSP if present"
  41 revokePolicy = ocsp
  42 # leaf has ocsp accessMethod in AIA, intermediate doesn't
  43 requireOcspIfPresent = true
  44 cert = apple_v3.000.cer
  45 cert = apple_v3.001.cer
  46 sslHost = store.apple.com
  47 certerror = 1:APPLETP_OCSP_UNAVAILABLE
  48 end
  49 echo "================================="
  50 test = "store.apple.com, require OCSP for all, fail"
  51 revokePolicy = ocsp
  52 # leaf has ocsp accessMethod in AIA, intermediate doesn't
  53 allowUnverified = false
  54 cert = apple_v3.000.cer
  55 cert = apple_v3.001.cer
  56 sslHost = store.apple.com
  57 certerror = 1:APPLETP_OCSP_UNAVAILABLE
  58 error = APPLETP_OCSP_UNAVAILABLE
  59 end
  60 echo "================================="
  61 test = "store.apple.com, require OCSP if present, disable net, fail"
  62 revokePolicy = ocsp
  63 # leaf has ocsp accessMethod in AIA, intermediate doesn't
  64 requireOcspIfPresent = true
  65 ocspNetFetchDisable = true
  66 cacheDisable = true
  67 cert = apple_v3.000.cer
  68 cert = apple_v3.001.cer
  69 sslHost = store.apple.com
  70 certerror = 1:APPLETP_OCSP_UNAVAILABLE
  71 error = APPLETP_OCSP_UNAVAILABLE
  72 end
  73 echo "================================="
  74 test = "www.verisign.com"
  75 revokePolicy = ocsp
  76 # leaf has ocsp accessMethod in AIA, intermediate doesn't
  77 allowUnverified = true
  78 cert = verisign_v3.100.cer
  79 cert = verisign_v3.101.cer
  80 #
  81 # This one is the root, which SSL server sent us.
  82 # Leave it in for variety.
  83 #
  84 cert = verisign_v3.102.cer
  85 sslHost = www.verisign.com
  86 certerror = 1:APPLETP_OCSP_UNAVAILABLE
  87 end
  88 echo "================================="
  89 test = "accounts2.keybank.com"
  90 revokePolicy = ocsp
  91 # leaf has ocsp accessMethod in AIA, intermediate doesn't
  92 allowUnverified = true
  93 cert = keybank_v3.100.cer
  94 cert = keybank_v3.101.cer
  95 #
  96 # This one is the root, which SSL server sent us.
  97 # Leave it in for variety.
  98 #
  99 cert = keybank_v3.102.cer
 100 sslHost = accounts2.keybank.com
 101 certerror = 1:APPLETP_OCSP_UNAVAILABLE
 102 end
 103 echo "================================="
 104 test = "secure.authorize.net"
 105 revokePolicy = ocsp
 106 # leaf has ocsp accessMethod in AIA, intermediate doesn't
 107 allowUnverified = true
 108 cert = secauth_v3.100.cer
 109 cert = secauth_v3.101.cer
 110 sslHost = secure.authorize.net
 111 certerror = 1:APPLETP_OCSP_UNAVAILABLE
 112 end
 113 ###
 114 ### OCSP via ocsp.thawte.com
 115 ###
 116 echo "================================="
 117 test = "www.proteron.com"
 118 revokePolicy = ocsp
 119 requireOcspIfPresent = true
 120 cert = proteron_v3.100.cer
 121 sslHost = www.proteron.com
 122 end
 123 #
 124 # misc. others
 125 #
 126 echo "================================="
 127 test = "www.wellsfargo.com"
 128 revokePolicy = ocsp
 129 requireOcspIfPresent = true
 130 cert = wellsfargo_v3.100.cer
 131 cert = wellsfargo_v3.101.cer
 132 sslHost = www.wellsfargo.com
 133 end
 134 echo "================================="
 135 test = "www.certum.pl"
 136 revokePolicy = ocsp
 137 requireOcspIfPresent = true
 138 cert = certum_v3.100.cer
 139 cert = certum_v3.101.cer
 140 sslHost = www.certum.pl
 141 # this, because we don't have the root, instead of APPLETP_OCSP_BAD_RESPONSE
 142 # which Radar 4158052 causes
 143 error = TP_NOT_TRUSTED
 144 end