SecurityTests/clxutils/makeCrl/testFiles/crlTime.scr

   1 #
   2 # test for Radar 4515141: perform cert verify with CRL checking one second before and
   3 # one second after the cert was revoked; the former should succeed, the latter should fail
   4 #
   5 #   leaf cert
   6 #   not before          20060417191040Z         19:10:40 Apr 17, 2006
   7 #   not after           20160414191040Z         19:10:40 Apr 14, 2016
   8 #
   9 #   root cert
  10 #   not before          20060417190954Z         19:10:40 Apr 17, 2006
  11 #   not after           20160414190954Z         19:10:40 Apr 14, 2016
  12 #
  13 #   CRL: not valid until well after leaf cert was created, valid for 10 years, revocation
  14 #       12 hours after CRL is created
  15 #
  16 #   % makeCrl -s crlTestLeaf.cer -i crlTestRoot.cer -o crl.crl -n 315360000 -r 43200
  17 #   ...wrote 282 bytes to crl.crl.
  18 #
  19 #   this update         20060417210558Z         21:05:58 Apr 17, 2006
  20 #   next update         20160414210558Z         21:05:58 Apr 14, 2016
  21 #   cert revoked        20060418090558Z         09:05:58 Apr 18, 2006
  22 #
  23 #   Test cert at revoke + 1 ==> fail                            20060418090559Z
  24 #   Test cert at revoke - 1 ==> OK                                      20060418090557Z
  25 #   Test cert at create with CRL ==> OK                         20060417191040Z (before revocation, before CRL)
  26 #   Test cert at create w/o CRL ==> OK                          20060417191040Z
  27 #   Test cert at create-1 w/o CRL - not yet valid       20060417191039Z
  28 #   Test cert at not after w/o CRL - OK                         20160414191040Z
  29 #   Test cert at not after + 1 - fail                           20160414191041Z
  30 #
  31 #   Certs were  generated from CA in enclosed keychain, crlKeychain.keychaain, pwd = crlKeychain
  32 #
  33
  34 globals
  35 certNetFetchEnable = false
  36 crlNetFetchEnable = false
  37 useSystemAnchors = false
  38 allowUnverified = true
  39 end
  40
  41 test = "basic, no CRL"
  42 requireCrlForAll = false
  43 cert = crlTestLeaf.cer
  44 root = crlTestRoot.cer
  45 end
  46
  47 #
  48 # This is a handy place to test the corner cases of notBefore and notAfter.
  49 # I don't believe these have ever been tested right to the second.
  50 #
  51 test = "basic, no CRL, at NotBefore"
  52 requireCrlForAll = false
  53 cert = crlTestLeaf.cer
  54 root = crlTestRoot.cer
  55 verifyTime = 20060417191040Z
  56 end
  57
  58 test = "basic, no CRL, before NotBefore, expect fail"
  59 requireCrlForAll = false
  60 cert = crlTestLeaf.cer
  61 root = crlTestRoot.cer
  62 verifyTime = 20060417191039Z
  63 error = CSSMERR_TP_CERT_NOT_VALID_YET
  64 # CSSM_CERT_STATUS_NOT_VALID_YET | CSSM_CERT_STATUS_IS_IN_INPUT_CERTS
  65 certstatus = 0:0x06
  66 end
  67
  68 #
  69 # Note root was created before leaf so we assume it will be expired at
  70 # the time of the leaf cert's NotAfter.
  71 #
  72 test = "basic, no CRL, at NotAfter"
  73 requireCrlForAll = false
  74 cert = crlTestLeaf.cer
  75 root = crlTestRoot.cer
  76 verifyTime = 20160414191040Z
  77 allowExpiredRoot = true
  78 end
  79
  80 test = "basic, no CRL, at NotAfter plus 1, expect fail"
  81 requireCrlForAll = false
  82 cert = crlTestLeaf.cer
  83 root = crlTestRoot.cer
  84 verifyTime = 20160414191041Z
  85 error = CSSMERR_TP_CERT_EXPIRED
  86 # CSSM_CERT_STATUS_EXPIRED | CSSM_CERT_STATUS_IS_IN_INPUT_CERTS
  87 certstatus = 0:0x05
  88 end
  89
  90 #
  91 # Begin CRL testing.
  92 #
  93 test = "CRL, prior to revocation, within CRL validity"
  94 requireCrlForAll = true
  95 revokePolicy = crl
  96 cert = crlTestLeaf.cer
  97 root = crlTestRoot.cer
  98 crl = crl.crl
  99 # One second before revocation
 100 verifyTime = 20060418090557Z
 101 end
 102
 103 #
 104 # This ensures that we verify the CRL itself at 'now' instead of the
 105 # cert verification time.
 106 #
 107 test = "CRL, prior to revocation, before CRL validity"
 108 requireCrlForAll = true
 109 revokePolicy = crl
 110 cert = crlTestLeaf.cer
 111 root = crlTestRoot.cer
 112 crl = crl.crl
 113 # Leaf create/notBefore time, definitely before the CRL is valid.
 114 verifyTime = 20060417191040Z
 115 end
 116
 117 test = "CRL, subsequent to revocation"
 118 requireCrlForAll = true
 119 revokePolicy = crl
 120 cert = crlTestLeaf.cer
 121 root = crlTestRoot.cer
 122 crl = crl.crl
 123 # Normal revocation case.
 124 verifyTime = 20060418090559Z
 125 error = CSSMERR_TP_CERT_REVOKED
 126 certerror = 0:CSSMERR_TP_CERT_REVOKED
 127 end