diff options
author | tb <> | 2021-02-26 15:15:40 +0000 |
---|---|---|
committer | tb <> | 2021-02-26 15:15:40 +0000 |
commit | 3f045c3f169355d4b8b237f763dafa09fee95f68 (patch) | |
tree | 2ad13a8e3141637e5e5040b49e98e2caf68c5a39 | |
parent | 7227be70483e3ee10d48bca3182b402fe54a1d4d (diff) | |
download | openbsd-3f045c3f169355d4b8b237f763dafa09fee95f68.tar.gz openbsd-3f045c3f169355d4b8b237f763dafa09fee95f68.tar.bz2 openbsd-3f045c3f169355d4b8b237f763dafa09fee95f68.zip |
zap spades of trailing whitespace
-rwxr-xr-x | src/regress/usr.bin/openssl/appstest.sh | 532 |
1 files changed, 266 insertions, 266 deletions
diff --git a/src/regress/usr.bin/openssl/appstest.sh b/src/regress/usr.bin/openssl/appstest.sh index e90dc989f5..1cc8bacfb1 100755 --- a/src/regress/usr.bin/openssl/appstest.sh +++ b/src/regress/usr.bin/openssl/appstest.sh | |||
@@ -1,6 +1,6 @@ | |||
1 | #!/bin/sh | 1 | #!/bin/sh |
2 | # | 2 | # |
3 | # $OpenBSD: appstest.sh,v 1.46 2020/08/01 14:31:23 inoguchi Exp $ | 3 | # $OpenBSD: appstest.sh,v 1.47 2021/02/26 15:15:40 tb Exp $ |
4 | # | 4 | # |
5 | # Copyright (c) 2016 Kinichiro Inoguchi <inoguchi@openbsd.org> | 5 | # Copyright (c) 2016 Kinichiro Inoguchi <inoguchi@openbsd.org> |
6 | # | 6 | # |
@@ -64,87 +64,87 @@ function usage { | |||
64 | function test_usage_lists_others { | 64 | function test_usage_lists_others { |
65 | # === COMMAND USAGE === | 65 | # === COMMAND USAGE === |
66 | section_message "COMMAND USAGE" | 66 | section_message "COMMAND USAGE" |
67 | 67 | ||
68 | start_message "output usages of all commands." | 68 | start_message "output usages of all commands." |
69 | 69 | ||
70 | cmds=`$openssl_bin list-standard-commands` | 70 | cmds=`$openssl_bin list-standard-commands` |
71 | $openssl_bin -help 2>> $user1_dir/usages.out | 71 | $openssl_bin -help 2>> $user1_dir/usages.out |
72 | for c in $cmds ; do | 72 | for c in $cmds ; do |
73 | $openssl_bin $c -help 2>> $user1_dir/usages.out | 73 | $openssl_bin $c -help 2>> $user1_dir/usages.out |
74 | done | 74 | done |
75 | 75 | ||
76 | start_message "check all list-* commands." | 76 | start_message "check all list-* commands." |
77 | 77 | ||
78 | lists="" | 78 | lists="" |
79 | lists="$lists list-standard-commands" | 79 | lists="$lists list-standard-commands" |
80 | lists="$lists list-message-digest-commands list-message-digest-algorithms" | 80 | lists="$lists list-message-digest-commands list-message-digest-algorithms" |
81 | lists="$lists list-cipher-commands list-cipher-algorithms" | 81 | lists="$lists list-cipher-commands list-cipher-algorithms" |
82 | lists="$lists list-public-key-algorithms" | 82 | lists="$lists list-public-key-algorithms" |
83 | 83 | ||
84 | listsfile=$user1_dir/lists.out | 84 | listsfile=$user1_dir/lists.out |
85 | 85 | ||
86 | for l in $lists ; do | 86 | for l in $lists ; do |
87 | echo "" >> $listsfile | 87 | echo "" >> $listsfile |
88 | echo "$l" >> $listsfile | 88 | echo "$l" >> $listsfile |
89 | $openssl_bin $l >> $listsfile | 89 | $openssl_bin $l >> $listsfile |
90 | done | 90 | done |
91 | 91 | ||
92 | start_message "check interactive mode" | 92 | start_message "check interactive mode" |
93 | $openssl_bin <<__EOF__ | 93 | $openssl_bin <<__EOF__ |
94 | help | 94 | help |
95 | quit | 95 | quit |
96 | __EOF__ | 96 | __EOF__ |
97 | check_exit_status $? | 97 | check_exit_status $? |
98 | 98 | ||
99 | #---------#---------#---------#---------#---------#---------#--------- | 99 | #---------#---------#---------#---------#---------#---------#--------- |
100 | 100 | ||
101 | # --- listing operations --- | 101 | # --- listing operations --- |
102 | section_message "listing operations" | 102 | section_message "listing operations" |
103 | 103 | ||
104 | start_message "ciphers" | 104 | start_message "ciphers" |
105 | $openssl_bin ciphers -V > $user1_dir/ciphers-V.out | 105 | $openssl_bin ciphers -V > $user1_dir/ciphers-V.out |
106 | check_exit_status $? | 106 | check_exit_status $? |
107 | 107 | ||
108 | start_message "errstr" | 108 | start_message "errstr" |
109 | $openssl_bin errstr 2606A074 | 109 | $openssl_bin errstr 2606A074 |
110 | check_exit_status $? | 110 | check_exit_status $? |
111 | $openssl_bin errstr -stats 2606A074 > $user1_dir/errstr-stats.out | 111 | $openssl_bin errstr -stats 2606A074 > $user1_dir/errstr-stats.out |
112 | check_exit_status $? | 112 | check_exit_status $? |
113 | 113 | ||
114 | #---------#---------#---------#---------#---------#---------#--------- | 114 | #---------#---------#---------#---------#---------#---------#--------- |
115 | 115 | ||
116 | # --- random number etc. operations --- | 116 | # --- random number etc. operations --- |
117 | section_message "random number etc. operations" | 117 | section_message "random number etc. operations" |
118 | 118 | ||
119 | start_message "passwd" | 119 | start_message "passwd" |
120 | 120 | ||
121 | pass="test-pass-1234" | 121 | pass="test-pass-1234" |
122 | 122 | ||
123 | echo $pass | $openssl_bin passwd -stdin -1 | 123 | echo $pass | $openssl_bin passwd -stdin -1 |
124 | check_exit_status $? | 124 | check_exit_status $? |
125 | 125 | ||
126 | echo $pass | $openssl_bin passwd -stdin -apr1 | 126 | echo $pass | $openssl_bin passwd -stdin -apr1 |
127 | check_exit_status $? | 127 | check_exit_status $? |
128 | 128 | ||
129 | echo $pass | $openssl_bin passwd -stdin -crypt | 129 | echo $pass | $openssl_bin passwd -stdin -crypt |
130 | check_exit_status $? | 130 | check_exit_status $? |
131 | 131 | ||
132 | start_message "prime" | 132 | start_message "prime" |
133 | 133 | ||
134 | $openssl_bin prime 1 | 134 | $openssl_bin prime 1 |
135 | check_exit_status $? | 135 | check_exit_status $? |
136 | 136 | ||
137 | $openssl_bin prime 2 | 137 | $openssl_bin prime 2 |
138 | check_exit_status $? | 138 | check_exit_status $? |
139 | 139 | ||
140 | $openssl_bin prime -bits 64 -checks 3 -generate -hex -safe 5 | 140 | $openssl_bin prime -bits 64 -checks 3 -generate -hex -safe 5 |
141 | check_exit_status $? | 141 | check_exit_status $? |
142 | 142 | ||
143 | start_message "rand" | 143 | start_message "rand" |
144 | 144 | ||
145 | $openssl_bin rand -base64 100 | 145 | $openssl_bin rand -base64 100 |
146 | check_exit_status $? | 146 | check_exit_status $? |
147 | 147 | ||
148 | $openssl_bin rand -hex 100 | 148 | $openssl_bin rand -hex 100 |
149 | check_exit_status $? | 149 | check_exit_status $? |
150 | } | 150 | } |
@@ -152,9 +152,9 @@ __EOF__ | |||
152 | function test_md { | 152 | function test_md { |
153 | # === MESSAGE DIGEST COMMANDS === | 153 | # === MESSAGE DIGEST COMMANDS === |
154 | section_message "MESSAGE DIGEST COMMANDS" | 154 | section_message "MESSAGE DIGEST COMMANDS" |
155 | 155 | ||
156 | start_message "dgst - See [MESSAGE DIGEST COMMANDS] section." | 156 | start_message "dgst - See [MESSAGE DIGEST COMMANDS] section." |
157 | 157 | ||
158 | text="1234567890abcdefghijklmnopqrstuvwxyz" | 158 | text="1234567890abcdefghijklmnopqrstuvwxyz" |
159 | dgstdat=$user1_dir/dgst.dat | 159 | dgstdat=$user1_dir/dgst.dat |
160 | echo $text > $dgstdat | 160 | echo $text > $dgstdat |
@@ -167,24 +167,24 @@ function test_md { | |||
167 | 167 | ||
168 | $openssl_bin genrsa -aes256 -passout pass:$dgstpass -out $dgstkey | 168 | $openssl_bin genrsa -aes256 -passout pass:$dgstpass -out $dgstkey |
169 | check_exit_status $? | 169 | check_exit_status $? |
170 | 170 | ||
171 | $openssl_bin pkey -in $dgstkey -passin pass:$dgstpass -pubout \ | 171 | $openssl_bin pkey -in $dgstkey -passin pass:$dgstpass -pubout \ |
172 | -out $dgstpub | 172 | -out $dgstpub |
173 | check_exit_status $? | 173 | check_exit_status $? |
174 | 174 | ||
175 | digests=`$openssl_bin list-message-digest-commands` | 175 | digests=`$openssl_bin list-message-digest-commands` |
176 | 176 | ||
177 | for d in $digests ; do | 177 | for d in $digests ; do |
178 | 178 | ||
179 | echo -n "$d ... " | 179 | echo -n "$d ... " |
180 | $openssl_bin dgst -$d -hex -out $dgstdat.$d $dgstdat | 180 | $openssl_bin dgst -$d -hex -out $dgstdat.$d $dgstdat |
181 | check_exit_status $? | 181 | check_exit_status $? |
182 | 182 | ||
183 | echo -n "$d HMAC ... " | 183 | echo -n "$d HMAC ... " |
184 | $openssl_bin dgst -$d -c -hmac $hmac_key -out $dgstdat.$d.hmac \ | 184 | $openssl_bin dgst -$d -c -hmac $hmac_key -out $dgstdat.$d.hmac \ |
185 | $dgstdat | 185 | $dgstdat |
186 | check_exit_status $? | 186 | check_exit_status $? |
187 | 187 | ||
188 | echo -n "$d CMAC ... " | 188 | echo -n "$d CMAC ... " |
189 | $openssl_bin dgst -$d -r -mac cmac -macopt cipher:aes-128-cbc \ | 189 | $openssl_bin dgst -$d -r -mac cmac -macopt cipher:aes-128-cbc \ |
190 | -macopt hexkey:$cmac_key -out $dgstdat.$d.cmac $dgstdat | 190 | -macopt hexkey:$cmac_key -out $dgstdat.$d.cmac $dgstdat |
@@ -213,27 +213,27 @@ function test_md { | |||
213 | function test_encoding_cipher { | 213 | function test_encoding_cipher { |
214 | # === ENCODING AND CIPHER COMMANDS === | 214 | # === ENCODING AND CIPHER COMMANDS === |
215 | section_message "ENCODING AND CIPHER COMMANDS" | 215 | section_message "ENCODING AND CIPHER COMMANDS" |
216 | 216 | ||
217 | start_message "enc - See [ENCODING AND CIPHER COMMANDS] section." | 217 | start_message "enc - See [ENCODING AND CIPHER COMMANDS] section." |
218 | 218 | ||
219 | text="1234567890abcdefghijklmnopqrstuvwxyz" | 219 | text="1234567890abcdefghijklmnopqrstuvwxyz" |
220 | encfile=$user1_dir/encfile.dat | 220 | encfile=$user1_dir/encfile.dat |
221 | echo $text > $encfile | 221 | echo $text > $encfile |
222 | pass="test-pass-1234" | 222 | pass="test-pass-1234" |
223 | 223 | ||
224 | ciphers=`$openssl_bin list-cipher-commands` | 224 | ciphers=`$openssl_bin list-cipher-commands` |
225 | 225 | ||
226 | for c in $ciphers ; do | 226 | for c in $ciphers ; do |
227 | echo -n "$c ... encoding ... " | 227 | echo -n "$c ... encoding ... " |
228 | $openssl_bin enc -$c -e -base64 -pass pass:$pass \ | 228 | $openssl_bin enc -$c -e -base64 -pass pass:$pass \ |
229 | -in $encfile -out $encfile-$c.enc | 229 | -in $encfile -out $encfile-$c.enc |
230 | check_exit_status $? | 230 | check_exit_status $? |
231 | 231 | ||
232 | echo -n "decoding ... " | 232 | echo -n "decoding ... " |
233 | $openssl_bin enc -$c -d -base64 -pass pass:$pass \ | 233 | $openssl_bin enc -$c -d -base64 -pass pass:$pass \ |
234 | -in $encfile-$c.enc -out $encfile-$c.dec | 234 | -in $encfile-$c.enc -out $encfile-$c.dec |
235 | check_exit_status $? | 235 | check_exit_status $? |
236 | 236 | ||
237 | echo -n "cmp ... " | 237 | echo -n "cmp ... " |
238 | cmp $encfile $encfile-$c.dec | 238 | cmp $encfile $encfile-$c.dec |
239 | check_exit_status $? | 239 | check_exit_status $? |
@@ -243,20 +243,20 @@ function test_encoding_cipher { | |||
243 | function test_key { | 243 | function test_key { |
244 | # === various KEY operations === | 244 | # === various KEY operations === |
245 | section_message "various KEY operations" | 245 | section_message "various KEY operations" |
246 | 246 | ||
247 | key_pass=test-key-pass | 247 | key_pass=test-key-pass |
248 | 248 | ||
249 | # DH | 249 | # DH |
250 | 250 | ||
251 | start_message "gendh - Obsoleted by dhparam." | 251 | start_message "gendh - Obsoleted by dhparam." |
252 | gendh2=$key_dir/gendh2.pem | 252 | gendh2=$key_dir/gendh2.pem |
253 | $openssl_bin gendh -2 -out $gendh2 > $gendh2.log 2>&1 | 253 | $openssl_bin gendh -2 -out $gendh2 > $gendh2.log 2>&1 |
254 | check_exit_status $? | 254 | check_exit_status $? |
255 | 255 | ||
256 | start_message "dh - Obsoleted by dhparam." | 256 | start_message "dh - Obsoleted by dhparam." |
257 | $openssl_bin dh -in $gendh2 -check -text -out $gendh2.out | 257 | $openssl_bin dh -in $gendh2 -check -text -out $gendh2.out |
258 | check_exit_status $? | 258 | check_exit_status $? |
259 | 259 | ||
260 | if [ $no_long_tests = 0 ] ; then | 260 | if [ $no_long_tests = 0 ] ; then |
261 | start_message "dhparam - Superseded by genpkey and pkeyparam." | 261 | start_message "dhparam - Superseded by genpkey and pkeyparam." |
262 | dhparam2=$key_dir/dhparam2.pem | 262 | dhparam2=$key_dir/dhparam2.pem |
@@ -268,111 +268,111 @@ function test_key { | |||
268 | else | 268 | else |
269 | start_message "SKIPPING dhparam - Superseded by genpkey and pkeyparam. (quick mode)" | 269 | start_message "SKIPPING dhparam - Superseded by genpkey and pkeyparam. (quick mode)" |
270 | fi | 270 | fi |
271 | 271 | ||
272 | # DSA | 272 | # DSA |
273 | 273 | ||
274 | start_message "dsaparam - Superseded by genpkey and pkeyparam." | 274 | start_message "dsaparam - Superseded by genpkey and pkeyparam." |
275 | dsaparam512=$key_dir/dsaparam512.pem | 275 | dsaparam512=$key_dir/dsaparam512.pem |
276 | $openssl_bin dsaparam -genkey -out $dsaparam512 512 \ | 276 | $openssl_bin dsaparam -genkey -out $dsaparam512 512 \ |
277 | > $dsaparam512.log 2>&1 | 277 | > $dsaparam512.log 2>&1 |
278 | check_exit_status $? | 278 | check_exit_status $? |
279 | 279 | ||
280 | start_message "dsa" | 280 | start_message "dsa" |
281 | $openssl_bin dsa -in $dsaparam512 -text -modulus -out $dsaparam512.out | 281 | $openssl_bin dsa -in $dsaparam512 -text -modulus -out $dsaparam512.out |
282 | check_exit_status $? | 282 | check_exit_status $? |
283 | 283 | ||
284 | start_message "gendsa - Superseded by genpkey and pkey." | 284 | start_message "gendsa - Superseded by genpkey and pkey." |
285 | gendsa_des3=$key_dir/gendsa_des3.pem | 285 | gendsa_des3=$key_dir/gendsa_des3.pem |
286 | $openssl_bin gendsa -des3 -out $gendsa_des3 \ | 286 | $openssl_bin gendsa -des3 -out $gendsa_des3 \ |
287 | -passout pass:$key_pass $dsaparam512 | 287 | -passout pass:$key_pass $dsaparam512 |
288 | check_exit_status $? | 288 | check_exit_status $? |
289 | 289 | ||
290 | # RSA | 290 | # RSA |
291 | 291 | ||
292 | start_message "genrsa - Superseded by genpkey." | 292 | start_message "genrsa - Superseded by genpkey." |
293 | genrsa_aes256=$key_dir/genrsa_aes256.pem | 293 | genrsa_aes256=$key_dir/genrsa_aes256.pem |
294 | $openssl_bin genrsa -f4 -aes256 -out $genrsa_aes256 \ | 294 | $openssl_bin genrsa -f4 -aes256 -out $genrsa_aes256 \ |
295 | -passout pass:$key_pass 2048 > $genrsa_aes256.log 2>&1 | 295 | -passout pass:$key_pass 2048 > $genrsa_aes256.log 2>&1 |
296 | check_exit_status $? | 296 | check_exit_status $? |
297 | 297 | ||
298 | start_message "rsa" | 298 | start_message "rsa" |
299 | $openssl_bin rsa -in $genrsa_aes256 -passin pass:$key_pass \ | 299 | $openssl_bin rsa -in $genrsa_aes256 -passin pass:$key_pass \ |
300 | -check -text -out $genrsa_aes256.out | 300 | -check -text -out $genrsa_aes256.out |
301 | check_exit_status $? | 301 | check_exit_status $? |
302 | 302 | ||
303 | start_message "rsautl - Superseded by pkeyutl." | 303 | start_message "rsautl - Superseded by pkeyutl." |
304 | rsautldat=$key_dir/rsautl.dat | 304 | rsautldat=$key_dir/rsautl.dat |
305 | rsautlsig=$key_dir/rsautl.sig | 305 | rsautlsig=$key_dir/rsautl.sig |
306 | echo "abcdefghijklmnopqrstuvwxyz1234567890" > $rsautldat | 306 | echo "abcdefghijklmnopqrstuvwxyz1234567890" > $rsautldat |
307 | 307 | ||
308 | $openssl_bin rsautl -sign -in $rsautldat -inkey $genrsa_aes256 \ | 308 | $openssl_bin rsautl -sign -in $rsautldat -inkey $genrsa_aes256 \ |
309 | -passin pass:$key_pass -out $rsautlsig | 309 | -passin pass:$key_pass -out $rsautlsig |
310 | check_exit_status $? | 310 | check_exit_status $? |
311 | 311 | ||
312 | $openssl_bin rsautl -verify -in $rsautlsig -inkey $genrsa_aes256 \ | 312 | $openssl_bin rsautl -verify -in $rsautlsig -inkey $genrsa_aes256 \ |
313 | -passin pass:$key_pass | 313 | -passin pass:$key_pass |
314 | check_exit_status $? | 314 | check_exit_status $? |
315 | 315 | ||
316 | # EC | 316 | # EC |
317 | 317 | ||
318 | start_message "ecparam -list-curves" | 318 | start_message "ecparam -list-curves" |
319 | $openssl_bin ecparam -list_curves -out $key_dir/ecparam-list_curves.out | 319 | $openssl_bin ecparam -list_curves -out $key_dir/ecparam-list_curves.out |
320 | check_exit_status $? | 320 | check_exit_status $? |
321 | 321 | ||
322 | # get all EC curves | 322 | # get all EC curves |
323 | ec_curves=`$openssl_bin ecparam -list_curves | grep ':' | cut -d ':' -f 1` | 323 | ec_curves=`$openssl_bin ecparam -list_curves | grep ':' | cut -d ':' -f 1` |
324 | 324 | ||
325 | start_message "ecparam and ec" | 325 | start_message "ecparam and ec" |
326 | 326 | ||
327 | for curve in $ec_curves ; | 327 | for curve in $ec_curves ; |
328 | do | 328 | do |
329 | ecparam=$key_dir/ecparam_$curve.pem | 329 | ecparam=$key_dir/ecparam_$curve.pem |
330 | 330 | ||
331 | echo -n "ec - $curve ... ecparam ... " | 331 | echo -n "ec - $curve ... ecparam ... " |
332 | $openssl_bin ecparam -out $ecparam -name $curve -genkey \ | 332 | $openssl_bin ecparam -out $ecparam -name $curve -genkey \ |
333 | -param_enc explicit -conv_form compressed -C | 333 | -param_enc explicit -conv_form compressed -C |
334 | check_exit_status $? | 334 | check_exit_status $? |
335 | 335 | ||
336 | echo -n "ec ... " | 336 | echo -n "ec ... " |
337 | $openssl_bin ec -in $ecparam -text \ | 337 | $openssl_bin ec -in $ecparam -text \ |
338 | -out $ecparam.out 2> /dev/null | 338 | -out $ecparam.out 2> /dev/null |
339 | check_exit_status $? | 339 | check_exit_status $? |
340 | done | 340 | done |
341 | 341 | ||
342 | # PKEY | 342 | # PKEY |
343 | 343 | ||
344 | start_message "genpkey" | 344 | start_message "genpkey" |
345 | 345 | ||
346 | # DH by GENPKEY | 346 | # DH by GENPKEY |
347 | 347 | ||
348 | genpkey_dh_param=$key_dir/genpkey_dh_param.pem | 348 | genpkey_dh_param=$key_dir/genpkey_dh_param.pem |
349 | $openssl_bin genpkey -genparam -algorithm DH -out $genpkey_dh_param \ | 349 | $openssl_bin genpkey -genparam -algorithm DH -out $genpkey_dh_param \ |
350 | -pkeyopt dh_paramgen_prime_len:1024 > $genpkey_dh_param.log 2>&1 | 350 | -pkeyopt dh_paramgen_prime_len:1024 > $genpkey_dh_param.log 2>&1 |
351 | check_exit_status $? | 351 | check_exit_status $? |
352 | 352 | ||
353 | genpkey_dh=$key_dir/genpkey_dh.pem | 353 | genpkey_dh=$key_dir/genpkey_dh.pem |
354 | $openssl_bin genpkey -paramfile $genpkey_dh_param -out $genpkey_dh | 354 | $openssl_bin genpkey -paramfile $genpkey_dh_param -out $genpkey_dh |
355 | check_exit_status $? | 355 | check_exit_status $? |
356 | 356 | ||
357 | # DSA by GENPKEY | 357 | # DSA by GENPKEY |
358 | 358 | ||
359 | genpkey_dsa_param=$key_dir/genpkey_dsa_param.pem | 359 | genpkey_dsa_param=$key_dir/genpkey_dsa_param.pem |
360 | $openssl_bin genpkey -genparam -algorithm DSA -out $genpkey_dsa_param \ | 360 | $openssl_bin genpkey -genparam -algorithm DSA -out $genpkey_dsa_param \ |
361 | -pkeyopt dsa_paramgen_bits:1024 > $genpkey_dsa_param.log 2>&1 | 361 | -pkeyopt dsa_paramgen_bits:1024 > $genpkey_dsa_param.log 2>&1 |
362 | check_exit_status $? | 362 | check_exit_status $? |
363 | 363 | ||
364 | genpkey_dsa=$key_dir/genpkey_dsa.pem | 364 | genpkey_dsa=$key_dir/genpkey_dsa.pem |
365 | $openssl_bin genpkey -paramfile $genpkey_dsa_param -out $genpkey_dsa | 365 | $openssl_bin genpkey -paramfile $genpkey_dsa_param -out $genpkey_dsa |
366 | check_exit_status $? | 366 | check_exit_status $? |
367 | 367 | ||
368 | # RSA by GENPKEY | 368 | # RSA by GENPKEY |
369 | 369 | ||
370 | genpkey_rsa=$key_dir/genpkey_rsa.pem | 370 | genpkey_rsa=$key_dir/genpkey_rsa.pem |
371 | $openssl_bin genpkey -algorithm RSA -out $genpkey_rsa \ | 371 | $openssl_bin genpkey -algorithm RSA -out $genpkey_rsa \ |
372 | -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3 \ | 372 | -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3 \ |
373 | > $genpkey_rsa.log 2>&1 | 373 | > $genpkey_rsa.log 2>&1 |
374 | check_exit_status $? | 374 | check_exit_status $? |
375 | 375 | ||
376 | genpkey_rsa_pss=$key_dir/genpkey_rsa_pss.pem | 376 | genpkey_rsa_pss=$key_dir/genpkey_rsa_pss.pem |
377 | $openssl_bin genpkey -algorithm RSA-PSS -out $genpkey_rsa_pss \ | 377 | $openssl_bin genpkey -algorithm RSA-PSS -out $genpkey_rsa_pss \ |
378 | -pkeyopt rsa_keygen_bits:2048 \ | 378 | -pkeyopt rsa_keygen_bits:2048 \ |
@@ -381,72 +381,72 @@ function test_key { | |||
381 | -pkeyopt rsa_pss_keygen_saltlen:32 \ | 381 | -pkeyopt rsa_pss_keygen_saltlen:32 \ |
382 | > $genpkey_rsa_pss.log 2>&1 | 382 | > $genpkey_rsa_pss.log 2>&1 |
383 | check_exit_status $? | 383 | check_exit_status $? |
384 | 384 | ||
385 | # EC by GENPKEY | 385 | # EC by GENPKEY |
386 | 386 | ||
387 | genpkey_ec_param=$key_dir/genpkey_ec_param.pem | 387 | genpkey_ec_param=$key_dir/genpkey_ec_param.pem |
388 | $openssl_bin genpkey -genparam -algorithm EC -out $genpkey_ec_param \ | 388 | $openssl_bin genpkey -genparam -algorithm EC -out $genpkey_ec_param \ |
389 | -pkeyopt ec_paramgen_curve:secp384r1 | 389 | -pkeyopt ec_paramgen_curve:secp384r1 |
390 | check_exit_status $? | 390 | check_exit_status $? |
391 | 391 | ||
392 | genpkey_ec=$key_dir/genpkey_ec.pem | 392 | genpkey_ec=$key_dir/genpkey_ec.pem |
393 | $openssl_bin genpkey -paramfile $genpkey_ec_param -out $genpkey_ec | 393 | $openssl_bin genpkey -paramfile $genpkey_ec_param -out $genpkey_ec |
394 | check_exit_status $? | 394 | check_exit_status $? |
395 | 395 | ||
396 | genpkey_ec_2=$key_dir/genpkey_ec_2.pem | 396 | genpkey_ec_2=$key_dir/genpkey_ec_2.pem |
397 | $openssl_bin genpkey -paramfile $genpkey_ec_param -out $genpkey_ec_2 | 397 | $openssl_bin genpkey -paramfile $genpkey_ec_param -out $genpkey_ec_2 |
398 | check_exit_status $? | 398 | check_exit_status $? |
399 | 399 | ||
400 | start_message "pkeyparam" | 400 | start_message "pkeyparam" |
401 | 401 | ||
402 | $openssl_bin pkeyparam -in $genpkey_dh_param -text \ | 402 | $openssl_bin pkeyparam -in $genpkey_dh_param -text \ |
403 | -out $genpkey_dh_param.out | 403 | -out $genpkey_dh_param.out |
404 | check_exit_status $? | 404 | check_exit_status $? |
405 | 405 | ||
406 | $openssl_bin pkeyparam -in $genpkey_dsa_param -text \ | 406 | $openssl_bin pkeyparam -in $genpkey_dsa_param -text \ |
407 | -out $genpkey_dsa_param.out | 407 | -out $genpkey_dsa_param.out |
408 | check_exit_status $? | 408 | check_exit_status $? |
409 | 409 | ||
410 | $openssl_bin pkeyparam -in $genpkey_ec_param -text \ | 410 | $openssl_bin pkeyparam -in $genpkey_ec_param -text \ |
411 | -out $genpkey_ec_param.out | 411 | -out $genpkey_ec_param.out |
412 | check_exit_status $? | 412 | check_exit_status $? |
413 | 413 | ||
414 | start_message "pkey" | 414 | start_message "pkey" |
415 | 415 | ||
416 | $openssl_bin pkey -in $genpkey_dh -pubout -out $genpkey_dh.pub \ | 416 | $openssl_bin pkey -in $genpkey_dh -pubout -out $genpkey_dh.pub \ |
417 | -text_pub | 417 | -text_pub |
418 | check_exit_status $? | 418 | check_exit_status $? |
419 | 419 | ||
420 | $openssl_bin pkey -in $genpkey_dsa -pubout -out $genpkey_dsa.pub \ | 420 | $openssl_bin pkey -in $genpkey_dsa -pubout -out $genpkey_dsa.pub \ |
421 | -text_pub | 421 | -text_pub |
422 | check_exit_status $? | 422 | check_exit_status $? |
423 | 423 | ||
424 | $openssl_bin pkey -in $genpkey_rsa -pubout -out $genpkey_rsa.pub \ | 424 | $openssl_bin pkey -in $genpkey_rsa -pubout -out $genpkey_rsa.pub \ |
425 | -text_pub | 425 | -text_pub |
426 | check_exit_status $? | 426 | check_exit_status $? |
427 | 427 | ||
428 | $openssl_bin pkey -in $genpkey_ec -pubout -out $genpkey_ec.pub \ | 428 | $openssl_bin pkey -in $genpkey_ec -pubout -out $genpkey_ec.pub \ |
429 | -text_pub | 429 | -text_pub |
430 | check_exit_status $? | 430 | check_exit_status $? |
431 | 431 | ||
432 | $openssl_bin pkey -in $genpkey_ec_2 -pubout -out $genpkey_ec_2.pub \ | 432 | $openssl_bin pkey -in $genpkey_ec_2 -pubout -out $genpkey_ec_2.pub \ |
433 | -text_pub | 433 | -text_pub |
434 | check_exit_status $? | 434 | check_exit_status $? |
435 | 435 | ||
436 | start_message "pkeyutl" | 436 | start_message "pkeyutl" |
437 | 437 | ||
438 | pkeyutldat=$key_dir/pkeyutl.dat | 438 | pkeyutldat=$key_dir/pkeyutl.dat |
439 | pkeyutlsig=$key_dir/pkeyutl.sig | 439 | pkeyutlsig=$key_dir/pkeyutl.sig |
440 | echo "abcdefghijklmnopqrstuvwxyz1234567890" > $pkeyutldat | 440 | echo "abcdefghijklmnopqrstuvwxyz1234567890" > $pkeyutldat |
441 | 441 | ||
442 | $openssl_bin pkeyutl -sign -in $pkeyutldat -inkey $genpkey_rsa \ | 442 | $openssl_bin pkeyutl -sign -in $pkeyutldat -inkey $genpkey_rsa \ |
443 | -out $pkeyutlsig | 443 | -out $pkeyutlsig |
444 | check_exit_status $? | 444 | check_exit_status $? |
445 | 445 | ||
446 | $openssl_bin pkeyutl -verify -in $pkeyutldat -sigfile $pkeyutlsig \ | 446 | $openssl_bin pkeyutl -verify -in $pkeyutldat -sigfile $pkeyutlsig \ |
447 | -inkey $genpkey_rsa | 447 | -inkey $genpkey_rsa |
448 | check_exit_status $? | 448 | check_exit_status $? |
449 | 449 | ||
450 | $openssl_bin pkeyutl -verifyrecover -in $pkeyutlsig -inkey $genpkey_rsa | 450 | $openssl_bin pkeyutl -verifyrecover -in $pkeyutlsig -inkey $genpkey_rsa |
451 | check_exit_status $? | 451 | check_exit_status $? |
452 | 452 | ||
@@ -562,16 +562,16 @@ extendedKeyUsage = OCSPSigning | |||
562 | __EOF__ | 562 | __EOF__ |
563 | 563 | ||
564 | #---------#---------#---------#---------#---------#---------#--------- | 564 | #---------#---------#---------#---------#---------#---------#--------- |
565 | 565 | ||
566 | # | 566 | # |
567 | # setup test CA | 567 | # setup test CA |
568 | # | 568 | # |
569 | 569 | ||
570 | mkdir -p $ca_dir | 570 | mkdir -p $ca_dir |
571 | mkdir -p $tsa_dir | 571 | mkdir -p $tsa_dir |
572 | mkdir -p $ocsp_dir | 572 | mkdir -p $ocsp_dir |
573 | mkdir -p $server_dir | 573 | mkdir -p $server_dir |
574 | 574 | ||
575 | mkdir -p $ca_dir/certs | 575 | mkdir -p $ca_dir/certs |
576 | mkdir -p $ca_dir/private | 576 | mkdir -p $ca_dir/private |
577 | mkdir -p $ca_dir/crl | 577 | mkdir -p $ca_dir/crl |
@@ -581,7 +581,7 @@ __EOF__ | |||
581 | touch $ca_dir/index.txt | 581 | touch $ca_dir/index.txt |
582 | touch $ca_dir/crlnumber | 582 | touch $ca_dir/crlnumber |
583 | echo "01" > $ca_dir/crlnumber | 583 | echo "01" > $ca_dir/crlnumber |
584 | 584 | ||
585 | # | 585 | # |
586 | # setup test TSA | 586 | # setup test TSA |
587 | # | 587 | # |
@@ -589,28 +589,28 @@ __EOF__ | |||
589 | chmod 700 $tsa_dir/private | 589 | chmod 700 $tsa_dir/private |
590 | echo "01" > $tsa_dir/serial | 590 | echo "01" > $tsa_dir/serial |
591 | touch $tsa_dir/index.txt | 591 | touch $tsa_dir/index.txt |
592 | 592 | ||
593 | # | 593 | # |
594 | # setup test OCSP | 594 | # setup test OCSP |
595 | # | 595 | # |
596 | mkdir -p $ocsp_dir/private | 596 | mkdir -p $ocsp_dir/private |
597 | chmod 700 $ocsp_dir/private | 597 | chmod 700 $ocsp_dir/private |
598 | 598 | ||
599 | #---------#---------#---------#---------#---------#---------#--------- | 599 | #---------#---------#---------#---------#---------#---------#--------- |
600 | 600 | ||
601 | # --- CA initiate (generate CA key and cert) --- | 601 | # --- CA initiate (generate CA key and cert) --- |
602 | 602 | ||
603 | start_message "req ... generate CA key and self signed cert" | 603 | start_message "req ... generate CA key and self signed cert" |
604 | 604 | ||
605 | ca_cert=$ca_dir/ca_cert.pem | 605 | ca_cert=$ca_dir/ca_cert.pem |
606 | ca_key=$ca_dir/private/ca_key.pem ca_pass=test-ca-pass | 606 | ca_key=$ca_dir/private/ca_key.pem ca_pass=test-ca-pass |
607 | 607 | ||
608 | if [ $mingw = 0 ] ; then | 608 | if [ $mingw = 0 ] ; then |
609 | subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testCA.test-dummy.com/' | 609 | subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testCA.test-dummy.com/' |
610 | else | 610 | else |
611 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testCA.test-dummy.com\' | 611 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testCA.test-dummy.com\' |
612 | fi | 612 | fi |
613 | 613 | ||
614 | $openssl_bin req -new -x509 -batch -newkey rsa:2048 \ | 614 | $openssl_bin req -new -x509 -batch -newkey rsa:2048 \ |
615 | -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3 \ | 615 | -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3 \ |
616 | -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ | 616 | -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ |
@@ -619,33 +619,33 @@ __EOF__ | |||
619 | -keyout $ca_key -passout pass:$ca_pass \ | 619 | -keyout $ca_key -passout pass:$ca_pass \ |
620 | -out $ca_cert -outform pem | 620 | -out $ca_cert -outform pem |
621 | check_exit_status $? | 621 | check_exit_status $? |
622 | 622 | ||
623 | #---------#---------#---------#---------#---------#---------#--------- | 623 | #---------#---------#---------#---------#---------#---------#--------- |
624 | 624 | ||
625 | # --- TSA initiate (generate TSA key and cert) --- | 625 | # --- TSA initiate (generate TSA key and cert) --- |
626 | 626 | ||
627 | start_message "req ... generate TSA key and cert" | 627 | start_message "req ... generate TSA key and cert" |
628 | 628 | ||
629 | # generate CSR for TSA | 629 | # generate CSR for TSA |
630 | 630 | ||
631 | tsa_csr=$tsa_dir/tsa_csr.pem | 631 | tsa_csr=$tsa_dir/tsa_csr.pem |
632 | tsa_key=$tsa_dir/private/tsa_key.pem | 632 | tsa_key=$tsa_dir/private/tsa_key.pem |
633 | tsa_pass=test-tsa-pass | 633 | tsa_pass=test-tsa-pass |
634 | 634 | ||
635 | if [ $mingw = 0 ] ; then | 635 | if [ $mingw = 0 ] ; then |
636 | subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testTSA.test-dummy.com/' | 636 | subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testTSA.test-dummy.com/' |
637 | else | 637 | else |
638 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testTSA.test-dummy.com\' | 638 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testTSA.test-dummy.com\' |
639 | fi | 639 | fi |
640 | 640 | ||
641 | $openssl_bin req -new -keyout $tsa_key -out $tsa_csr \ | 641 | $openssl_bin req -new -keyout $tsa_key -out $tsa_csr \ |
642 | -passout pass:$tsa_pass -subj $subj -asn1-kludge | 642 | -passout pass:$tsa_pass -subj $subj -asn1-kludge |
643 | check_exit_status $? | 643 | check_exit_status $? |
644 | 644 | ||
645 | start_message "ca ... sign by CA with TSA extensions" | 645 | start_message "ca ... sign by CA with TSA extensions" |
646 | 646 | ||
647 | tsa_cert=$tsa_dir/tsa_cert.pem | 647 | tsa_cert=$tsa_dir/tsa_cert.pem |
648 | 648 | ||
649 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -keyform pem \ | 649 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -keyform pem \ |
650 | -key $ca_pass -config $ssldir/openssl.cnf -create_serial \ | 650 | -key $ca_pass -config $ssldir/openssl.cnf -create_serial \ |
651 | -policy policy_match -days 1 -md sha256 -extensions tsa_ext \ | 651 | -policy policy_match -days 1 -md sha256 -extensions tsa_ext \ |
@@ -654,55 +654,55 @@ __EOF__ | |||
654 | -in $tsa_csr -outdir $tsa_dir -out $tsa_cert -verbose -notext \ | 654 | -in $tsa_csr -outdir $tsa_dir -out $tsa_cert -verbose -notext \ |
655 | > $tsa_cert.log 2>&1 | 655 | > $tsa_cert.log 2>&1 |
656 | check_exit_status $? | 656 | check_exit_status $? |
657 | 657 | ||
658 | #---------#---------#---------#---------#---------#---------#--------- | 658 | #---------#---------#---------#---------#---------#---------#--------- |
659 | 659 | ||
660 | # --- OCSP initiate (generate OCSP key and cert) --- | 660 | # --- OCSP initiate (generate OCSP key and cert) --- |
661 | 661 | ||
662 | start_message "req ... generate OCSP key and cert" | 662 | start_message "req ... generate OCSP key and cert" |
663 | 663 | ||
664 | # generate CSR for OCSP | 664 | # generate CSR for OCSP |
665 | 665 | ||
666 | ocsp_csr=$ocsp_dir/ocsp_csr.pem | 666 | ocsp_csr=$ocsp_dir/ocsp_csr.pem |
667 | ocsp_key=$ocsp_dir/private/ocsp_key.pem | 667 | ocsp_key=$ocsp_dir/private/ocsp_key.pem |
668 | 668 | ||
669 | if [ $mingw = 0 ] ; then | 669 | if [ $mingw = 0 ] ; then |
670 | subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testOCSP.test-dummy.com/' | 670 | subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testOCSP.test-dummy.com/' |
671 | else | 671 | else |
672 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testOCSP.test-dummy.com\' | 672 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testOCSP.test-dummy.com\' |
673 | fi | 673 | fi |
674 | 674 | ||
675 | $openssl_bin req -new -keyout $ocsp_key -nodes -out $ocsp_csr \ | 675 | $openssl_bin req -new -keyout $ocsp_key -nodes -out $ocsp_csr \ |
676 | -subj $subj -no-asn1-kludge | 676 | -subj $subj -no-asn1-kludge |
677 | check_exit_status $? | 677 | check_exit_status $? |
678 | 678 | ||
679 | start_message "ca ... sign by CA with OCSP extensions" | 679 | start_message "ca ... sign by CA with OCSP extensions" |
680 | 680 | ||
681 | ocsp_cert=$ocsp_dir/ocsp_cert.pem | 681 | ocsp_cert=$ocsp_dir/ocsp_cert.pem |
682 | 682 | ||
683 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -keyform pem \ | 683 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -keyform pem \ |
684 | -key $ca_pass -out $ocsp_cert -extensions ocsp_ext \ | 684 | -key $ca_pass -out $ocsp_cert -extensions ocsp_ext \ |
685 | -startdate `date -u '+%y%m%d%H%M%SZ'` -enddate 491223235959Z \ | 685 | -startdate `date -u '+%y%m%d%H%M%SZ'` -enddate 491223235959Z \ |
686 | -subj $subj -infiles $ocsp_csr > $ocsp_cert.log 2>&1 | 686 | -subj $subj -infiles $ocsp_csr > $ocsp_cert.log 2>&1 |
687 | check_exit_status $? | 687 | check_exit_status $? |
688 | 688 | ||
689 | #---------#---------#---------#---------#---------#---------#--------- | 689 | #---------#---------#---------#---------#---------#---------#--------- |
690 | 690 | ||
691 | # --- server-admin operations (generate server key and csr) --- | 691 | # --- server-admin operations (generate server key and csr) --- |
692 | section_message "server-admin operations (generate server key and csr)" | 692 | section_message "server-admin operations (generate server key and csr)" |
693 | 693 | ||
694 | # RSA certificate | 694 | # RSA certificate |
695 | 695 | ||
696 | sv_rsa_key=$server_dir/sv_rsa_key.pem | 696 | sv_rsa_key=$server_dir/sv_rsa_key.pem |
697 | sv_rsa_csr=$server_dir/sv_rsa_csr.pem | 697 | sv_rsa_csr=$server_dir/sv_rsa_csr.pem |
698 | sv_rsa_pass=test-server-pass | 698 | sv_rsa_pass=test-server-pass |
699 | 699 | ||
700 | if [ $mingw = 0 ] ; then | 700 | if [ $mingw = 0 ] ; then |
701 | subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=localhost.test-dummy.com/' | 701 | subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=localhost.test-dummy.com/' |
702 | else | 702 | else |
703 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=localhost.test-dummy.com\' | 703 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=localhost.test-dummy.com\' |
704 | fi | 704 | fi |
705 | 705 | ||
706 | start_message "genrsa ... generate server key#1" | 706 | start_message "genrsa ... generate server key#1" |
707 | 707 | ||
708 | $openssl_bin genrsa -aes256 -passout pass:$sv_rsa_pass -out $sv_rsa_key | 708 | $openssl_bin genrsa -aes256 -passout pass:$sv_rsa_pass -out $sv_rsa_key |
@@ -715,7 +715,7 @@ __EOF__ | |||
715 | -addext 'subjectAltName = DNS:localhost.test-dummy.com' \ | 715 | -addext 'subjectAltName = DNS:localhost.test-dummy.com' \ |
716 | -out $sv_rsa_csr -outform pem | 716 | -out $sv_rsa_csr -outform pem |
717 | check_exit_status $? | 717 | check_exit_status $? |
718 | 718 | ||
719 | start_message "req ... verify server csr#1" | 719 | start_message "req ... verify server csr#1" |
720 | 720 | ||
721 | $openssl_bin req -verify -in $sv_rsa_csr -inform pem \ | 721 | $openssl_bin req -verify -in $sv_rsa_csr -inform pem \ |
@@ -725,7 +725,7 @@ __EOF__ | |||
725 | check_exit_status $? | 725 | check_exit_status $? |
726 | 726 | ||
727 | start_message "req ... generate server csr#2 (interactive mode)" | 727 | start_message "req ... generate server csr#2 (interactive mode)" |
728 | 728 | ||
729 | # RSA certificate (for revoke test) | 729 | # RSA certificate (for revoke test) |
730 | 730 | ||
731 | revoke_key=$server_dir/revoke_key.pem | 731 | revoke_key=$server_dir/revoke_key.pem |
@@ -752,7 +752,7 @@ __EOF__ | |||
752 | else | 752 | else |
753 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=ecdsa.test-dummy.com\' | 753 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=ecdsa.test-dummy.com\' |
754 | fi | 754 | fi |
755 | 755 | ||
756 | start_message "ecparam ... generate server key#3" | 756 | start_message "ecparam ... generate server key#3" |
757 | 757 | ||
758 | $openssl_bin ecparam -name prime256v1 -genkey -out $sv_ecdsa_key | 758 | $openssl_bin ecparam -name prime256v1 -genkey -out $sv_ecdsa_key |
@@ -765,7 +765,7 @@ __EOF__ | |||
765 | -addext 'subjectAltName = DNS:ecdsa.test-dummy.com' \ | 765 | -addext 'subjectAltName = DNS:ecdsa.test-dummy.com' \ |
766 | -out $sv_ecdsa_csr -outform pem | 766 | -out $sv_ecdsa_csr -outform pem |
767 | check_exit_status $? | 767 | check_exit_status $? |
768 | 768 | ||
769 | start_message "req ... verify server csr#3" | 769 | start_message "req ... verify server csr#3" |
770 | 770 | ||
771 | $openssl_bin req -verify -in $sv_ecdsa_csr -inform pem \ | 771 | $openssl_bin req -verify -in $sv_ecdsa_csr -inform pem \ |
@@ -785,7 +785,7 @@ __EOF__ | |||
785 | else | 785 | else |
786 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=gost.test-dummy.com\' | 786 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=gost.test-dummy.com\' |
787 | fi | 787 | fi |
788 | 788 | ||
789 | start_message "genpkey ... generate server key#4" | 789 | start_message "genpkey ... generate server key#4" |
790 | 790 | ||
791 | $openssl_bin genpkey -algorithm GOST2001 -pkeyopt paramset:A \ | 791 | $openssl_bin genpkey -algorithm GOST2001 -pkeyopt paramset:A \ |
@@ -799,7 +799,7 @@ __EOF__ | |||
799 | -addext 'subjectAltName = DNS:gost.test-dummy.com' \ | 799 | -addext 'subjectAltName = DNS:gost.test-dummy.com' \ |
800 | -out $sv_gost_csr -outform pem | 800 | -out $sv_gost_csr -outform pem |
801 | check_exit_status $? | 801 | check_exit_status $? |
802 | 802 | ||
803 | start_message "req ... verify server csr#4" | 803 | start_message "req ... verify server csr#4" |
804 | 804 | ||
805 | $openssl_bin req -verify -in $sv_gost_csr -inform pem \ | 805 | $openssl_bin req -verify -in $sv_gost_csr -inform pem \ |
@@ -809,19 +809,19 @@ __EOF__ | |||
809 | check_exit_status $? | 809 | check_exit_status $? |
810 | 810 | ||
811 | #---------#---------#---------#---------#---------#---------#--------- | 811 | #---------#---------#---------#---------#---------#---------#--------- |
812 | 812 | ||
813 | # --- CA operations (issue cert for server) --- | 813 | # --- CA operations (issue cert for server) --- |
814 | section_message "CA operations (issue cert for server)" | 814 | section_message "CA operations (issue cert for server)" |
815 | 815 | ||
816 | start_message "ca ... issue cert for server csr#1" | 816 | start_message "ca ... issue cert for server csr#1" |
817 | 817 | ||
818 | sv_rsa_cert=$server_dir/sv_rsa_cert.pem | 818 | sv_rsa_cert=$server_dir/sv_rsa_cert.pem |
819 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ | 819 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ |
820 | -in $sv_rsa_csr -out $sv_rsa_cert > $sv_rsa_cert.log 2>&1 | 820 | -in $sv_rsa_csr -out $sv_rsa_cert > $sv_rsa_cert.log 2>&1 |
821 | check_exit_status $? | 821 | check_exit_status $? |
822 | 822 | ||
823 | start_message "x509 ... issue cert for server csr#2" | 823 | start_message "x509 ... issue cert for server csr#2" |
824 | 824 | ||
825 | revoke_cert=$server_dir/revoke_cert.pem | 825 | revoke_cert=$server_dir/revoke_cert.pem |
826 | $openssl_bin x509 -req -in $revoke_csr -CA $ca_cert -CAform pem \ | 826 | $openssl_bin x509 -req -in $revoke_csr -CA $ca_cert -CAform pem \ |
827 | -CAkey $ca_key -CAkeyform pem \ | 827 | -CAkey $ca_key -CAkeyform pem \ |
@@ -829,26 +829,26 @@ __EOF__ | |||
829 | -passin pass:$ca_pass -CAcreateserial -out $revoke_cert \ | 829 | -passin pass:$ca_pass -CAcreateserial -out $revoke_cert \ |
830 | > $revoke_cert.log 2>&1 | 830 | > $revoke_cert.log 2>&1 |
831 | check_exit_status $? | 831 | check_exit_status $? |
832 | 832 | ||
833 | start_message "ca ... issue cert for server csr#3" | 833 | start_message "ca ... issue cert for server csr#3" |
834 | 834 | ||
835 | sv_ecdsa_cert=$server_dir/sv_ecdsa_cert.pem | 835 | sv_ecdsa_cert=$server_dir/sv_ecdsa_cert.pem |
836 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ | 836 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ |
837 | -in $sv_ecdsa_csr -out $sv_ecdsa_cert > $sv_ecdsa_cert.log 2>&1 | 837 | -in $sv_ecdsa_csr -out $sv_ecdsa_cert > $sv_ecdsa_cert.log 2>&1 |
838 | check_exit_status $? | 838 | check_exit_status $? |
839 | 839 | ||
840 | start_message "ca ... issue cert for server csr#4" | 840 | start_message "ca ... issue cert for server csr#4" |
841 | 841 | ||
842 | sv_gost_cert=$server_dir/sv_gost_cert.pem | 842 | sv_gost_cert=$server_dir/sv_gost_cert.pem |
843 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ | 843 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ |
844 | -in $sv_gost_csr -out $sv_gost_cert > $sv_gost_cert.log 2>&1 | 844 | -in $sv_gost_csr -out $sv_gost_cert > $sv_gost_cert.log 2>&1 |
845 | check_exit_status $? | 845 | check_exit_status $? |
846 | 846 | ||
847 | #---------#---------#---------#---------#---------#---------#--------- | 847 | #---------#---------#---------#---------#---------#---------#--------- |
848 | 848 | ||
849 | # --- CA operations (revoke cert and generate crl) --- | 849 | # --- CA operations (revoke cert and generate crl) --- |
850 | section_message "CA operations (revoke cert and generate crl)" | 850 | section_message "CA operations (revoke cert and generate crl)" |
851 | 851 | ||
852 | start_message "ca ... revoke server cert#2" | 852 | start_message "ca ... revoke server cert#2" |
853 | crl_file=$ca_dir/crl.pem | 853 | crl_file=$ca_dir/crl.pem |
854 | $openssl_bin ca -gencrl -out $crl_file -revoke $revoke_cert \ | 854 | $openssl_bin ca -gencrl -out $crl_file -revoke $revoke_cert \ |
@@ -860,34 +860,34 @@ __EOF__ | |||
860 | -keyfile $ca_key -passin pass:$ca_pass -cert $ca_cert \ | 860 | -keyfile $ca_key -passin pass:$ca_pass -cert $ca_cert \ |
861 | > $crl_file.log 2>&1 | 861 | > $crl_file.log 2>&1 |
862 | check_exit_status $? | 862 | check_exit_status $? |
863 | 863 | ||
864 | start_message "ca ... show certificate status by serial number" | 864 | start_message "ca ... show certificate status by serial number" |
865 | $openssl_bin ca -config $ssldir/openssl.cnf -status 1 | 865 | $openssl_bin ca -config $ssldir/openssl.cnf -status 1 |
866 | 866 | ||
867 | start_message "crl ... CA generates CRL" | 867 | start_message "crl ... CA generates CRL" |
868 | $openssl_bin crl -in $crl_file -fingerprint >> $crl_file.log 2>&1 | 868 | $openssl_bin crl -in $crl_file -fingerprint >> $crl_file.log 2>&1 |
869 | check_exit_status $? | 869 | check_exit_status $? |
870 | 870 | ||
871 | crl_p7=$ca_dir/crl.p7 | 871 | crl_p7=$ca_dir/crl.p7 |
872 | start_message "crl2pkcs7 ... convert CRL to pkcs7" | 872 | start_message "crl2pkcs7 ... convert CRL to pkcs7" |
873 | $openssl_bin crl2pkcs7 -in $crl_file -certfile $ca_cert -out $crl_p7 | 873 | $openssl_bin crl2pkcs7 -in $crl_file -certfile $ca_cert -out $crl_p7 |
874 | check_exit_status $? | 874 | check_exit_status $? |
875 | 875 | ||
876 | #---------#---------#---------#---------#---------#---------#--------- | 876 | #---------#---------#---------#---------#---------#---------#--------- |
877 | 877 | ||
878 | # --- server-admin operations (check csr, verify cert, certhash) --- | 878 | # --- server-admin operations (check csr, verify cert, certhash) --- |
879 | section_message "server-admin operations (check csr, verify cert, certhash)" | 879 | section_message "server-admin operations (check csr, verify cert, certhash)" |
880 | 880 | ||
881 | start_message "asn1parse ... parse server csr#1" | 881 | start_message "asn1parse ... parse server csr#1" |
882 | $openssl_bin asn1parse -in $sv_rsa_csr -i -dlimit 100 -length 1000 \ | 882 | $openssl_bin asn1parse -in $sv_rsa_csr -i -dlimit 100 -length 1000 \ |
883 | -strparse 01 > $sv_rsa_csr.asn1parse.out | 883 | -strparse 01 > $sv_rsa_csr.asn1parse.out |
884 | check_exit_status $? | 884 | check_exit_status $? |
885 | 885 | ||
886 | start_message "verify ... server cert#1" | 886 | start_message "verify ... server cert#1" |
887 | $openssl_bin verify -verbose -CAfile $ca_cert -CRLfile $crl_file \ | 887 | $openssl_bin verify -verbose -CAfile $ca_cert -CRLfile $crl_file \ |
888 | -crl_check -issuer_checks -purpose sslserver $sv_rsa_cert | 888 | -crl_check -issuer_checks -purpose sslserver $sv_rsa_cert |
889 | check_exit_status $? | 889 | check_exit_status $? |
890 | 890 | ||
891 | start_message "x509 ... get detail info about server cert#1" | 891 | start_message "x509 ... get detail info about server cert#1" |
892 | $openssl_bin x509 -in $sv_rsa_cert -text -C -dates -startdate -enddate \ | 892 | $openssl_bin x509 -in $sv_rsa_cert -text -C -dates -startdate -enddate \ |
893 | -fingerprint -issuer -issuer_hash -issuer_hash_old \ | 893 | -fingerprint -issuer -issuer_hash -issuer_hash_old \ |
@@ -896,14 +896,14 @@ __EOF__ | |||
896 | -alias -clrtrust -clrreject -next_serial -checkend 3600 \ | 896 | -alias -clrtrust -clrreject -next_serial -checkend 3600 \ |
897 | -nameopt multiline -certopt compatible > $sv_rsa_cert.x509.out | 897 | -nameopt multiline -certopt compatible > $sv_rsa_cert.x509.out |
898 | check_exit_status $? | 898 | check_exit_status $? |
899 | 899 | ||
900 | if [ $mingw = 0 ] ; then | 900 | if [ $mingw = 0 ] ; then |
901 | start_message "certhash" | 901 | start_message "certhash" |
902 | $openssl_bin certhash -v $server_dir \ | 902 | $openssl_bin certhash -v $server_dir \ |
903 | > $server_dir/certhash.log 2>&1 | 903 | > $server_dir/certhash.log 2>&1 |
904 | check_exit_status $? | 904 | check_exit_status $? |
905 | fi | 905 | fi |
906 | 906 | ||
907 | # self signed | 907 | # self signed |
908 | start_message "x509 ... generate self signed server cert" | 908 | start_message "x509 ... generate self signed server cert" |
909 | server_self_cert=$server_dir/server_self_cert.pem | 909 | server_self_cert=$server_dir/server_self_cert.pem |
@@ -911,23 +911,23 @@ __EOF__ | |||
911 | -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ | 911 | -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ |
912 | -passin pass:$sv_rsa_pass -out $server_self_cert -days 1 | 912 | -passin pass:$sv_rsa_pass -out $server_self_cert -days 1 |
913 | check_exit_status $? | 913 | check_exit_status $? |
914 | 914 | ||
915 | #---------#---------#---------#---------#---------#---------#--------- | 915 | #---------#---------#---------#---------#---------#---------#--------- |
916 | 916 | ||
917 | # --- Netscape SPKAC operations --- | 917 | # --- Netscape SPKAC operations --- |
918 | section_message "Netscape SPKAC operations" | 918 | section_message "Netscape SPKAC operations" |
919 | 919 | ||
920 | # server-admin generates SPKAC | 920 | # server-admin generates SPKAC |
921 | 921 | ||
922 | start_message "spkac" | 922 | start_message "spkac" |
923 | spkacfile=$server_dir/spkac.file | 923 | spkacfile=$server_dir/spkac.file |
924 | 924 | ||
925 | $openssl_bin spkac -key $genpkey_rsa -challenge hello -out $spkacfile | 925 | $openssl_bin spkac -key $genpkey_rsa -challenge hello -out $spkacfile |
926 | check_exit_status $? | 926 | check_exit_status $? |
927 | 927 | ||
928 | $openssl_bin spkac -in $spkacfile -verify -out $spkacfile.out | 928 | $openssl_bin spkac -in $spkacfile -verify -out $spkacfile.out |
929 | check_exit_status $? | 929 | check_exit_status $? |
930 | 930 | ||
931 | spkacreq=$server_dir/spkac.req | 931 | spkacreq=$server_dir/spkac.req |
932 | cat << __EOF__ > $spkacreq | 932 | cat << __EOF__ > $spkacreq |
933 | countryName = JP | 933 | countryName = JP |
@@ -936,30 +936,30 @@ organizationName = TEST_DUMMY_COMPANY | |||
936 | commonName = spkac.test-dummy.com | 936 | commonName = spkac.test-dummy.com |
937 | __EOF__ | 937 | __EOF__ |
938 | cat $spkacfile >> $spkacreq | 938 | cat $spkacfile >> $spkacreq |
939 | 939 | ||
940 | # CA signs SPKAC | 940 | # CA signs SPKAC |
941 | start_message "ca ... CA signs SPKAC csr" | 941 | start_message "ca ... CA signs SPKAC csr" |
942 | spkaccert=$server_dir/spkac.cert | 942 | spkaccert=$server_dir/spkac.cert |
943 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ | 943 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ |
944 | -spkac $spkacreq -out $spkaccert > $spkaccert.log 2>&1 | 944 | -spkac $spkacreq -out $spkaccert > $spkaccert.log 2>&1 |
945 | check_exit_status $? | 945 | check_exit_status $? |
946 | 946 | ||
947 | start_message "x509 ... convert DER format SPKAC cert to PEM" | 947 | start_message "x509 ... convert DER format SPKAC cert to PEM" |
948 | spkacpem=$server_dir/spkac.pem | 948 | spkacpem=$server_dir/spkac.pem |
949 | $openssl_bin x509 -in $spkaccert -inform DER -out $spkacpem -outform PEM | 949 | $openssl_bin x509 -in $spkaccert -inform DER -out $spkacpem -outform PEM |
950 | check_exit_status $? | 950 | check_exit_status $? |
951 | 951 | ||
952 | # server-admin cert verify | 952 | # server-admin cert verify |
953 | 953 | ||
954 | start_message "nseq" | 954 | start_message "nseq" |
955 | $openssl_bin nseq -in $spkacpem -toseq -out $spkacpem.nseq | 955 | $openssl_bin nseq -in $spkacpem -toseq -out $spkacpem.nseq |
956 | check_exit_status $? | 956 | check_exit_status $? |
957 | 957 | ||
958 | #---------#---------#---------#---------#---------#---------#--------- | 958 | #---------#---------#---------#---------#---------#---------#--------- |
959 | 959 | ||
960 | # --- user1 operations (generate user1 key and csr) --- | 960 | # --- user1 operations (generate user1 key and csr) --- |
961 | section_message "user1 operations (generate user1 key and csr)" | 961 | section_message "user1 operations (generate user1 key and csr)" |
962 | 962 | ||
963 | # trust | 963 | # trust |
964 | start_message "x509 ... trust testCA cert" | 964 | start_message "x509 ... trust testCA cert" |
965 | user1_trust=$user1_dir/user1_trust_ca.pem | 965 | user1_trust=$user1_dir/user1_trust_ca.pem |
@@ -967,35 +967,35 @@ __EOF__ | |||
967 | -setalias "trusted testCA" -purpose -out $user1_trust \ | 967 | -setalias "trusted testCA" -purpose -out $user1_trust \ |
968 | > $user1_trust.log 2>&1 | 968 | > $user1_trust.log 2>&1 |
969 | check_exit_status $? | 969 | check_exit_status $? |
970 | 970 | ||
971 | start_message "req ... generate private key and csr for user1" | 971 | start_message "req ... generate private key and csr for user1" |
972 | 972 | ||
973 | cl_rsa_key=$user1_dir/cl_rsa_key.pem | 973 | cl_rsa_key=$user1_dir/cl_rsa_key.pem |
974 | cl_rsa_csr=$user1_dir/cl_rsa_csr.pem | 974 | cl_rsa_csr=$user1_dir/cl_rsa_csr.pem |
975 | cl_rsa_pass=test-user1-pass | 975 | cl_rsa_pass=test-user1-pass |
976 | 976 | ||
977 | if [ $mingw = 0 ] ; then | 977 | if [ $mingw = 0 ] ; then |
978 | subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=user1.test-dummy.com/' | 978 | subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=user1.test-dummy.com/' |
979 | else | 979 | else |
980 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=user1.test-dummy.com\' | 980 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=user1.test-dummy.com\' |
981 | fi | 981 | fi |
982 | 982 | ||
983 | $openssl_bin req -new -keyout $cl_rsa_key -out $cl_rsa_csr \ | 983 | $openssl_bin req -new -keyout $cl_rsa_key -out $cl_rsa_csr \ |
984 | -passout pass:$cl_rsa_pass -subj $subj > $cl_rsa_csr.log 2>&1 | 984 | -passout pass:$cl_rsa_pass -subj $subj > $cl_rsa_csr.log 2>&1 |
985 | check_exit_status $? | 985 | check_exit_status $? |
986 | 986 | ||
987 | start_message "req ... generate private key and csr for user2" | 987 | start_message "req ... generate private key and csr for user2" |
988 | 988 | ||
989 | cl_ecdsa_key=$user1_dir/cl_ecdsa_key.pem | 989 | cl_ecdsa_key=$user1_dir/cl_ecdsa_key.pem |
990 | cl_ecdsa_csr=$user1_dir/cl_ecdsa_csr.pem | 990 | cl_ecdsa_csr=$user1_dir/cl_ecdsa_csr.pem |
991 | cl_ecdsa_pass=test-user1-pass | 991 | cl_ecdsa_pass=test-user1-pass |
992 | 992 | ||
993 | if [ $mingw = 0 ] ; then | 993 | if [ $mingw = 0 ] ; then |
994 | subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=user2.test-dummy.com/' | 994 | subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=user2.test-dummy.com/' |
995 | else | 995 | else |
996 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=user2.test-dummy.com\' | 996 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=user2.test-dummy.com\' |
997 | fi | 997 | fi |
998 | 998 | ||
999 | $openssl_bin ecparam -name prime256v1 -genkey -out $cl_ecdsa_key | 999 | $openssl_bin ecparam -name prime256v1 -genkey -out $cl_ecdsa_key |
1000 | check_exit_status $? | 1000 | check_exit_status $? |
1001 | 1001 | ||
@@ -1003,19 +1003,19 @@ __EOF__ | |||
1003 | -key $cl_ecdsa_key -keyform pem -passin pass:$cl_ecdsa_pass \ | 1003 | -key $cl_ecdsa_key -keyform pem -passin pass:$cl_ecdsa_pass \ |
1004 | -out $cl_ecdsa_csr -outform pem | 1004 | -out $cl_ecdsa_csr -outform pem |
1005 | check_exit_status $? | 1005 | check_exit_status $? |
1006 | 1006 | ||
1007 | start_message "req ... generate private key and csr for user3" | 1007 | start_message "req ... generate private key and csr for user3" |
1008 | 1008 | ||
1009 | cl_gost_key=$user1_dir/cl_gost_key.pem | 1009 | cl_gost_key=$user1_dir/cl_gost_key.pem |
1010 | cl_gost_csr=$user1_dir/cl_gost_csr.pem | 1010 | cl_gost_csr=$user1_dir/cl_gost_csr.pem |
1011 | cl_gost_pass=test-user1-pass | 1011 | cl_gost_pass=test-user1-pass |
1012 | 1012 | ||
1013 | if [ $mingw = 0 ] ; then | 1013 | if [ $mingw = 0 ] ; then |
1014 | subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=user3.test-dummy.com/' | 1014 | subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=user3.test-dummy.com/' |
1015 | else | 1015 | else |
1016 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=user3.test-dummy.com\' | 1016 | subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=user3.test-dummy.com\' |
1017 | fi | 1017 | fi |
1018 | 1018 | ||
1019 | $openssl_bin genpkey -algorithm GOST2001 -pkeyopt paramset:A \ | 1019 | $openssl_bin genpkey -algorithm GOST2001 -pkeyopt paramset:A \ |
1020 | -pkeyopt dgst:streebog512 -out $cl_gost_key | 1020 | -pkeyopt dgst:streebog512 -out $cl_gost_key |
1021 | check_exit_status $? | 1021 | check_exit_status $? |
@@ -1024,28 +1024,28 @@ __EOF__ | |||
1024 | -key $cl_gost_key -keyform pem -passin pass:$cl_gost_pass \ | 1024 | -key $cl_gost_key -keyform pem -passin pass:$cl_gost_pass \ |
1025 | -out $cl_gost_csr -outform pem | 1025 | -out $cl_gost_csr -outform pem |
1026 | check_exit_status $? | 1026 | check_exit_status $? |
1027 | 1027 | ||
1028 | #---------#---------#---------#---------#---------#---------#--------- | 1028 | #---------#---------#---------#---------#---------#---------#--------- |
1029 | 1029 | ||
1030 | # --- CA operations (issue cert for user1) --- | 1030 | # --- CA operations (issue cert for user1) --- |
1031 | section_message "CA operations (issue cert for user1)" | 1031 | section_message "CA operations (issue cert for user1)" |
1032 | 1032 | ||
1033 | start_message "ca ... issue cert for user1" | 1033 | start_message "ca ... issue cert for user1" |
1034 | 1034 | ||
1035 | cl_rsa_cert=$user1_dir/cl_rsa_cert.pem | 1035 | cl_rsa_cert=$user1_dir/cl_rsa_cert.pem |
1036 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ | 1036 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ |
1037 | -in $cl_rsa_csr -out $cl_rsa_cert > $cl_rsa_cert.log 2>&1 | 1037 | -in $cl_rsa_csr -out $cl_rsa_cert > $cl_rsa_cert.log 2>&1 |
1038 | check_exit_status $? | 1038 | check_exit_status $? |
1039 | 1039 | ||
1040 | start_message "ca ... issue cert for user2" | 1040 | start_message "ca ... issue cert for user2" |
1041 | 1041 | ||
1042 | cl_ecdsa_cert=$user1_dir/cl_ecdsa_cert.pem | 1042 | cl_ecdsa_cert=$user1_dir/cl_ecdsa_cert.pem |
1043 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ | 1043 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ |
1044 | -in $cl_ecdsa_csr -out $cl_ecdsa_cert > $cl_ecdsa_cert.log 2>&1 | 1044 | -in $cl_ecdsa_csr -out $cl_ecdsa_cert > $cl_ecdsa_cert.log 2>&1 |
1045 | check_exit_status $? | 1045 | check_exit_status $? |
1046 | 1046 | ||
1047 | start_message "ca ... issue cert for user3" | 1047 | start_message "ca ... issue cert for user3" |
1048 | 1048 | ||
1049 | cl_gost_cert=$user1_dir/cl_gost_cert.pem | 1049 | cl_gost_cert=$user1_dir/cl_gost_cert.pem |
1050 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ | 1050 | $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ |
1051 | -in $cl_gost_csr -out $cl_gost_cert > $cl_gost_cert.log 2>&1 | 1051 | -in $cl_gost_csr -out $cl_gost_cert > $cl_gost_cert.log 2>&1 |
@@ -1055,7 +1055,7 @@ __EOF__ | |||
1055 | function test_tsa { | 1055 | function test_tsa { |
1056 | # --- TSA operations --- | 1056 | # --- TSA operations --- |
1057 | section_message "TSA operations" | 1057 | section_message "TSA operations" |
1058 | 1058 | ||
1059 | tsa_dat=$user1_dir/tsa.dat | 1059 | tsa_dat=$user1_dir/tsa.dat |
1060 | cat << __EOF__ > $tsa_dat | 1060 | cat << __EOF__ > $tsa_dat |
1061 | Hello Bob, | 1061 | Hello Bob, |
@@ -1065,31 +1065,31 @@ __EOF__ | |||
1065 | 1065 | ||
1066 | # Query | 1066 | # Query |
1067 | start_message "ts ... create time stamp request" | 1067 | start_message "ts ... create time stamp request" |
1068 | 1068 | ||
1069 | tsa_tsq=$user1_dir/tsa.tsq | 1069 | tsa_tsq=$user1_dir/tsa.tsq |
1070 | 1070 | ||
1071 | $openssl_bin ts -query -sha1 -data $tsa_dat -no_nonce -out $tsa_tsq | 1071 | $openssl_bin ts -query -sha1 -data $tsa_dat -no_nonce -out $tsa_tsq |
1072 | check_exit_status $? | 1072 | check_exit_status $? |
1073 | 1073 | ||
1074 | start_message "ts ... print time stamp request" | 1074 | start_message "ts ... print time stamp request" |
1075 | 1075 | ||
1076 | $openssl_bin ts -query -in $tsa_tsq -text -out $tsa_tsq.log | 1076 | $openssl_bin ts -query -in $tsa_tsq -text -out $tsa_tsq.log |
1077 | check_exit_status $? | 1077 | check_exit_status $? |
1078 | 1078 | ||
1079 | # Reply | 1079 | # Reply |
1080 | start_message "ts ... create time stamp response for a request" | 1080 | start_message "ts ... create time stamp response for a request" |
1081 | 1081 | ||
1082 | tsa_tsr=$user1_dir/tsa.tsr | 1082 | tsa_tsr=$user1_dir/tsa.tsr |
1083 | 1083 | ||
1084 | $openssl_bin ts -reply -queryfile $tsa_tsq -inkey $tsa_key \ | 1084 | $openssl_bin ts -reply -queryfile $tsa_tsq -inkey $tsa_key \ |
1085 | -passin pass:$tsa_pass -signer $tsa_cert -chain $ca_cert \ | 1085 | -passin pass:$tsa_pass -signer $tsa_cert -chain $ca_cert \ |
1086 | -config $ssldir/openssl.cnf -section tsa_config1 -cert \ | 1086 | -config $ssldir/openssl.cnf -section tsa_config1 -cert \ |
1087 | -policy 1.3.6.1.4.1.4146.2.3 -out $tsa_tsr | 1087 | -policy 1.3.6.1.4.1.4146.2.3 -out $tsa_tsr |
1088 | check_exit_status $? | 1088 | check_exit_status $? |
1089 | 1089 | ||
1090 | # Verify | 1090 | # Verify |
1091 | start_message "ts ... verify time stamp response" | 1091 | start_message "ts ... verify time stamp response" |
1092 | 1092 | ||
1093 | $openssl_bin ts -verify -queryfile $tsa_tsq -in $tsa_tsr \ | 1093 | $openssl_bin ts -verify -queryfile $tsa_tsq -in $tsa_tsr \ |
1094 | -CAfile $ca_cert -untrusted $tsa_cert | 1094 | -CAfile $ca_cert -untrusted $tsa_cert |
1095 | check_exit_status $? | 1095 | check_exit_status $? |
@@ -1098,7 +1098,7 @@ __EOF__ | |||
1098 | function test_cms { | 1098 | function test_cms { |
1099 | # --- CMS operations --- | 1099 | # --- CMS operations --- |
1100 | section_message "CMS operations" | 1100 | section_message "CMS operations" |
1101 | 1101 | ||
1102 | cms_txt=$user1_dir/cms.txt | 1102 | cms_txt=$user1_dir/cms.txt |
1103 | cms_sig=$user1_dir/cms.sig | 1103 | cms_sig=$user1_dir/cms.sig |
1104 | cms_enc=$user1_dir/cms.enc | 1104 | cms_enc=$user1_dir/cms.enc |
@@ -1115,16 +1115,16 @@ function test_cms { | |||
1115 | cms_srp=$user1_dir/cms.srp | 1115 | cms_srp=$user1_dir/cms.srp |
1116 | cms_pwe=$user1_dir/cms.pwe | 1116 | cms_pwe=$user1_dir/cms.pwe |
1117 | cms_pwd=$user1_dir/cms.pwd | 1117 | cms_pwd=$user1_dir/cms.pwd |
1118 | 1118 | ||
1119 | cat << __EOF__ > $cms_txt | 1119 | cat << __EOF__ > $cms_txt |
1120 | Hello Bob, | 1120 | Hello Bob, |
1121 | Sincerely yours | 1121 | Sincerely yours |
1122 | Alice | 1122 | Alice |
1123 | __EOF__ | 1123 | __EOF__ |
1124 | 1124 | ||
1125 | # sign | 1125 | # sign |
1126 | start_message "cms ... sign to message" | 1126 | start_message "cms ... sign to message" |
1127 | 1127 | ||
1128 | $openssl_bin cms -sign -in $cms_txt -text \ | 1128 | $openssl_bin cms -sign -in $cms_txt -text \ |
1129 | -out $cms_sig -outform smime \ | 1129 | -out $cms_sig -outform smime \ |
1130 | -signer $cl_rsa_cert -inkey $cl_rsa_key -keyform pem \ | 1130 | -signer $cl_rsa_cert -inkey $cl_rsa_key -keyform pem \ |
@@ -1135,7 +1135,7 @@ __EOF__ | |||
1135 | -receipt_request_from server@test-dummy.com \ | 1135 | -receipt_request_from server@test-dummy.com \ |
1136 | -receipt_request_to user1@test-dummy.com | 1136 | -receipt_request_to user1@test-dummy.com |
1137 | check_exit_status $? | 1137 | check_exit_status $? |
1138 | 1138 | ||
1139 | # encrypt | 1139 | # encrypt |
1140 | start_message "cms ... encrypt message" | 1140 | start_message "cms ... encrypt message" |
1141 | 1141 | ||
@@ -1153,7 +1153,7 @@ __EOF__ | |||
1153 | 1153 | ||
1154 | # verify | 1154 | # verify |
1155 | start_message "cms ... verify message" | 1155 | start_message "cms ... verify message" |
1156 | 1156 | ||
1157 | $openssl_bin cms -verify -in $cms_dec \ | 1157 | $openssl_bin cms -verify -in $cms_dec \ |
1158 | -CAfile $ca_cert -certfile $cl_rsa_cert -nointern \ | 1158 | -CAfile $ca_cert -certfile $cl_rsa_cert -nointern \ |
1159 | -check_ss_sig -issuer_checks -policy_check -x509_strict \ | 1159 | -check_ss_sig -issuer_checks -policy_check -x509_strict \ |
@@ -1166,31 +1166,31 @@ __EOF__ | |||
1166 | 1166 | ||
1167 | # cmsout | 1167 | # cmsout |
1168 | start_message "cms ... cmsout" | 1168 | start_message "cms ... cmsout" |
1169 | 1169 | ||
1170 | $openssl_bin cms -cmsout -in $cms_enc -print -out $cms_out | 1170 | $openssl_bin cms -cmsout -in $cms_enc -print -out $cms_out |
1171 | check_exit_status $? | 1171 | check_exit_status $? |
1172 | 1172 | ||
1173 | # data_create | 1173 | # data_create |
1174 | start_message "cms ... data_create" | 1174 | start_message "cms ... data_create" |
1175 | 1175 | ||
1176 | $openssl_bin cms -data_create -in $cms_enc -out $cms_dct | 1176 | $openssl_bin cms -data_create -in $cms_enc -out $cms_dct |
1177 | check_exit_status $? | 1177 | check_exit_status $? |
1178 | 1178 | ||
1179 | # data_out | 1179 | # data_out |
1180 | start_message "cms ... data_out" | 1180 | start_message "cms ... data_out" |
1181 | 1181 | ||
1182 | $openssl_bin cms -data_out -in $cms_dct -out $cms_dot | 1182 | $openssl_bin cms -data_out -in $cms_dct -out $cms_dot |
1183 | check_exit_status $? | 1183 | check_exit_status $? |
1184 | 1184 | ||
1185 | # digest_create | 1185 | # digest_create |
1186 | start_message "cms ... digest_create" | 1186 | start_message "cms ... digest_create" |
1187 | 1187 | ||
1188 | $openssl_bin cms -digest_create -in $cms_txt -md sha256 -out $cms_dgc | 1188 | $openssl_bin cms -digest_create -in $cms_txt -md sha256 -out $cms_dgc |
1189 | check_exit_status $? | 1189 | check_exit_status $? |
1190 | 1190 | ||
1191 | # digest_verify | 1191 | # digest_verify |
1192 | start_message "cms ... digest_verify" | 1192 | start_message "cms ... digest_verify" |
1193 | 1193 | ||
1194 | $openssl_bin cms -digest_verify -in $cms_dgc -md sha256 -out $cms_dgv | 1194 | $openssl_bin cms -digest_verify -in $cms_dgc -md sha256 -out $cms_dgv |
1195 | check_exit_status $? | 1195 | check_exit_status $? |
1196 | 1196 | ||
@@ -1203,14 +1203,14 @@ __EOF__ | |||
1203 | 1203 | ||
1204 | # EncryptedData_encrypt | 1204 | # EncryptedData_encrypt |
1205 | start_message "cms ... EncryptedData_encrypt" | 1205 | start_message "cms ... EncryptedData_encrypt" |
1206 | 1206 | ||
1207 | $openssl_bin cms -EncryptedData_encrypt -in $cms_sig -out $cms_ede \ | 1207 | $openssl_bin cms -EncryptedData_encrypt -in $cms_sig -out $cms_ede \ |
1208 | -aes128 -secretkey 00112233445566778899aabbccddeeff | 1208 | -aes128 -secretkey 00112233445566778899aabbccddeeff |
1209 | check_exit_status $? | 1209 | check_exit_status $? |
1210 | 1210 | ||
1211 | # EncryptedData_decrypt | 1211 | # EncryptedData_decrypt |
1212 | start_message "cms ... EncryptedData_decrypt" | 1212 | start_message "cms ... EncryptedData_decrypt" |
1213 | 1213 | ||
1214 | $openssl_bin cms -EncryptedData_decrypt -in $cms_ede -out $cms_edd \ | 1214 | $openssl_bin cms -EncryptedData_decrypt -in $cms_ede -out $cms_edd \ |
1215 | -aes128 -secretkey 00112233445566778899aabbccddeeff | 1215 | -aes128 -secretkey 00112233445566778899aabbccddeeff |
1216 | check_exit_status $? | 1216 | check_exit_status $? |
@@ -1220,7 +1220,7 @@ __EOF__ | |||
1220 | 1220 | ||
1221 | # sign_receipt | 1221 | # sign_receipt |
1222 | start_message "cms ... sign to receipt" | 1222 | start_message "cms ... sign to receipt" |
1223 | 1223 | ||
1224 | $openssl_bin cms -sign_receipt -in $cms_sig -out $cms_srp \ | 1224 | $openssl_bin cms -sign_receipt -in $cms_sig -out $cms_srp \ |
1225 | -signer $sv_rsa_cert -inkey $sv_rsa_key \ | 1225 | -signer $sv_rsa_cert -inkey $sv_rsa_key \ |
1226 | -passin pass:$sv_rsa_pass -md sha256 | 1226 | -passin pass:$sv_rsa_pass -md sha256 |
@@ -1228,11 +1228,11 @@ __EOF__ | |||
1228 | 1228 | ||
1229 | # verify_receipt | 1229 | # verify_receipt |
1230 | start_message "cms ... verify receipt" | 1230 | start_message "cms ... verify receipt" |
1231 | 1231 | ||
1232 | $openssl_bin cms -verify_receipt $cms_srp -rctform smime -in $cms_sig \ | 1232 | $openssl_bin cms -verify_receipt $cms_srp -rctform smime -in $cms_sig \ |
1233 | -CAfile $ca_cert -certfile $sv_rsa_cert | 1233 | -CAfile $ca_cert -certfile $sv_rsa_cert |
1234 | check_exit_status $? | 1234 | check_exit_status $? |
1235 | 1235 | ||
1236 | # encrypt with pwri | 1236 | # encrypt with pwri |
1237 | start_message "cms ... encrypt with pwri" | 1237 | start_message "cms ... encrypt with pwri" |
1238 | 1238 | ||
@@ -1254,7 +1254,7 @@ __EOF__ | |||
1254 | function test_smime { | 1254 | function test_smime { |
1255 | # --- S/MIME operations --- | 1255 | # --- S/MIME operations --- |
1256 | section_message "S/MIME operations" | 1256 | section_message "S/MIME operations" |
1257 | 1257 | ||
1258 | smime_txt=$user1_dir/smime.txt | 1258 | smime_txt=$user1_dir/smime.txt |
1259 | smime_enc=$user1_dir/smime.enc | 1259 | smime_enc=$user1_dir/smime.enc |
1260 | smime_sig=$user1_dir/smime.sig | 1260 | smime_sig=$user1_dir/smime.sig |
@@ -1262,13 +1262,13 @@ function test_smime { | |||
1262 | smime_sgr=$user1_dir/smime.sgr | 1262 | smime_sgr=$user1_dir/smime.sgr |
1263 | smime_ver=$user1_dir/smime.ver | 1263 | smime_ver=$user1_dir/smime.ver |
1264 | smime_dec=$user1_dir/smime.dec | 1264 | smime_dec=$user1_dir/smime.dec |
1265 | 1265 | ||
1266 | cat << __EOF__ > $smime_txt | 1266 | cat << __EOF__ > $smime_txt |
1267 | Hello Bob, | 1267 | Hello Bob, |
1268 | Sincerely yours | 1268 | Sincerely yours |
1269 | Alice | 1269 | Alice |
1270 | __EOF__ | 1270 | __EOF__ |
1271 | 1271 | ||
1272 | # encrypt | 1272 | # encrypt |
1273 | start_message "smime ... encrypt message" | 1273 | start_message "smime ... encrypt message" |
1274 | 1274 | ||
@@ -1278,7 +1278,7 @@ __EOF__ | |||
1278 | 1278 | ||
1279 | # sign | 1279 | # sign |
1280 | start_message "smime ... sign to message" | 1280 | start_message "smime ... sign to message" |
1281 | 1281 | ||
1282 | $openssl_bin smime -sign -in $smime_enc -text -inform smime \ | 1282 | $openssl_bin smime -sign -in $smime_enc -text -inform smime \ |
1283 | -out $smime_sig -outform smime \ | 1283 | -out $smime_sig -outform smime \ |
1284 | -signer $cl_rsa_cert -inkey $cl_rsa_key -keyform pem \ | 1284 | -signer $cl_rsa_cert -inkey $cl_rsa_key -keyform pem \ |
@@ -1286,7 +1286,7 @@ __EOF__ | |||
1286 | -from user1@test-dummy.com -to server@test-dummy.com \ | 1286 | -from user1@test-dummy.com -to server@test-dummy.com \ |
1287 | -subject "test openssl smime" | 1287 | -subject "test openssl smime" |
1288 | check_exit_status $? | 1288 | check_exit_status $? |
1289 | 1289 | ||
1290 | # pk7out | 1290 | # pk7out |
1291 | start_message "smime ... pk7out from message" | 1291 | start_message "smime ... pk7out from message" |
1292 | 1292 | ||
@@ -1295,7 +1295,7 @@ __EOF__ | |||
1295 | 1295 | ||
1296 | # verify | 1296 | # verify |
1297 | start_message "smime ... verify message" | 1297 | start_message "smime ... verify message" |
1298 | 1298 | ||
1299 | $openssl_bin smime -verify -in $smime_sig \ | 1299 | $openssl_bin smime -verify -in $smime_sig \ |
1300 | -CAfile $ca_cert -certfile $cl_rsa_cert -nointern \ | 1300 | -CAfile $ca_cert -certfile $cl_rsa_cert -nointern \ |
1301 | -check_ss_sig -issuer_checks -policy_check -x509_strict \ | 1301 | -check_ss_sig -issuer_checks -policy_check -x509_strict \ |
@@ -1316,7 +1316,7 @@ __EOF__ | |||
1316 | function test_ocsp { | 1316 | function test_ocsp { |
1317 | # --- OCSP operations --- | 1317 | # --- OCSP operations --- |
1318 | section_message "OCSP operations" | 1318 | section_message "OCSP operations" |
1319 | 1319 | ||
1320 | # get key without pass | 1320 | # get key without pass |
1321 | cl_rsa_key_nopass=$user1_dir/cl_rsa_key_nopass.pem | 1321 | cl_rsa_key_nopass=$user1_dir/cl_rsa_key_nopass.pem |
1322 | $openssl_bin pkey -in $cl_rsa_key -passin pass:$cl_rsa_pass \ | 1322 | $openssl_bin pkey -in $cl_rsa_key -passin pass:$cl_rsa_pass \ |
@@ -1325,7 +1325,7 @@ function test_ocsp { | |||
1325 | 1325 | ||
1326 | # request | 1326 | # request |
1327 | start_message "ocsp ... create OCSP request" | 1327 | start_message "ocsp ... create OCSP request" |
1328 | 1328 | ||
1329 | ocsp_req=$user1_dir/ocsp_req.der | 1329 | ocsp_req=$user1_dir/ocsp_req.der |
1330 | $openssl_bin ocsp -issuer $ca_cert -cert $sv_rsa_cert \ | 1330 | $openssl_bin ocsp -issuer $ca_cert -cert $sv_rsa_cert \ |
1331 | -cert $revoke_cert -serial 1 -nonce -no_certs -CAfile $ca_cert \ | 1331 | -cert $revoke_cert -serial 1 -nonce -no_certs -CAfile $ca_cert \ |
@@ -1333,10 +1333,10 @@ function test_ocsp { | |||
1333 | -sign_other $cl_rsa_cert -sha256 \ | 1333 | -sign_other $cl_rsa_cert -sha256 \ |
1334 | -reqout $ocsp_req -req_text -out $ocsp_req.out | 1334 | -reqout $ocsp_req -req_text -out $ocsp_req.out |
1335 | check_exit_status $? | 1335 | check_exit_status $? |
1336 | 1336 | ||
1337 | # response | 1337 | # response |
1338 | start_message "ocsp ... create OCPS response for a request" | 1338 | start_message "ocsp ... create OCPS response for a request" |
1339 | 1339 | ||
1340 | ocsp_res=$user1_dir/ocsp_res.der | 1340 | ocsp_res=$user1_dir/ocsp_res.der |
1341 | $openssl_bin ocsp -index $ca_dir/index.txt -CA $ca_cert \ | 1341 | $openssl_bin ocsp -index $ca_dir/index.txt -CA $ca_cert \ |
1342 | -CAfile $ca_cert -rsigner $ocsp_cert -rkey $ocsp_key \ | 1342 | -CAfile $ca_cert -rsigner $ocsp_cert -rkey $ocsp_key \ |
@@ -1344,12 +1344,12 @@ function test_ocsp { | |||
1344 | -nmin 60 -validity_period 300 -status_age 300 \ | 1344 | -nmin 60 -validity_period 300 -status_age 300 \ |
1345 | -respout $ocsp_res -resp_text -out $ocsp_res.out | 1345 | -respout $ocsp_res -resp_text -out $ocsp_res.out |
1346 | check_exit_status $? | 1346 | check_exit_status $? |
1347 | 1347 | ||
1348 | # ocsp server | 1348 | # ocsp server |
1349 | start_message "ocsp ... start OCSP server in background" | 1349 | start_message "ocsp ... start OCSP server in background" |
1350 | 1350 | ||
1351 | ocsp_port=8888 | 1351 | ocsp_port=8888 |
1352 | 1352 | ||
1353 | ocsp_svr_log=$user1_dir/ocsp_svr.log | 1353 | ocsp_svr_log=$user1_dir/ocsp_svr.log |
1354 | $openssl_bin ocsp -index $ca_dir/index.txt -CA $ca_cert \ | 1354 | $openssl_bin ocsp -index $ca_dir/index.txt -CA $ca_cert \ |
1355 | -CAfile $ca_cert -rsigner $ocsp_cert -rkey $ocsp_key \ | 1355 | -CAfile $ca_cert -rsigner $ocsp_cert -rkey $ocsp_key \ |
@@ -1359,10 +1359,10 @@ function test_ocsp { | |||
1359 | ocsp_svr_pid=$! | 1359 | ocsp_svr_pid=$! |
1360 | echo "ocsp server pid = [ $ocsp_svr_pid ]" | 1360 | echo "ocsp server pid = [ $ocsp_svr_pid ]" |
1361 | sleep 1 | 1361 | sleep 1 |
1362 | 1362 | ||
1363 | # send query to ocsp server | 1363 | # send query to ocsp server |
1364 | start_message "ocsp ... send OCSP request to server" | 1364 | start_message "ocsp ... send OCSP request to server" |
1365 | 1365 | ||
1366 | ocsp_qry=$user1_dir/ocsp_qry.der | 1366 | ocsp_qry=$user1_dir/ocsp_qry.der |
1367 | $openssl_bin ocsp -issuer $ca_cert -cert $sv_rsa_cert \ | 1367 | $openssl_bin ocsp -issuer $ca_cert -cert $sv_rsa_cert \ |
1368 | -cert $revoke_cert -CAfile $ca_cert -no_nonce \ | 1368 | -cert $revoke_cert -CAfile $ca_cert -no_nonce \ |
@@ -1384,24 +1384,24 @@ function test_ocsp { | |||
1384 | function test_pkcs { | 1384 | function test_pkcs { |
1385 | # --- PKCS operations --- | 1385 | # --- PKCS operations --- |
1386 | section_message "PKCS operations" | 1386 | section_message "PKCS operations" |
1387 | 1387 | ||
1388 | pkcs_pass=test-pkcs-pass | 1388 | pkcs_pass=test-pkcs-pass |
1389 | 1389 | ||
1390 | start_message "pkcs7 ... output certs in crl(pkcs7)" | 1390 | start_message "pkcs7 ... output certs in crl(pkcs7)" |
1391 | $openssl_bin pkcs7 -in $crl_p7 -print_certs -text -out $crl_p7.out | 1391 | $openssl_bin pkcs7 -in $crl_p7 -print_certs -text -out $crl_p7.out |
1392 | check_exit_status $? | 1392 | check_exit_status $? |
1393 | 1393 | ||
1394 | start_message "pkcs8 ... convert key to pkcs8" | 1394 | start_message "pkcs8 ... convert key to pkcs8" |
1395 | $openssl_bin pkcs8 -in $cl_rsa_key -topk8 -out $cl_rsa_key.p8 \ | 1395 | $openssl_bin pkcs8 -in $cl_rsa_key -topk8 -out $cl_rsa_key.p8 \ |
1396 | -passin pass:$cl_rsa_pass -passout pass:$cl_rsa_pass \ | 1396 | -passin pass:$cl_rsa_pass -passout pass:$cl_rsa_pass \ |
1397 | -v1 pbeWithSHA1AndDES-CBC -v2 des3 | 1397 | -v1 pbeWithSHA1AndDES-CBC -v2 des3 |
1398 | check_exit_status $? | 1398 | check_exit_status $? |
1399 | 1399 | ||
1400 | start_message "pkcs8 ... convert pkcs8 to key in DER format" | 1400 | start_message "pkcs8 ... convert pkcs8 to key in DER format" |
1401 | $openssl_bin pkcs8 -in $cl_rsa_key.p8 -passin pass:$cl_rsa_pass \ | 1401 | $openssl_bin pkcs8 -in $cl_rsa_key.p8 -passin pass:$cl_rsa_pass \ |
1402 | -outform DER -out $cl_rsa_key.p8.der | 1402 | -outform DER -out $cl_rsa_key.p8.der |
1403 | check_exit_status $? | 1403 | check_exit_status $? |
1404 | 1404 | ||
1405 | start_message "pkcs12 ... create" | 1405 | start_message "pkcs12 ... create" |
1406 | $openssl_bin pkcs12 -export -in $sv_rsa_cert -inkey $sv_rsa_key \ | 1406 | $openssl_bin pkcs12 -export -in $sv_rsa_cert -inkey $sv_rsa_key \ |
1407 | -passin pass:$sv_rsa_pass -certfile $ca_cert -CAfile $ca_cert \ | 1407 | -passin pass:$sv_rsa_pass -certfile $ca_cert -CAfile $ca_cert \ |
@@ -1411,12 +1411,12 @@ function test_pkcs { | |||
1411 | -CSP "csp_server_p12" -LMK -keyex \ | 1411 | -CSP "csp_server_p12" -LMK -keyex \ |
1412 | -passout pass:$pkcs_pass -out $sv_rsa_cert.p12 | 1412 | -passout pass:$pkcs_pass -out $sv_rsa_cert.p12 |
1413 | check_exit_status $? | 1413 | check_exit_status $? |
1414 | 1414 | ||
1415 | start_message "pkcs12 ... verify" | 1415 | start_message "pkcs12 ... verify" |
1416 | $openssl_bin pkcs12 -in $sv_rsa_cert.p12 -passin pass:$pkcs_pass -info \ | 1416 | $openssl_bin pkcs12 -in $sv_rsa_cert.p12 -passin pass:$pkcs_pass -info \ |
1417 | -noout > $sv_rsa_cert.p12.log 2>&1 | 1417 | -noout > $sv_rsa_cert.p12.log 2>&1 |
1418 | check_exit_status $? | 1418 | check_exit_status $? |
1419 | 1419 | ||
1420 | start_message "pkcs12 ... private key to PEM without encryption" | 1420 | start_message "pkcs12 ... private key to PEM without encryption" |
1421 | $openssl_bin pkcs12 -in $sv_rsa_cert.p12 -password pass:$pkcs_pass \ | 1421 | $openssl_bin pkcs12 -in $sv_rsa_cert.p12 -password pass:$pkcs_pass \ |
1422 | -nocerts -nomacver -nodes -out $sv_rsa_cert.p12.pem | 1422 | -nocerts -nomacver -nodes -out $sv_rsa_cert.p12.pem |
@@ -1440,14 +1440,14 @@ function test_sc_by_protocol_version { | |||
1440 | fi | 1440 | fi |
1441 | 1441 | ||
1442 | s_client_out=$user1_dir/s_client_${sc}_${ver}.out | 1442 | s_client_out=$user1_dir/s_client_${sc}_${ver}.out |
1443 | 1443 | ||
1444 | start_message "s_client ... connect to TLS/SSL test server by $ver" | 1444 | start_message "s_client ... connect to TLS/SSL test server by $ver" |
1445 | sleep $test_pause_sec | 1445 | sleep $test_pause_sec |
1446 | $c_bin s_client -connect $host:$port -CAfile $ca_cert \ | 1446 | $c_bin s_client -connect $host:$port -CAfile $ca_cert \ |
1447 | -$ver $groups_and_cipher \ | 1447 | -$ver $groups_and_cipher \ |
1448 | -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 | 1448 | -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 |
1449 | check_exit_status $? | 1449 | check_exit_status $? |
1450 | 1450 | ||
1451 | # check downgrade bits in SH | 1451 | # check downgrade bits in SH |
1452 | if [ $ver = "tls1" -o $ver = "tls1_1" ] ; then | 1452 | if [ $ver = "tls1" -o $ver = "tls1_1" ] ; then |
1453 | perl -0ne \ | 1453 | perl -0ne \ |
@@ -1480,13 +1480,13 @@ function test_sc_by_protocol_version { | |||
1480 | check_exit_status $? | 1480 | check_exit_status $? |
1481 | fi | 1481 | fi |
1482 | 1482 | ||
1483 | # OpenSSL1.1.1 with TLSv1.3 does not call SSL_SESSION_print() until | 1483 | # OpenSSL1.1.1 with TLSv1.3 does not call SSL_SESSION_print() until |
1484 | # NewSessionTicket arrival | 1484 | # NewSessionTicket arrival |
1485 | if ! [ $cid = "1" -a $ver = "tls1_3" ] ; then | 1485 | if ! [ $cid = "1" -a $ver = "tls1_3" ] ; then |
1486 | grep "$msg" $s_client_out > /dev/null | 1486 | grep "$msg" $s_client_out > /dev/null |
1487 | check_exit_status $? | 1487 | check_exit_status $? |
1488 | fi | 1488 | fi |
1489 | 1489 | ||
1490 | grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null | 1490 | grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null |
1491 | check_exit_status $? | 1491 | check_exit_status $? |
1492 | } | 1492 | } |
@@ -1548,17 +1548,17 @@ function test_sc_all_cipher { | |||
1548 | cnum=`expr $cnum + 1` | 1548 | cnum=`expr $cnum + 1` |
1549 | cnstr=`printf %03d $cnum` | 1549 | cnstr=`printf %03d $cnum` |
1550 | s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_${cnstr}_${c}.out | 1550 | s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_${cnstr}_${c}.out |
1551 | 1551 | ||
1552 | start_message "s_client ... connect to TLS/SSL test server with [ $cnstr ] $ver $c" | 1552 | start_message "s_client ... connect to TLS/SSL test server with [ $cnstr ] $ver $c" |
1553 | sleep $test_pause_sec | 1553 | sleep $test_pause_sec |
1554 | $c_bin s_client -connect $host:$port -CAfile $ca_cert \ | 1554 | $c_bin s_client -connect $host:$port -CAfile $ca_cert \ |
1555 | -$ver -$copt $c \ | 1555 | -$ver -$copt $c \ |
1556 | -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 | 1556 | -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 |
1557 | check_exit_status $? | 1557 | check_exit_status $? |
1558 | 1558 | ||
1559 | grep "Cipher is $c" $s_client_out > /dev/null | 1559 | grep "Cipher is $c" $s_client_out > /dev/null |
1560 | check_exit_status $? | 1560 | check_exit_status $? |
1561 | 1561 | ||
1562 | grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null | 1562 | grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null |
1563 | check_exit_status $? | 1563 | check_exit_status $? |
1564 | done | 1564 | done |
@@ -1575,36 +1575,36 @@ function test_sc_session_reuse { | |||
1575 | sess_dat=$user1_dir/s_client_${sc}_${ver}_sess.dat | 1575 | sess_dat=$user1_dir/s_client_${sc}_${ver}_sess.dat |
1576 | 1576 | ||
1577 | # Get session ticket to reuse | 1577 | # Get session ticket to reuse |
1578 | 1578 | ||
1579 | s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_reuse_1.out | 1579 | s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_reuse_1.out |
1580 | 1580 | ||
1581 | start_message "s_client ... connect to TLS/SSL test server to get session id $ver" | 1581 | start_message "s_client ... connect to TLS/SSL test server to get session id $ver" |
1582 | sleep $test_pause_sec | 1582 | sleep $test_pause_sec |
1583 | $c_bin s_client -connect $host:$port -CAfile $ca_cert \ | 1583 | $c_bin s_client -connect $host:$port -CAfile $ca_cert \ |
1584 | -$ver -alpn "spdy/3,http/1.1" -sess_out $sess_dat \ | 1584 | -$ver -alpn "spdy/3,http/1.1" -sess_out $sess_dat \ |
1585 | -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 | 1585 | -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 |
1586 | check_exit_status $? | 1586 | check_exit_status $? |
1587 | 1587 | ||
1588 | grep '^New, TLS.*$' $s_client_out > /dev/null | 1588 | grep '^New, TLS.*$' $s_client_out > /dev/null |
1589 | check_exit_status $? | 1589 | check_exit_status $? |
1590 | 1590 | ||
1591 | grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null | 1591 | grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null |
1592 | check_exit_status $? | 1592 | check_exit_status $? |
1593 | 1593 | ||
1594 | # Reuse session ticket | 1594 | # Reuse session ticket |
1595 | 1595 | ||
1596 | s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_reuse_2.out | 1596 | s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_reuse_2.out |
1597 | 1597 | ||
1598 | start_message "s_client ... connect to TLS/SSL test server reusing session id $ver" | 1598 | start_message "s_client ... connect to TLS/SSL test server reusing session id $ver" |
1599 | sleep $test_pause_sec | 1599 | sleep $test_pause_sec |
1600 | $c_bin s_client -connect $host:$port -CAfile $ca_cert \ | 1600 | $c_bin s_client -connect $host:$port -CAfile $ca_cert \ |
1601 | -$ver -sess_in $sess_dat \ | 1601 | -$ver -sess_in $sess_dat \ |
1602 | -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 | 1602 | -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 |
1603 | check_exit_status $? | 1603 | check_exit_status $? |
1604 | 1604 | ||
1605 | grep '^Reused, TLS.*$' $s_client_out > /dev/null | 1605 | grep '^Reused, TLS.*$' $s_client_out > /dev/null |
1606 | check_exit_status $? | 1606 | check_exit_status $? |
1607 | 1607 | ||
1608 | grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null | 1608 | grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null |
1609 | check_exit_status $? | 1609 | check_exit_status $? |
1610 | 1610 | ||
@@ -1624,9 +1624,9 @@ function test_sc_verify { | |||
1624 | fi | 1624 | fi |
1625 | 1625 | ||
1626 | # invalid verification pattern | 1626 | # invalid verification pattern |
1627 | 1627 | ||
1628 | s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_invalid.out | 1628 | s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_invalid.out |
1629 | 1629 | ||
1630 | start_message "s_client ... connect to tls/ssl test server but verify error $ver" | 1630 | start_message "s_client ... connect to tls/ssl test server but verify error $ver" |
1631 | sleep $test_pause_sec | 1631 | sleep $test_pause_sec |
1632 | $c_bin s_client -connect $host:$port -CAfile $ca_cert \ | 1632 | $c_bin s_client -connect $host:$port -CAfile $ca_cert \ |
@@ -1634,7 +1634,7 @@ function test_sc_verify { | |||
1634 | -status -servername xyz \ | 1634 | -status -servername xyz \ |
1635 | -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 | 1635 | -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 |
1636 | check_exit_status $? | 1636 | check_exit_status $? |
1637 | 1637 | ||
1638 | grep 'verify return code: 0 (ok)' $s_client_out > /dev/null | 1638 | grep 'verify return code: 0 (ok)' $s_client_out > /dev/null |
1639 | if [ $? -eq 0 ] ; then | 1639 | if [ $? -eq 0 ] ; then |
1640 | check_exit_status 1 | 1640 | check_exit_status 1 |
@@ -1643,9 +1643,9 @@ function test_sc_verify { | |||
1643 | fi | 1643 | fi |
1644 | 1644 | ||
1645 | # client certificate pattern | 1645 | # client certificate pattern |
1646 | 1646 | ||
1647 | s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_client_cert.out | 1647 | s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_client_cert.out |
1648 | 1648 | ||
1649 | start_message "s_client ... connect to tls/ssl test server with client certificate $ver" | 1649 | start_message "s_client ... connect to tls/ssl test server with client certificate $ver" |
1650 | 1650 | ||
1651 | if [ $ecdsa_tests = 1 ] ; then | 1651 | if [ $ecdsa_tests = 1 ] ; then |
@@ -1727,7 +1727,7 @@ function test_server_client { | |||
1727 | else | 1727 | else |
1728 | extra_opts="" | 1728 | extra_opts="" |
1729 | fi | 1729 | fi |
1730 | 1730 | ||
1731 | start_message "s_server ... start TLS/SSL test server" | 1731 | start_message "s_server ... start TLS/SSL test server" |
1732 | $s_bin s_server -accept $port -CAfile $ca_cert \ | 1732 | $s_bin s_server -accept $port -CAfile $ca_cert \ |
1733 | -cert $crt -key $key -pass pass:$pwd \ | 1733 | -cert $crt -key $key -pass pass:$pwd \ |
@@ -1740,24 +1740,24 @@ function test_server_client { | |||
1740 | s_server_pid=$! | 1740 | s_server_pid=$! |
1741 | echo "s_server pid = [ $s_server_pid ]" | 1741 | echo "s_server pid = [ $s_server_pid ]" |
1742 | sleep 1 | 1742 | sleep 1 |
1743 | 1743 | ||
1744 | # test by protocol version | 1744 | # test by protocol version |
1745 | test_sc_by_protocol_version $sc tls1 'Protocol : TLSv1$' $c_id | 1745 | test_sc_by_protocol_version $sc tls1 'Protocol : TLSv1$' $c_id |
1746 | test_sc_by_protocol_version $sc tls1_1 'Protocol : TLSv1\.1$' $c_id | 1746 | test_sc_by_protocol_version $sc tls1_1 'Protocol : TLSv1\.1$' $c_id |
1747 | test_sc_by_protocol_version $sc tls1_2 'Protocol : TLSv1\.2$' $c_id | 1747 | test_sc_by_protocol_version $sc tls1_2 'Protocol : TLSv1\.2$' $c_id |
1748 | test_sc_by_protocol_version $sc tls1_3 'Protocol : TLSv1\.3$' $c_id | 1748 | test_sc_by_protocol_version $sc tls1_3 'Protocol : TLSv1\.3$' $c_id |
1749 | 1749 | ||
1750 | # all available ciphers with random order | 1750 | # all available ciphers with random order |
1751 | test_sc_all_cipher $sc tls1_2 | 1751 | test_sc_all_cipher $sc tls1_2 |
1752 | test_sc_all_cipher $sc tls1_3 | 1752 | test_sc_all_cipher $sc tls1_3 |
1753 | 1753 | ||
1754 | # session resumption | 1754 | # session resumption |
1755 | test_sc_session_reuse $sc tls1_2 | 1755 | test_sc_session_reuse $sc tls1_2 |
1756 | 1756 | ||
1757 | # invalid verification pattern | 1757 | # invalid verification pattern |
1758 | test_sc_verify $sc tls1_2 | 1758 | test_sc_verify $sc tls1_2 |
1759 | test_sc_verify $sc tls1_3 | 1759 | test_sc_verify $sc tls1_3 |
1760 | 1760 | ||
1761 | # s_time | 1761 | # s_time |
1762 | if [ $gost_tests != 1 ] ; then | 1762 | if [ $gost_tests != 1 ] ; then |
1763 | start_message "s_time ... connect to TLS/SSL test server" | 1763 | start_message "s_time ... connect to TLS/SSL test server" |
@@ -1765,14 +1765,14 @@ function test_server_client { | |||
1765 | > $server_dir/s_time_${sc}.log | 1765 | > $server_dir/s_time_${sc}.log |
1766 | check_exit_status $? | 1766 | check_exit_status $? |
1767 | fi | 1767 | fi |
1768 | 1768 | ||
1769 | stop_s_server | 1769 | stop_s_server |
1770 | } | 1770 | } |
1771 | 1771 | ||
1772 | function test_speed { | 1772 | function test_speed { |
1773 | # === PERFORMANCE === | 1773 | # === PERFORMANCE === |
1774 | section_message "PERFORMANCE" | 1774 | section_message "PERFORMANCE" |
1775 | 1775 | ||
1776 | if [ $no_long_tests = 0 ] ; then | 1776 | if [ $no_long_tests = 0 ] ; then |
1777 | start_message "speed" | 1777 | start_message "speed" |
1778 | $openssl_bin speed sha512 rsa2048 -multi 2 -elapsed | 1778 | $openssl_bin speed sha512 rsa2048 -multi 2 -elapsed |
@@ -1785,7 +1785,7 @@ function test_speed { | |||
1785 | function test_version { | 1785 | function test_version { |
1786 | # --- VERSION INFORMATION --- | 1786 | # --- VERSION INFORMATION --- |
1787 | section_message "VERSION INFORMATION" | 1787 | section_message "VERSION INFORMATION" |
1788 | 1788 | ||
1789 | start_message "version" | 1789 | start_message "version" |
1790 | $openssl_bin version -a | 1790 | $openssl_bin version -a |
1791 | check_exit_status $? | 1791 | check_exit_status $? |