1#! /usr/bin/env perl 2# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved. 3# 4# Licensed under the OpenSSL license (the "License"). You may not use 5# this file except in compliance with the License. You can obtain a copy 6# in the file LICENSE in the source distribution or at 7# https://www.openssl.org/source/license.html 8 9 10use strict; 11use warnings; 12 13use File::Spec::Functions qw/canonpath/; 14use OpenSSL::Test qw/:DEFAULT srctop_file/; 15use OpenSSL::Test::Utils; 16 17setup("test_verify"); 18 19sub verify { 20 my ($cert, $purpose, $trusted, $untrusted, @opts) = @_; 21 my @args = qw(openssl verify -auth_level 1 -purpose); 22 my @path = qw(test certs); 23 push(@args, "$purpose", @opts); 24 for (@$trusted) { push(@args, "-trusted", srctop_file(@path, "$_.pem")) } 25 for (@$untrusted) { push(@args, "-untrusted", srctop_file(@path, "$_.pem")) } 26 push(@args, srctop_file(@path, "$cert.pem")); 27 run(app([@args])); 28} 29 30plan tests => 146; 31 32# Canonical success 33ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]), 34 "accept compat trust"); 35 36# Root CA variants 37ok(!verify("ee-cert", "sslserver", [qw(root-nonca)], [qw(ca-cert)]), 38 "fail trusted non-ca root"); 39ok(!verify("ee-cert", "sslserver", [qw(nroot+serverAuth)], [qw(ca-cert)]), 40 "fail server trust non-ca root"); 41ok(!verify("ee-cert", "sslserver", [qw(nroot+anyEKU)], [qw(ca-cert)]), 42 "fail wildcard trust non-ca root"); 43ok(!verify("ee-cert", "sslserver", [qw(root-cert2)], [qw(ca-cert)]), 44 "fail wrong root key"); 45ok(!verify("ee-cert", "sslserver", [qw(root-name2)], [qw(ca-cert)]), 46 "fail wrong root DN"); 47 48# Explicit trust/purpose combinations 49# 50ok(verify("ee-cert", "sslserver", [qw(sroot-cert)], [qw(ca-cert)]), 51 "accept server purpose"); 52ok(!verify("ee-cert", "sslserver", [qw(croot-cert)], [qw(ca-cert)]), 53 "fail client purpose"); 54ok(verify("ee-cert", "sslserver", [qw(root+serverAuth)], [qw(ca-cert)]), 55 "accept server trust"); 56ok(verify("ee-cert", "sslserver", [qw(sroot+serverAuth)], [qw(ca-cert)]), 57 "accept server trust with server purpose"); 58ok(verify("ee-cert", "sslserver", [qw(croot+serverAuth)], [qw(ca-cert)]), 59 "accept server trust with client purpose"); 60# Wildcard trust 61ok(verify("ee-cert", "sslserver", [qw(root+anyEKU)], [qw(ca-cert)]), 62 "accept wildcard trust"); 63ok(verify("ee-cert", "sslserver", [qw(sroot+anyEKU)], [qw(ca-cert)]), 64 "accept wildcard trust with server purpose"); 65ok(verify("ee-cert", "sslserver", [qw(croot+anyEKU)], [qw(ca-cert)]), 66 "accept wildcard trust with client purpose"); 67# Inapplicable mistrust 68ok(verify("ee-cert", "sslserver", [qw(root-clientAuth)], [qw(ca-cert)]), 69 "accept client mistrust"); 70ok(verify("ee-cert", "sslserver", [qw(sroot-clientAuth)], [qw(ca-cert)]), 71 "accept client mistrust with server purpose"); 72ok(!verify("ee-cert", "sslserver", [qw(croot-clientAuth)], [qw(ca-cert)]), 73 "fail client mistrust with client purpose"); 74# Inapplicable trust 75ok(!verify("ee-cert", "sslserver", [qw(root+clientAuth)], [qw(ca-cert)]), 76 "fail client trust"); 77ok(!verify("ee-cert", "sslserver", [qw(sroot+clientAuth)], [qw(ca-cert)]), 78 "fail client trust with server purpose"); 79ok(!verify("ee-cert", "sslserver", [qw(croot+clientAuth)], [qw(ca-cert)]), 80 "fail client trust with client purpose"); 81# Server mistrust 82ok(!verify("ee-cert", "sslserver", [qw(root-serverAuth)], [qw(ca-cert)]), 83 "fail rejected EKU"); 84ok(!verify("ee-cert", "sslserver", [qw(sroot-serverAuth)], [qw(ca-cert)]), 85 "fail server mistrust with server purpose"); 86ok(!verify("ee-cert", "sslserver", [qw(croot-serverAuth)], [qw(ca-cert)]), 87 "fail server mistrust with client purpose"); 88# Wildcard mistrust 89ok(!verify("ee-cert", "sslserver", [qw(root-anyEKU)], [qw(ca-cert)]), 90 "fail wildcard mistrust"); 91ok(!verify("ee-cert", "sslserver", [qw(sroot-anyEKU)], [qw(ca-cert)]), 92 "fail wildcard mistrust with server purpose"); 93ok(!verify("ee-cert", "sslserver", [qw(croot-anyEKU)], [qw(ca-cert)]), 94 "fail wildcard mistrust with client purpose"); 95 96# Check that trusted-first is on by setting up paths to different roots 97# depending on whether the intermediate is the trusted or untrusted one. 98# 99ok(verify("ee-cert", "sslserver", [qw(root-serverAuth root-cert2 ca-root2)], 100 [qw(ca-cert)]), 101 "accept trusted-first path"); 102ok(verify("ee-cert", "sslserver", [qw(root-cert root2+serverAuth ca-root2)], 103 [qw(ca-cert)]), 104 "accept trusted-first path with server trust"); 105ok(!verify("ee-cert", "sslserver", [qw(root-cert root2-serverAuth ca-root2)], 106 [qw(ca-cert)]), 107 "fail trusted-first path with server mistrust"); 108ok(!verify("ee-cert", "sslserver", [qw(root-cert root2+clientAuth ca-root2)], 109 [qw(ca-cert)]), 110 "fail trusted-first path with client trust"); 111 112# CA variants 113ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-nonca)]), 114 "fail non-CA untrusted intermediate"); 115ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-nonbc)]), 116 "fail non-CA untrusted intermediate"); 117ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-nonca)], []), 118 "fail non-CA trust-store intermediate"); 119ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-nonbc)], []), 120 "fail non-CA trust-store intermediate"); 121ok(!verify("ee-cert", "sslserver", [qw(root-cert nca+serverAuth)], []), 122 "fail non-CA server trust intermediate"); 123ok(!verify("ee-cert", "sslserver", [qw(root-cert nca+anyEKU)], []), 124 "fail non-CA wildcard trust intermediate"); 125ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-cert2)]), 126 "fail wrong intermediate CA key"); 127ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-name2)]), 128 "fail wrong intermediate CA DN"); 129ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-root2)]), 130 "fail wrong intermediate CA issuer"); 131ok(!verify("ee-cert", "sslserver", [], [qw(ca-cert)], "-partial_chain"), 132 "fail untrusted partial chain"); 133ok(verify("ee-cert", "sslserver", [qw(ca-cert)], [], "-partial_chain"), 134 "accept trusted partial chain"); 135ok(!verify("ee-cert", "sslserver", [qw(ca-expired)], [], "-partial_chain"), 136 "reject expired trusted partial chain"); # this check is beyond RFC 5280 137ok(!verify("ee-cert", "sslserver", [qw(root-expired)], [qw(ca-cert)]), 138 "reject expired trusted root"); # this check is beyond RFC 5280 139ok(verify("ee-cert", "sslserver", [qw(sca-cert)], [], "-partial_chain"), 140 "accept partial chain with server purpose"); 141ok(!verify("ee-cert", "sslserver", [qw(cca-cert)], [], "-partial_chain"), 142 "fail partial chain with client purpose"); 143ok(verify("ee-cert", "sslserver", [qw(ca+serverAuth)], [], "-partial_chain"), 144 "accept server trust partial chain"); 145ok(verify("ee-cert", "sslserver", [qw(cca+serverAuth)], [], "-partial_chain"), 146 "accept server trust client purpose partial chain"); 147ok(verify("ee-cert", "sslserver", [qw(ca-clientAuth)], [], "-partial_chain"), 148 "accept client mistrust partial chain"); 149ok(verify("ee-cert", "sslserver", [qw(ca+anyEKU)], [], "-partial_chain"), 150 "accept wildcard trust partial chain"); 151ok(!verify("ee-cert", "sslserver", [], [qw(ca+serverAuth)], "-partial_chain"), 152 "fail untrusted partial issuer with ignored server trust"); 153ok(!verify("ee-cert", "sslserver", [qw(ca-serverAuth)], [], "-partial_chain"), 154 "fail server mistrust partial chain"); 155ok(!verify("ee-cert", "sslserver", [qw(ca+clientAuth)], [], "-partial_chain"), 156 "fail client trust partial chain"); 157ok(!verify("ee-cert", "sslserver", [qw(ca-anyEKU)], [], "-partial_chain"), 158 "fail wildcard mistrust partial chain"); 159 160# We now test auxiliary trust even for intermediate trusted certs without 161# -partial_chain. Note that "-trusted_first" is now always on and cannot 162# be disabled. 163ok(verify("ee-cert", "sslserver", [qw(root-cert ca+serverAuth)], [qw(ca-cert)]), 164 "accept server trust"); 165ok(verify("ee-cert", "sslserver", [qw(root-cert ca+anyEKU)], [qw(ca-cert)]), 166 "accept wildcard trust"); 167ok(verify("ee-cert", "sslserver", [qw(root-cert sca-cert)], [qw(ca-cert)]), 168 "accept server purpose"); 169ok(verify("ee-cert", "sslserver", [qw(root-cert sca+serverAuth)], [qw(ca-cert)]), 170 "accept server trust and purpose"); 171ok(verify("ee-cert", "sslserver", [qw(root-cert sca+anyEKU)], [qw(ca-cert)]), 172 "accept wildcard trust and server purpose"); 173ok(verify("ee-cert", "sslserver", [qw(root-cert sca-clientAuth)], [qw(ca-cert)]), 174 "accept client mistrust and server purpose"); 175ok(verify("ee-cert", "sslserver", [qw(root-cert cca+serverAuth)], [qw(ca-cert)]), 176 "accept server trust and client purpose"); 177ok(verify("ee-cert", "sslserver", [qw(root-cert cca+anyEKU)], [qw(ca-cert)]), 178 "accept wildcard trust and client purpose"); 179ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-cert)], [qw(ca-cert)]), 180 "fail client purpose"); 181ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-anyEKU)], [qw(ca-cert)]), 182 "fail wildcard mistrust"); 183ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-serverAuth)], [qw(ca-cert)]), 184 "fail server mistrust"); 185ok(!verify("ee-cert", "sslserver", [qw(root-cert ca+clientAuth)], [qw(ca-cert)]), 186 "fail client trust"); 187ok(!verify("ee-cert", "sslserver", [qw(root-cert sca+clientAuth)], [qw(ca-cert)]), 188 "fail client trust and server purpose"); 189ok(!verify("ee-cert", "sslserver", [qw(root-cert cca+clientAuth)], [qw(ca-cert)]), 190 "fail client trust and client purpose"); 191ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-serverAuth)], [qw(ca-cert)]), 192 "fail server mistrust and client purpose"); 193ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-clientAuth)], [qw(ca-cert)]), 194 "fail client mistrust and client purpose"); 195ok(!verify("ee-cert", "sslserver", [qw(root-cert sca-serverAuth)], [qw(ca-cert)]), 196 "fail server mistrust and server purpose"); 197ok(!verify("ee-cert", "sslserver", [qw(root-cert sca-anyEKU)], [qw(ca-cert)]), 198 "fail wildcard mistrust and server purpose"); 199ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-anyEKU)], [qw(ca-cert)]), 200 "fail wildcard mistrust and client purpose"); 201 202# EE variants 203ok(verify("ee-client", "sslclient", [qw(root-cert)], [qw(ca-cert)]), 204 "accept client chain"); 205ok(!verify("ee-client", "sslserver", [qw(root-cert)], [qw(ca-cert)]), 206 "fail server leaf purpose"); 207ok(!verify("ee-cert", "sslclient", [qw(root-cert)], [qw(ca-cert)]), 208 "fail client leaf purpose"); 209ok(!verify("ee-cert2", "sslserver", [qw(root-cert)], [qw(ca-cert)]), 210 "fail wrong intermediate CA key"); 211ok(!verify("ee-name2", "sslserver", [qw(root-cert)], [qw(ca-cert)]), 212 "fail wrong intermediate CA DN"); 213ok(!verify("ee-expired", "sslserver", [qw(root-cert)], [qw(ca-cert)]), 214 "fail expired leaf"); 215ok(verify("ee-cert", "sslserver", [qw(ee-cert)], [], "-partial_chain"), 216 "accept last-resort direct leaf match"); 217ok(verify("ee-client", "sslclient", [qw(ee-client)], [], "-partial_chain"), 218 "accept last-resort direct leaf match"); 219ok(!verify("ee-cert", "sslserver", [qw(ee-client)], [], "-partial_chain"), 220 "fail last-resort direct leaf non-match"); 221ok(verify("ee-cert", "sslserver", [qw(ee+serverAuth)], [], "-partial_chain"), 222 "accept direct match with server trust"); 223ok(!verify("ee-cert", "sslserver", [qw(ee-serverAuth)], [], "-partial_chain"), 224 "fail direct match with server mistrust"); 225ok(verify("ee-client", "sslclient", [qw(ee+clientAuth)], [], "-partial_chain"), 226 "accept direct match with client trust"); 227ok(!verify("ee-client", "sslclient", [qw(ee-clientAuth)], [], "-partial_chain"), 228 "reject direct match with client mistrust"); 229ok(verify("ee-pathlen", "sslserver", [qw(root-cert)], [qw(ca-cert)]), 230 "accept non-ca with pathlen:0 by default"); 231ok(!verify("ee-pathlen", "sslserver", [qw(root-cert)], [qw(ca-cert)], "-x509_strict"), 232 "reject non-ca with pathlen:0 with strict flag"); 233 234# Proxy certificates 235ok(!verify("pc1-cert", "sslclient", [qw(root-cert)], [qw(ee-client ca-cert)]), 236 "fail to accept proxy cert without -allow_proxy_certs"); 237ok(verify("pc1-cert", "sslclient", [qw(root-cert)], [qw(ee-client ca-cert)], 238 "-allow_proxy_certs"), 239 "accept proxy cert 1"); 240ok(verify("pc2-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)], 241 "-allow_proxy_certs"), 242 "accept proxy cert 2"); 243ok(!verify("bad-pc3-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)], 244 "-allow_proxy_certs"), 245 "fail proxy cert with incorrect subject"); 246ok(!verify("bad-pc4-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)], 247 "-allow_proxy_certs"), 248 "fail proxy cert with incorrect pathlen"); 249ok(verify("pc5-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)], 250 "-allow_proxy_certs"), 251 "accept proxy cert missing proxy policy"); 252ok(!verify("pc6-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)], 253 "-allow_proxy_certs"), 254 "failed proxy cert where last CN was added as a multivalue RDN component"); 255 256# Security level tests 257ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"), 258 "accept RSA 2048 chain at auth level 2"); 259ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "3"), 260 "reject RSA 2048 root at auth level 3"); 261ok(verify("ee-cert", "sslserver", ["root-cert-768"], ["ca-cert-768i"], "-auth_level", "0"), 262 "accept RSA 768 root at auth level 0"); 263ok(!verify("ee-cert", "sslserver", ["root-cert-768"], ["ca-cert-768i"]), 264 "reject RSA 768 root at auth level 1"); 265ok(verify("ee-cert-768i", "sslserver", ["root-cert"], ["ca-cert-768"], "-auth_level", "0"), 266 "accept RSA 768 intermediate at auth level 0"); 267ok(!verify("ee-cert-768i", "sslserver", ["root-cert"], ["ca-cert-768"]), 268 "reject RSA 768 intermediate at auth level 1"); 269ok(verify("ee-cert-768", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"), 270 "accept RSA 768 leaf at auth level 0"); 271ok(!verify("ee-cert-768", "sslserver", ["root-cert"], ["ca-cert"]), 272 "reject RSA 768 leaf at auth level 1"); 273# 274ok(verify("ee-cert", "sslserver", ["root-cert-md5"], ["ca-cert"], "-auth_level", "2"), 275 "accept md5 self-signed TA at auth level 2"); 276ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [], "-auth_level", "2"), 277 "accept md5 intermediate TA at auth level 2"); 278ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert-md5"], "-auth_level", "0"), 279 "accept md5 intermediate at auth level 0"); 280ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert-md5"]), 281 "reject md5 intermediate at auth level 1"); 282ok(verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"), 283 "accept md5 leaf at auth level 0"); 284ok(!verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"]), 285 "reject md5 leaf at auth level 1"); 286 287# Explicit vs named curve tests 288SKIP: { 289 skip "EC is not supported by this OpenSSL build", 5 290 if disabled("ec"); 291 ok(verify("ee-cert-ec-explicit", "sslserver", ["root-cert"], 292 ["ca-cert-ec-named"]), 293 "accept explicit curve leaf with named curve intermediate without strict"); 294 ok(verify("ee-cert-ec-named-explicit", "sslserver", ["root-cert"], 295 ["ca-cert-ec-explicit"]), 296 "accept named curve leaf with explicit curve intermediate without strict"); 297 ok(!verify("ee-cert-ec-explicit", "sslserver", ["root-cert"], 298 ["ca-cert-ec-named"], "-x509_strict"), 299 "reject explicit curve leaf with named curve intermediate with strict"); 300 ok(!verify("ee-cert-ec-named-explicit", "sslserver", ["root-cert"], 301 ["ca-cert-ec-explicit"], "-x509_strict"), 302 "reject named curve leaf with explicit curve intermediate with strict"); 303 ok(verify("ee-cert-ec-named-named", "sslserver", ["root-cert"], 304 ["ca-cert-ec-named"], "-x509_strict"), 305 "accept named curve leaf with named curve intermediate with strict"); 306} 307 308# Depth tests, note the depth limit bounds the number of CA certificates 309# between the trust-anchor and the leaf, so, for example, with a root->ca->leaf 310# chain, depth = 1 is sufficient, but depth == 0 is not. 311# 312ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "2"), 313 "accept chain with verify_depth 2"); 314ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "1"), 315 "accept chain with verify_depth 1"); 316ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "0"), 317 "accept chain with verify_depth 0"); 318ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [], "-verify_depth", "0"), 319 "accept md5 intermediate TA with verify_depth 0"); 320 321# Name Constraints tests. 322 323ok(verify("alt1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ), 324 "Name Constraints everything permitted"); 325 326ok(verify("alt2-cert", "sslserver", ["root-cert"], ["ncca2-cert"], ), 327 "Name Constraints nothing excluded"); 328 329ok(verify("alt3-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ), 330 "Name Constraints nested test all permitted"); 331 332ok(verify("goodcn1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ), 333 "Name Constraints CNs permitted"); 334 335ok(!verify("badcn1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ), 336 "Name Constraints CNs not permitted"); 337 338ok(!verify("badalt1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ), 339 "Name Constraints hostname not permitted"); 340 341ok(!verify("badalt2-cert", "sslserver", ["root-cert"], ["ncca2-cert"], ), 342 "Name Constraints hostname excluded"); 343 344ok(!verify("badalt3-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ), 345 "Name Constraints email address not permitted"); 346 347ok(!verify("badalt4-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ), 348 "Name Constraints subject email address not permitted"); 349 350ok(!verify("badalt5-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ), 351 "Name Constraints IP address not permitted"); 352 353ok(!verify("badalt6-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ), 354 "Name Constraints CN hostname not permitted"); 355 356ok(!verify("badalt7-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ), 357 "Name Constraints CN BMPSTRING hostname not permitted"); 358 359ok(!verify("badalt8-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ), 360 "Name constraints nested DNS name not permitted 1"); 361 362ok(!verify("badalt9-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ), 363 "Name constraints nested DNS name not permitted 2"); 364 365ok(!verify("badalt10-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ), 366 "Name constraints nested DNS name excluded"); 367 368ok(verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], ), 369 "Certificate PSS signature using SHA1"); 370 371ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], ), 372 "CA with PSS signature using SHA256"); 373 374ok(!verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"), 375 "Reject PSS signature using SHA1 and auth level 2"); 376 377ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"), 378 "PSS signature using SHA256 and auth level 2"); 379 380ok(verify("ee-pss-cert", "sslserver", ["root-cert"], ["ca-pss-cert"], ), 381 "CA PSS signature"); 382 383ok(!verify("many-names1", "sslserver", ["many-constraints"], ["many-constraints"], ), 384 "Too many names and constraints to check (1)"); 385ok(!verify("many-names2", "sslserver", ["many-constraints"], ["many-constraints"], ), 386 "Too many names and constraints to check (2)"); 387ok(!verify("many-names3", "sslserver", ["many-constraints"], ["many-constraints"], ), 388 "Too many names and constraints to check (3)"); 389 390ok(verify("some-names1", "sslserver", ["many-constraints"], ["many-constraints"], ), 391 "Not too many names and constraints to check (1)"); 392ok(verify("some-names2", "sslserver", ["many-constraints"], ["many-constraints"], ), 393 "Not too many names and constraints to check (2)"); 394ok(verify("some-names2", "sslserver", ["many-constraints"], ["many-constraints"], ), 395 "Not too many names and constraints to check (3)"); 396ok(verify("root-cert-rsa2", "sslserver", ["root-cert-rsa2"], [], "-check_ss_sig"), 397 "Public Key Algorithm rsa instead of rsaEncryption"); 398 399ok(verify("ee-self-signed", "sslserver", ["ee-self-signed"], [], 400 "-attime", "1593565200"), 401 "accept trusted self-signed EE cert excluding key usage keyCertSign"); 402 403SKIP: { 404 skip "Ed25519 is not supported by this OpenSSL build", 1 405 if disabled("ec"); 406 407 # ED25519 certificate from draft-ietf-curdle-pkix-04 408 ok(verify("ee-ed25519", "sslserver", ["root-ed25519"], []), 409 "ED25519 signature"); 410 411} 412