Skip to content
Snippets Groups Projects
Commit 30c37de5 authored by Francesco Giacomini's avatar Francesco Giacomini
Browse files

Infrastructure to support throw-away certificates 

The conf.d directory contains the configurations for the various
CA and EE certificates, starting from the x509-scripts repo.
parent d86dc663
No related branches found
No related tags found
1 merge request!27Resolve "Use a throw-away CA for the tests"
Hide whitespace changes
Inline Side-by-side
Showing
with 268 additions and 2 deletions
t/certs/README.md
+ 2
− 2
View file @ 30c37de5
......@@ -22,7 +22,7 @@ The following certificates and proxy certificates are used in these tests:
* `0.pem`: long-lived proxy certificate, without any Attribute Certificate (AC). Obtained with:
```shell
voms-proxy-init -cert t/certs/test0.p12 --valid 10000:0 --vomsdir t/vomsdir --certdir t/trust-anchors --vomses t/vomses
voms-proxy-init -cert t/certs/test0.p12 --valid 100:0
```
* `1.pem`: long-lived proxy certificate, with an expired AC. Obtained with:
......@@ -40,7 +40,7 @@ The following certificates and proxy certificates are used in these tests:
* `3.pem`: long-lived proxy with valid VOMS attributes. Obtained with:
```shell
$ VOMS_CLIENTS_JAVA_OPTIONS="-Dvoms.fake.vo=test.vo -Dvoms.fake=true -Dvoms.fake.aaCert=t/certs/star.test.example.cert.pem -Dvoms.fake.aaKey=t/certs/star.test.example.key.pem -Dvoms.fake.notAfter=2031-12-31T00:00:00 -Dvoms.fake.notBefore=2022-12-10T00:00:00 -Dvoms.fake.gas=nickname=sd,nickname=cnaf -Dvoms.fake.fqans=/test.vo/exp1,/test.vo/exp2,/test.vo/exp3/Role=PIPPO -Dvoms.fake.serial=123456" voms-proxy-init -voms test.vo -cert t/certs/test0.p12 --valid 10000:0 --vomsdir t/vomsdir --certdir t/trust-anchors --vomses t/vomses
$ VOMS_CLIENTS_JAVA_OPTIONS="-Dvoms.fake.vo=test.vo -Dvoms.fake=true -Dvoms.fake.aaCert=t/certs/star_test_example.cert.pem -Dvoms.fake.aaKey=t/certs/star_test_example.key.pem -Dvoms.fake.notAfter=2031-12-31T00:00:00 -Dvoms.fake.notBefore=2022-12-10T00:00:00 -Dvoms.fake.gas=nickname=sd,nickname=cnaf -Dvoms.fake.fqans=/test.vo/exp1,/test.vo/exp2,/test.vo/exp3/Role=PIPPO -Dvoms.fake.serial=123456" voms-proxy-init -voms test.vo -cert t/certs/test0.p12 --valid 10000:0 --vomsdir t/vomsdir --certdir t/trust-anchors --vomses t/vomses
```
* `4.pem`: long-lived proxy with VOMS generic attributes containing special characters. Obtained with:
......
t/conf.d/ephemeral_ca.conf 0 → 100644
+ 34
− 0
View file @ 30c37de5
[ ephemeral_ca ]
dir = ${ENV::CA_NAME}
certs = $dir/certs
database = $dir/index.txt
serial = $dir/serial
certificate = $dir/ca.crt
private_key = $dir/private/ca.key
default_crl_days = 30
default_md = sha512
[ ephemeral_ca_cert ]
default_bits = 2048
default_keyfile = ${ENV::CA_NAME}/private/ca.key
distinguished_name = ${ENV::CA_NAME}_dn
prompt = no
encrypt_key = no
default_md = sha512
x509_extensions = ${ENV::CA_NAME}_extensions
[ ephemeral_ca_dn ]
C = IT
O = IGI
CN = Ephemeral CA
[ ephemeral_ca_extensions ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer:always
basicConstraints = critical, CA:true
keyUsage = critical, cRLSign, keyCertSign
t/conf.d/expired.conf 0 → 100644
+ 26
− 0
View file @ 30c37de5
[ expired ]
default_bits = 2048
default_keyfile = ${ENV::CA_NAME}/certs/expired.key.pem
distinguished_name = expired_dn
prompt = no
output_password = pass
default_md = sha512
x509_extensions = expired_extensions
[ expired_dn ]
C = IT
O = IGI
CN = Expired
[ expired_extensions ]
basicConstraints = critical,CA:FALSE
subjectKeyIdentifier = hash
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
authorityKeyIdentifier = keyid, issuer
subjectAltName = email:expired@cnaf.infn.it
t/conf.d/igi_test_ca.conf 0 → 100644
+ 34
− 0
View file @ 30c37de5
[ igi_test_ca ]
dir = ${ENV::CA_NAME}
certs = $dir/certs
database = $dir/index.txt
serial = $dir/serial
certificate = $dir/ca.crt
private_key = $dir/private/ca.key
default_crl_days = 30
default_md = sha512
[ igi_test_ca_cert ]
default_bits = 2048
default_keyfile = ${ENV::CA_NAME}/private/ca.key
distinguished_name = ${ENV::CA_NAME}_dn
prompt = no
encrypt_key = no
default_md = sha512
x509_extensions = ${ENV::CA_NAME}_extensions
[ igi_test_ca_dn ]
C = IT
O = IGI
CN = Test CA
[ igi_test_ca_extensions ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer:always
basicConstraints = critical, CA:true
keyUsage = critical, cRLSign, keyCertSign
t/conf.d/igi_test_ca2.conf 0 → 100644
+ 34
− 0
View file @ 30c37de5
[ igi_test_ca2 ]
dir = ${ENV::CA_NAME}
certs = $dir/certs
database = $dir/index.txt
serial = $dir/serial
certificate = $dir/ca.crt
private_key = $dir/private/ca.key
default_crl_days = 30
default_md = sha512
[ igi_test_ca2_cert ]
default_bits = 2048
default_keyfile = ${ENV::CA_NAME}/private/ca.key
distinguished_name = ${ENV::CA_NAME}_dn
prompt = no
encrypt_key = no
default_md = sha512
x509_extensions = ${ENV::CA_NAME}_extensions
[ igi_test_ca2_dn ]
C = IT
O = IGI
CN = Test CA 2
[ igi_test_ca2_extensions ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer:always
basicConstraints = critical, CA:true
keyUsage = critical, cRLSign, keyCertSign
t/conf.d/revoked.conf 0 → 100644
+ 26
− 0
View file @ 30c37de5
[ revoked ]
default_bits = 2048
default_keyfile = ${ENV::CA_NAME}/certs/revoked.key.pem
distinguished_name = revoked_dn
prompt = no
output_password = pass
default_md = sha512
x509_extensions = revoked_extensions
[ revoked_dn ]
C = IT
O = IGI
CN = Revoked
[ revoked_extensions ]
basicConstraints = critical,CA:FALSE
subjectKeyIdentifier = hash
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
authorityKeyIdentifier = keyid, issuer
subjectAltName = email:revoked@cnaf.infn.it
t/conf.d/star_test_example.conf 0 → 100644
+ 25
− 0
View file @ 30c37de5
[ star_test_example ]
default_bits = 2048
default_keyfile = ${ENV::CA_NAME}/certs/star_test_example.key.pem
distinguished_name = star_test_example_dn
prompt = no
encrypt_key = no
default_md = sha512
x509_extensions = star_test_example_extensions
[ star_test_example_dn ]
C = IT
O = IGI
CN = *.test.example
[ star_test_example_extensions ]
basicConstraints = critical,CA:FALSE
subjectKeyIdentifier = hash
keyUsage = critical, digitalSignature
extendedKeyUsage = serverAuth, clientAuth
authorityKeyIdentifier = keyid, issuer
subjectAltName = DNS:*.test.example
t/conf.d/test0.conf 0 → 100644
+ 26
− 0
View file @ 30c37de5
[ test0 ]
default_bits = 2048
default_keyfile = ${ENV::CA_NAME}/certs/test0.key.pem
distinguished_name = test0_dn
prompt = no
encrypt_key = no
default_md = sha512
x509_extensions = test0_extensions
[ test0_dn ]
C = IT
O = IGI
CN = Test0
[ test0_extensions ]
basicConstraints = critical,CA:FALSE
subjectKeyIdentifier = hash
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
authorityKeyIdentifier = keyid, issuer
subjectAltName = email:test0@cnaf.infn.it
t/conf.d/test1.conf 0 → 100644
+ 26
− 0
View file @ 30c37de5
[ test1 ]
default_bits = 2048
default_keyfile = ${ENV::CA_NAME}/certs/test1.key.pem
distinguished_name = test1_dn
prompt = no
encrypt_key = no
default_md = sha512
x509_extensions = test1_extensions
[ test1_dn ]
C = IT
O = IGI
CN = Test1
[ test1_extensions ]
basicConstraints = critical,CA:FALSE
subjectKeyIdentifier = hash
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
authorityKeyIdentifier = keyid, issuer
subjectAltName = email:test1@cnaf.infn.it
t/openssl.conf 0 → 100644
+ 8
− 0
View file @ 30c37de5
config_diagnostics = 1
[ ca ]
default_ca = ${ENV::CA_NAME}
.include conf.d
t/setup.sh 0 → 100755
+ 27
− 0
View file @ 30c37de5
#!/bin/bash
set -e
env CA_NAME=igi_test_ca2 make_ca.sh
env CA_NAME=igi_test_ca2 make_crl.sh
install_ca.sh igi_test_ca2 trust-anchors
export CA_NAME=igi_test_ca
make_ca.sh
make_cert.sh test0
cp igi_test_ca/certs/test0.* certs
make_cert.sh star_test_example
cp igi_test_ca/certs/star_test_example.* certs
# test 1
echo | voms-proxy-init -cert certs/test0.p12 --valid 10:0 --out certs/0.pem --pwstdin
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' certs/0.pem > certs/0.key.pem
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' certs/0.pem > certs/0.cert.pem
# test 3
cat certs/test0.cert.pem trust-anchors/igi_test_ca.pem > certs/test0+ca.pem
make_crl.sh
install_ca.sh igi_test_ca trust-anchors
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment