mbedtls/tests/data_files/test-ca.opensslconf

[req]
x509_extensions = v3_ca
distinguished_name = req_dn

[req_dn]
countryName = NL
organizationalUnitName = PolarSSL
commonName = PolarSSL Test CA

[v3_ca]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
basicConstraints = CA:true

[noext_ca]
basicConstraints = CA:true

[test_ca]
database = /dev/null

[crl_ext_idp]
issuingDistributionPoint=critical, @idpdata

[crl_ext_idp_nc]
issuingDistributionPoint=@idpdata

[idpdata]
fullname=URI:http://pki.example.com/

# these IPs are the ascii values for 'abcd' and 'abcd.example.com'
[tricky_ip_san]
subjectAltName=IP:97.98.99.100,IP:6162:6364:2e65:7861:6d70:6c65:2e63:6f6d
Added SHA256 test certificates With SHA-1 deprecation, we need a few certificates using algorithms in the default support list. Most tests still use SHA-1 though. The generation process for the new certificates is recorded in the makefile. 2017-05-05 16:56:12 +00:00			`[req]`
			`x509_extensions = v3_ca`
			`distinguished_name = req_dn`

			`[req_dn]`
			`countryName = NL`
			`organizationalUnitName = PolarSSL`
			`commonName = PolarSSL Test CA`

			`[v3_ca]`
			`subjectKeyIdentifier=hash`
			`authorityKeyIdentifier=keyid:always,issuer:always`
			`basicConstraints = CA:true`
Add test for CA forgery attempt As we accept EE certs that are explicitly trusted (in the list of trusted roots) and usually look for parent by subject, and in the future we might want to avoid checking the self-signature on trusted certs, there could a risk that we incorrectly accept a cert that looks like a trusted root except it doesn't have the same key. This test ensures this will never happen. 2017-06-29 07:48:08 +00:00
			`[noext_ca]`
			`basicConstraints = CA:true`
Merge tag 'mbedtls-2.8.0' into iotssl-1381-x509-verify-refactor-restricted Conflict resolution: * ChangeLog * tests/data_files/Makefile: concurrent additions, order irrelevant * tests/data_files/test-ca.opensslconf: concurrent additions, order irrelevant * tests/scripts/all.sh: one comment change conflicted with a code addition. In addition some of the additions in the iotssl-1381-x509-verify-refactor-restricted branch need support for keep-going mode, this will be added in a subsequent commit. 2018-03-22 21:21:55 +00:00
x509: CRL: reject unsupported critical extensions 2018-03-13 10:53:30 +00:00			`[test_ca]`
			`database = /dev/null`

			`[crl_ext_idp]`
			`issuingDistributionPoint=critical, @idpdata`

x509: CRL: add tests for non-critical extension The 'critical' boolean can be set to false in two ways: - by leaving it implicit (test data generated by openssl) - by explicitly setting it to false (generated by hand) 2018-03-14 11:23:56 +00:00			`[crl_ext_idp_nc]`
			`issuingDistributionPoint=@idpdata`

x509: CRL: reject unsupported critical extensions 2018-03-13 10:53:30 +00:00			`[idpdata]`
			`fullname=URI:http://pki.example.com/`
Add test: DNS names should not match IP addresses Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> 2020-07-23 10:39:53 +00:00
			`# these IPs are the ascii values for 'abcd' and 'abcd.example.com'`
			`[tricky_ip_san]`
			`subjectAltName=IP:97.98.99.100,IP:6162:6364:2e65:7861:6d70:6c65:2e63:6f6d`