From f9def1431f3a54fe970d16199cc3df8126f4e7b8 Mon Sep 17 00:00:00 2001 From: Nickolas Lapp Date: Wed, 22 Jul 2015 15:08:29 -0600 Subject: [PATCH] Adding support for crl testing via make check. includes modifying crl.pem/revoked Adding a revoked server cert/key pair. Adding a script to test with a revoked cert (scripts/crl.test) --- certs/crl/crl.pem | 58 ++++++------ certs/crl/crl.revoked | 63 +++++++------ certs/crl/gencrls.sh | 28 ++++++ certs/gen_revoked.sh | 18 ++++ certs/renewcerts.sh | 33 +++---- certs/server-revoked-cert.pem | 172 ++++++++++++++++++++++++++++++++++ certs/server-revoked-key.pem | 27 ++++++ configure.ac | 3 +- scripts/crl.test | 95 +++++++++++++++++++ scripts/include.am | 4 + 10 files changed, 425 insertions(+), 76 deletions(-) create mode 100755 certs/gen_revoked.sh create mode 100644 certs/server-revoked-cert.pem create mode 100644 certs/server-revoked-key.pem create mode 100755 scripts/crl.test diff --git a/certs/crl/crl.pem b/certs/crl/crl.pem index 28311c760..caef4cd7a 100644 --- a/certs/crl/crl.pem +++ b/certs/crl/crl.pem @@ -2,38 +2,40 @@ Certificate Revocation List (CRL): Version 2 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: /C=US/ST=Montana/L=Bozeman/O=Sawtooth/OU=Consulting/CN=www.wolfssl.com/emailAddress=info@wolfssl.com - Last Update: May 7 18:21:01 2015 GMT - Next Update: Jan 31 18:21:01 2018 GMT + Last Update: Jul 22 16:17:45 2015 GMT + Next Update: Apr 17 16:17:45 2018 GMT CRL extensions: X509v3 CRL Number: - 1 -No Revoked Certificates. + 6 +Revoked Certificates: + Serial Number: 02 + Revocation Date: Jul 22 16:17:45 2015 GMT Signature Algorithm: sha256WithRSAEncryption - 96:e2:b9:11:e0:e5:25:be:ab:69:e5:fa:8a:5c:7f:fc:6f:1d: - 8f:4a:54:70:f8:2e:87:fa:b0:f6:fd:3f:8f:9c:75:8a:eb:62: - cc:dd:2c:0a:8c:31:9e:30:3f:22:9b:91:50:6b:43:fd:32:8a: - 79:ea:0b:6b:68:6c:82:9c:79:da:20:95:83:25:5e:09:fc:57: - 2d:19:f9:bc:5a:67:95:98:65:dc:2d:91:13:2a:81:c2:6d:ff: - 12:48:6f:a4:ce:8a:b2:d3:19:b8:c2:86:e0:ba:91:3f:bb:ec: - c6:79:83:50:95:19:95:28:eb:ef:ff:bb:16:8f:3c:7d:4c:d1: - 3e:c3:82:22:8f:c5:e8:0e:b3:64:8f:5d:53:32:d5:98:64:9c: - 36:c4:6a:cf:68:21:4f:a8:4e:90:37:76:dc:05:70:66:2d:bc: - a0:d8:19:5c:96:90:d6:b9:09:56:46:07:be:3c:ae:08:bb:26: - 26:21:2c:d1:48:01:88:28:bc:21:a4:97:b7:3b:f0:7e:67:73: - 84:cf:21:43:e7:dd:53:9d:6a:59:c3:e5:98:c9:69:71:c3:e3: - 70:28:ba:f9:69:0a:af:78:e5:83:02:13:7e:08:70:8c:f3:8b: - 5d:96:b0:78:b9:d9:99:c5:1e:b7:45:dc:28:32:1a:d0:50:4b: - f4:41:92:19 + 7c:5c:fe:a6:cb:e9:78:ed:10:48:59:4a:e6:d9:96:68:ea:30: + 43:ba:b8:99:d1:8b:96:5e:d9:52:4c:58:3f:c1:d4:98:f1:20: + 46:02:0f:a3:25:7b:9c:06:c7:3d:5a:f1:00:bf:d2:d6:70:5c: + 45:ee:dc:fa:22:58:36:f2:14:06:c4:18:c9:b4:f8:ff:54:56: + cf:ff:71:00:cd:a1:9a:3c:52:dc:6f:a6:c1:fa:67:2f:a9:4d: + 7e:f7:da:c0:4c:29:34:53:8d:27:31:02:ad:05:35:3e:7d:8d: + ea:f7:2a:f8:57:cb:7f:da:27:54:3d:0b:c4:69:a7:40:8f:b3: + cb:fe:dc:76:90:57:aa:62:23:22:61:8a:d5:aa:f4:43:aa:30: + bd:9d:97:df:84:58:7c:f1:d6:78:9d:a9:4f:69:7a:a2:b5:0f: + a2:61:d0:53:93:ea:d1:0f:35:ea:d4:49:09:a1:53:7d:64:ed: + 2a:c0:f3:78:d6:ad:07:38:01:56:d5:bb:66:cc:02:e7:a4:f6: + 9f:65:64:98:f8:db:0d:ed:fc:29:2e:f6:e5:e9:d8:d7:68:97: + 84:05:99:8e:e2:ad:1c:e6:ba:0d:05:46:5c:9a:6f:60:69:b3: + 03:d1:af:b9:3c:52:de:08:48:20:1a:3c:86:49:a8:06:49:b8: + 03:da:ba:89 -----BEGIN X509 CRL----- -MIIB7jCB1wIBATANBgkqhkiG9w0BAQsFADCBlDELMAkGA1UEBhMCVVMxEDAOBgNV +MIICBDCB7QIBATANBgkqhkiG9w0BAQsFADCBlDELMAkGA1UEBhMCVVMxEDAOBgNV BAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoMCFNhd3Rvb3Ro MRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20x -HzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20XDTE1MDUwNzE4MjEwMVoX -DTE4MDEzMTE4MjEwMVqgDjAMMAoGA1UdFAQDAgEBMA0GCSqGSIb3DQEBCwUAA4IB -AQCW4rkR4OUlvqtp5fqKXH/8bx2PSlRw+C6H+rD2/T+PnHWK62LM3SwKjDGeMD8i -m5FQa0P9Mop56gtraGyCnHnaIJWDJV4J/FctGfm8WmeVmGXcLZETKoHCbf8SSG+k -zoqy0xm4wobgupE/u+zGeYNQlRmVKOvv/7sWjzx9TNE+w4Iij8XoDrNkj11TMtWY -ZJw2xGrPaCFPqE6QN3bcBXBmLbyg2BlclpDWuQlWRge+PK4IuyYmISzRSAGIKLwh -pJe3O/B+Z3OEzyFD591TnWpZw+WYyWlxw+NwKLr5aQqveOWDAhN+CHCM84tdlrB4 -udmZxR63RdwoMhrQUEv0QZIZ +HzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20XDTE1MDcyMjE2MTc0NVoX +DTE4MDQxNzE2MTc0NVowFDASAgECFw0xNTA3MjIxNjE3NDVaoA4wDDAKBgNVHRQE +AwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAfFz+psvpeO0QSFlK5tmWaOowQ7q4mdGL +ll7ZUkxYP8HUmPEgRgIPoyV7nAbHPVrxAL/S1nBcRe7c+iJYNvIUBsQYybT4/1RW +z/9xAM2hmjxS3G+mwfpnL6lNfvfawEwpNFONJzECrQU1Pn2N6vcq+FfLf9onVD0L +xGmnQI+zy/7cdpBXqmIjImGK1ar0Q6owvZ2X34RYfPHWeJ2pT2l6orUPomHQU5Pq +0Q816tRJCaFTfWTtKsDzeNatBzgBVtW7ZswC56T2n2VkmPjbDe38KS725enY12iX +hAWZjuKtHOa6DQVGXJpvYGmzA9GvuTxS3ghIIBo8hkmoBkm4A9q6iQ== -----END X509 CRL----- diff --git a/certs/crl/crl.revoked b/certs/crl/crl.revoked index 60152d880..6bef57e6b 100644 --- a/certs/crl/crl.revoked +++ b/certs/crl/crl.revoked @@ -2,40 +2,43 @@ Certificate Revocation List (CRL): Version 2 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: /C=US/ST=Montana/L=Bozeman/O=Sawtooth/OU=Consulting/CN=www.wolfssl.com/emailAddress=info@wolfssl.com - Last Update: May 7 18:21:01 2015 GMT - Next Update: Jan 31 18:21:01 2018 GMT + Last Update: Jul 22 16:17:45 2015 GMT + Next Update: Apr 17 16:17:45 2018 GMT CRL extensions: X509v3 CRL Number: - 2 + 7 Revoked Certificates: Serial Number: 01 - Revocation Date: May 7 18:21:01 2015 GMT + Revocation Date: Jul 22 16:17:45 2015 GMT + Serial Number: 02 + Revocation Date: Jul 22 16:17:45 2015 GMT Signature Algorithm: sha256WithRSAEncryption - b7:34:2b:1c:09:6b:a2:9c:12:4f:fd:ef:69:4c:a4:1d:f2:39: - 52:29:98:78:b2:86:ea:54:9b:29:e5:c2:88:0e:2f:f9:d2:5b: - 9d:49:37:68:26:6c:45:61:d4:9d:05:ef:2d:ca:78:0a:d0:28: - c1:25:f2:f7:6a:ad:df:1d:eb:8a:66:64:4d:0c:02:91:fb:ff: - 70:b4:36:b6:e4:79:17:d5:18:6a:72:17:e1:8b:31:49:04:98: - 96:88:42:ea:8c:fe:91:40:5a:c5:ad:3b:da:9a:47:43:d6:e9: - f6:59:75:49:91:a9:e4:8b:c8:03:60:6b:36:69:87:71:f1:5b: - 92:00:51:bb:fe:d5:4f:0d:0e:f2:56:38:e3:b6:cb:76:11:7b: - 17:ad:a5:da:37:87:f2:49:af:73:42:56:ed:6c:a1:8d:46:5c: - dd:00:a7:8f:1f:5a:dd:d7:87:89:43:30:32:fe:e2:d4:b1:29: - 12:11:ef:22:0d:8f:7f:c5:33:3b:a9:a7:52:0c:25:b8:0c:e6: - 8a:8b:68:8f:55:84:65:04:c7:44:48:36:02:4d:4e:43:09:1d: - 1f:3b:f9:4a:0e:ff:59:42:ca:be:0e:a7:79:89:19:31:73:5a: - 45:6c:70:56:4d:1b:8a:59:c4:6d:ca:bc:f7:41:c4:f6:f0:fd: - 9c:7e:f1:7e + 7f:61:91:8a:8c:c1:23:f1:d4:98:d9:67:67:1e:d2:54:2a:ce: + b8:41:d1:f7:c4:88:84:01:a5:52:d6:42:d1:af:e6:c8:fb:13: + 51:9e:2e:18:c1:e7:9d:83:81:79:d3:34:a3:14:a8:1c:7b:9e: + 07:2b:fb:73:31:ce:17:52:69:80:cc:f7:fd:42:e3:1c:e0:63: + 66:70:52:81:09:cc:be:51:02:2c:33:9a:ec:21:15:81:9f:7a: + 10:d0:9c:23:f4:e6:b3:2b:e2:36:0e:fb:79:da:52:2c:bc:fa: + dd:9c:53:6b:48:b0:6a:56:5c:7b:87:53:18:94:c4:37:03:bf: + 13:18:e3:a4:26:e0:66:0c:dc:e5:99:84:5d:36:69:01:f4:69: + d4:06:eb:43:ff:4f:f5:17:46:9d:b7:cb:45:ec:0d:9e:9c:4a: + 96:3c:0b:92:c5:fb:de:d4:3f:af:a9:5e:b1:6f:9d:d7:8b:b5: + ab:86:b6:eb:00:da:b1:f4:6d:72:2d:9b:ec:f3:1b:2f:24:99: + d5:04:7b:4f:f8:7a:2e:4e:b6:ee:be:f8:50:d2:96:96:6f:f6: + 3a:c2:7f:35:48:82:1a:84:64:03:e8:58:8e:0c:dc:62:97:cd: + 82:ff:16:93:ac:44:14:e1:ae:fc:fb:52:25:b6:0d:70:ec:c4: + 93:42:37:af -----BEGIN X509 CRL----- -MIICBDCB7QIBATANBgkqhkiG9w0BAQsFADCBlDELMAkGA1UEBhMCVVMxEDAOBgNV -BAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoMCFNhd3Rvb3Ro -MRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20x -HzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20XDTE1MDUwNzE4MjEwMVoX -DTE4MDEzMTE4MjEwMVowFDASAgEBFw0xNTA1MDcxODIxMDFaoA4wDDAKBgNVHRQE -AwIBAjANBgkqhkiG9w0BAQsFAAOCAQEAtzQrHAlropwST/3vaUykHfI5UimYeLKG -6lSbKeXCiA4v+dJbnUk3aCZsRWHUnQXvLcp4CtAowSXy92qt3x3rimZkTQwCkfv/ -cLQ2tuR5F9UYanIX4YsxSQSYlohC6oz+kUBaxa072ppHQ9bp9ll1SZGp5IvIA2Br -NmmHcfFbkgBRu/7VTw0O8lY447bLdhF7F62l2jeH8kmvc0JW7WyhjUZc3QCnjx9a -3deHiUMwMv7i1LEpEhHvIg2Pf8UzO6mnUgwluAzmiotoj1WEZQTHREg2Ak1OQwkd -Hzv5Sg7/WULKvg6neYkZMXNaRWxwVk0bilnEbcq890HE9vD9nH7xfg== +MIICGTCCAQECAQEwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVTMRAwDgYD +VQQIDAdNb250YW5hMRAwDgYDVQQHDAdCb3plbWFuMREwDwYDVQQKDAhTYXd0b290 +aDETMBEGA1UECwwKQ29uc3VsdGluZzEYMBYGA1UEAwwPd3d3LndvbGZzc2wuY29t +MR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tFw0xNTA3MjIxNjE3NDVa +Fw0xODA0MTcxNjE3NDVaMCgwEgIBARcNMTUwNzIyMTYxNzQ1WjASAgECFw0xNTA3 +MjIxNjE3NDVaoA4wDDAKBgNVHRQEAwIBBzANBgkqhkiG9w0BAQsFAAOCAQEAf2GR +iozBI/HUmNlnZx7SVCrOuEHR98SIhAGlUtZC0a/myPsTUZ4uGMHnnYOBedM0oxSo +HHueByv7czHOF1JpgMz3/ULjHOBjZnBSgQnMvlECLDOa7CEVgZ96ENCcI/Tmsyvi +Ng77edpSLLz63ZxTa0iwalZce4dTGJTENwO/ExjjpCbgZgzc5ZmEXTZpAfRp1Abr +Q/9P9RdGnbfLRewNnpxKljwLksX73tQ/r6lesW+d14u1q4a26wDasfRtci2b7PMb +LySZ1QR7T/h6Lk627r74UNKWlm/2OsJ/NUiCGoRkA+hYjgzcYpfNgv8Wk6xEFOGu +/PtSJbYNcOzEk0I3rw== -----END X509 CRL----- diff --git a/certs/crl/gencrls.sh b/certs/crl/gencrls.sh index a18ecf3f7..3e500ff84 100755 --- a/certs/crl/gencrls.sh +++ b/certs/crl/gencrls.sh @@ -2,9 +2,36 @@ # gencrls, crl config already done, see taoCerts.txt for setup +function setup_files() { + #set up the file system for updating the crls + echo "setting up the file system for generating the crls..." + echo "" + touch ./index.txt + touch ./crlnumber + echo "01" >> crlnumber + touch ./blank.index.txt + mkdir demoCA + touch ./demoCA/index.txt +} +function cleanup_files() { + rm blank.index.txt + rm index.* + rm crlnumber* + rm -r demoCA + echo "Removed ../wolfssl.cnf, blank.index.txt, index.*, crlnumber*, demoCA/" + echo "" + exit 0 +} +trap cleanup_files EXIT + +#setup the files +setup_files # caCrl +# revoke server-revoked-cert.pem +openssl ca -config ../renewcerts/wolfssl.cnf -revoke ../server-revoked-cert.pem -keyfile ../ca-key.pem -cert ../ca-cert.pem + openssl ca -config ../renewcerts/wolfssl.cnf -gencrl -crldays 1000 -out crl.pem -keyfile ../ca-key.pem -cert ../ca-cert.pem # metadata @@ -55,3 +82,4 @@ mv tmp eccSrvCRL.pem # install (only needed if working outside wolfssl) #cp eccSrvCRL.pem ~/wolfssl/certs/crl/eccSrvCRL.pem +exit 0 diff --git a/certs/gen_revoked.sh b/certs/gen_revoked.sh new file mode 100755 index 000000000..e42073d70 --- /dev/null +++ b/certs/gen_revoked.sh @@ -0,0 +1,18 @@ + ########################################################### + ########## update and sign server-revoked-key.pem ################ + ########################################################### + echo "Updating server-revoked-cert.pem" + echo "" + #pipe the following arguments to openssl req... + echo -e "US\nMontana\nBozeman\nwolfSSL\nSupport\nwww.wolfssl.com\ninfo@wolfssl.com\n.\n.\n" | openssl req -new -key server-revoked-key.pem -nodes > server-revoked-req.pem + + openssl x509 -req -in server-revoked-req.pem -extfile wolfssl.cnf -extensions wolfssl_opts -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 02 > server-revoked-cert.pem + + rm server-revoked-req.pem + + openssl x509 -in ca-cert.pem -text > ca_tmp.pem + openssl x509 -in server-revoked-cert.pem -text > srv_tmp.pem + mv srv_tmp.pem server-revoked-cert.pem + cat ca_tmp.pem >> server-revoked-cert.pem + rm ca_tmp.pem + diff --git a/certs/renewcerts.sh b/certs/renewcerts.sh index a048b631d..c163dcab9 100755 --- a/certs/renewcerts.sh +++ b/certs/renewcerts.sh @@ -98,6 +98,23 @@ function run_renewcerts(){ mv srv_tmp.pem server-cert.pem cat ca_tmp.pem >> server-cert.pem rm ca_tmp.pem + ########################################################### + ########## update and sign server-revoked-key.pem ######### + ########################################################### + echo "Updating server-revoked-cert.pem" + echo "" + #pipe the following arguments to openssl req... + echo -e "US\nMontana\nBozeman\nwolfSSL\nSupport\nwww.wolfssl.com\ninfo@wolfssl.com\n.\n.\n" | openssl req -new -key server-revoked-key.pem -nodes > server-revoked-req.pem + + openssl x509 -req -in server-revoked-req.pem -extfile wolfssl.cnf -extensions wolfssl_opts -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 02 > server-revoked-cert.pem + + rm server-revoked-req.pem + + openssl x509 -in ca-cert.pem -text > ca_tmp.pem + openssl x509 -in server-revoked-cert.pem -text > srv_tmp.pem + mv srv_tmp.pem server-revoked-cert.pem + cat ca_tmp.pem >> server-revoked-cert.pem + rm ca_tmp.pem ############################################################ ########## update and sign the server-ecc-rsa.pem ########## ############################################################ @@ -181,16 +198,6 @@ function run_renewcerts(){ echo "We are back in the certs directory" echo "" - #set up the file system for updating the crls - echo "setting up the file system for generating the crls..." - echo "" - touch crl/index.txt - touch crl/crlnumber - echo "01" >> crl/crlnumber - touch crl/blank.index.txt - mkdir crl/demoCA - touch crl/demoCA/index.txt - echo "Updating the crls..." echo "" cd crl @@ -205,12 +212,6 @@ function run_renewcerts(){ echo "" rm ../wolfssl.cnf - rm blank.index.txt - rm index.* - rm crlnumber* - rm -r demoCA - echo "Removed ../wolfssl.cnf, blank.index.txt, index.*, crlnumber*, demoCA/" - echo "" } diff --git a/certs/server-revoked-cert.pem b/certs/server-revoked-cert.pem new file mode 100644 index 000000000..c4d4cc68d --- /dev/null +++ b/certs/server-revoked-cert.pem @@ -0,0 +1,172 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 2 (0x2) + Signature Algorithm: sha256WithRSAEncryption + Issuer: C=US, ST=Montana, L=Bozeman, O=Sawtooth, OU=Consulting, CN=www.wolfssl.com/emailAddress=info@wolfssl.com + Validity + Not Before: Jul 22 16:17:13 2015 GMT + Not After : Apr 17 16:17:13 2018 GMT + Subject: C=US, ST=Montana, L=Bozeman, O=wolfSSL, OU=Support, CN=www.wolfssl.com/emailAddress=info@wolfssl.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:b0:14:16:3a:43:dd:e1:50:45:4f:cf:80:b3:dd: + 66:96:c7:e9:f4:dc:de:b6:6b:24:1b:76:48:ac:c6: + 23:a5:a7:e4:05:19:bd:b7:f6:de:fa:ff:ed:5b:3c: + 79:8a:a9:d5:f1:fb:eb:c8:b1:e4:b2:ab:52:72:89: + 93:22:5c:ba:cd:8a:36:2a:2c:d1:40:ec:a8:66:0e: + c3:76:cd:e7:b3:a3:0a:1e:dd:4a:07:82:17:81:ba: + de:57:ce:b6:32:81:c7:bd:11:bb:e9:15:22:4e:e2: + 16:ac:e3:d4:c0:68:88:6c:11:fc:c2:bd:1b:db:1d: + fd:e6:43:c7:1b:33:b8:f4:e5:1b:59:39:12:38:4d: + 2d:9b:64:68:98:fc:8d:72:12:91:f2:24:25:6c:4c: + 4a:48:57:92:00:cc:7e:d8:d4:3d:b8:1d:f2:9e:ea: + b2:23:0f:51:0f:11:41:1c:f5:27:00:1b:08:7a:12: + 3a:05:5b:03:24:fe:b1:7b:20:fa:e4:a8:58:c6:ca: + ce:7f:be:95:01:12:9d:05:e6:39:13:1b:c0:3e:56: + 2e:2b:9f:76:37:de:de:9b:e0:0d:7a:63:0d:a7:22: + 58:db:31:c7:f7:b4:46:5c:ba:b6:4b:48:b1:18:9a: + 68:b3:63:47:fd:af:12:5f:2f:fe:10:cb:58:2b:33: + 68:85 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + D8:09:2B:59:E1:2A:EE:D9:EE:40:AA:9C:AB:F0:5D:28:09:4F:22:BB + X509v3 Authority Key Identifier: + keyid:27:8E:67:11:74:C3:26:1D:3F:ED:33:63:B3:A4:D8:1D:30:E5:E8:D5 + DirName:/C=US/ST=Montana/L=Bozeman/O=Sawtooth/OU=Consulting/CN=www.wolfssl.com/emailAddress=info@wolfssl.com + serial:D9:80:3A:C3:D2:F4:DA:37 + + X509v3 Basic Constraints: + CA:TRUE + Signature Algorithm: sha256WithRSAEncryption + 9a:f1:4a:20:31:d1:06:ac:6f:88:ff:c5:c1:db:85:cf:a1:bc: + 25:6a:04:12:9a:5e:23:31:ab:d1:aa:cb:a2:a7:0e:8f:9a:2d: + f2:84:5b:40:05:6f:fb:9c:88:e8:a7:92:a4:95:aa:34:c3:7a: + 8c:95:6f:a1:30:9a:a7:0c:1c:57:e0:76:ad:4b:53:c1:71:b3: + 8d:11:96:59:0c:c9:2b:92:69:bb:5a:48:55:23:77:dd:26:0b: + 34:ec:25:98:7a:3b:a5:de:ed:0b:d0:05:80:cc:d2:db:9e:3c: + 9e:b2:49:97:38:06:28:48:44:a8:75:88:43:2c:bc:44:44:4f: + 9a:33:08:8f:dc:8a:51:ce:7e:0f:d6:10:95:01:e1:b4:65:0f: + 0a:9f:23:b0:76:e8:10:c4:ac:80:97:e4:93:1a:ce:1a:a4:ea: + 9d:5d:89:93:ca:83:c0:b0:19:eb:c9:58:f7:bf:22:c0:6f:7d: + 4e:1f:44:69:47:b0:d0:3c:07:db:dc:95:7c:cf:32:fc:3b:4d: + 43:42:c0:c4:cc:af:5a:f0:4e:e1:65:15:12:7d:bd:bc:68:72: + 4c:ae:e5:8a:81:21:fb:1a:45:3f:89:f3:2a:a3:c1:e0:49:8b: + c1:2b:9f:fd:99:54:d4:84:5f:ec:2a:8e:ba:06:23:85:3f:a1: + d9:57:c0:ee +-----BEGIN CERTIFICATE----- +MIIEnjCCA4agAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBlDELMAkGA1UEBhMCVVMx +EDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoMCFNh +d3Rvb3RoMRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29sZnNz +bC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMTUwNzIy +MTYxNzEzWhcNMTgwNDE3MTYxNzEzWjCBkDELMAkGA1UEBhMCVVMxEDAOBgNVBAgM +B01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xEDAOBgNVBAoMB3dvbGZTU0wxEDAO +BgNVBAsMB1N1cHBvcnQxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqG +SIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEP +ADCCAQoCggEBALAUFjpD3eFQRU/PgLPdZpbH6fTc3rZrJBt2SKzGI6Wn5AUZvbf2 +3vr/7Vs8eYqp1fH768ix5LKrUnKJkyJcus2KNios0UDsqGYOw3bN57OjCh7dSgeC +F4G63lfOtjKBx70Ru+kVIk7iFqzj1MBoiGwR/MK9G9sd/eZDxxszuPTlG1k5EjhN +LZtkaJj8jXISkfIkJWxMSkhXkgDMftjUPbgd8p7qsiMPUQ8RQRz1JwAbCHoSOgVb +AyT+sXsg+uSoWMbKzn++lQESnQXmORMbwD5WLiufdjfe3pvgDXpjDaciWNsxx/e0 +Rly6tktIsRiaaLNjR/2vEl8v/hDLWCszaIUCAwEAAaOB/DCB+TAdBgNVHQ4EFgQU +2AkrWeEq7tnuQKqcq/BdKAlPIrswgckGA1UdIwSBwTCBvoAUJ45nEXTDJh0/7TNj +s6TYHTDl6NWhgZqkgZcwgZQxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdNb250YW5h +MRAwDgYDVQQHDAdCb3plbWFuMREwDwYDVQQKDAhTYXd0b290aDETMBEGA1UECwwK +Q29uc3VsdGluZzEYMBYGA1UEAwwPd3d3LndvbGZzc2wuY29tMR8wHQYJKoZIhvcN +AQkBFhBpbmZvQHdvbGZzc2wuY29tggkA2YA6w9L02jcwDAYDVR0TBAUwAwEB/zAN +BgkqhkiG9w0BAQsFAAOCAQEAmvFKIDHRBqxviP/FwduFz6G8JWoEEppeIzGr0arL +oqcOj5ot8oRbQAVv+5yI6KeSpJWqNMN6jJVvoTCapwwcV+B2rUtTwXGzjRGWWQzJ +K5Jpu1pIVSN33SYLNOwlmHo7pd7tC9AFgMzS2548nrJJlzgGKEhEqHWIQyy8RERP +mjMIj9yKUc5+D9YQlQHhtGUPCp8jsHboEMSsgJfkkxrOGqTqnV2Jk8qDwLAZ68lY +978iwG99Th9EaUew0DwH29yVfM8y/DtNQ0LAxMyvWvBO4WUVEn29vGhyTK7lioEh ++xpFP4nzKqPB4EmLwSuf/ZlU1IRf7CqOugYjhT+h2VfA7g== +-----END CERTIFICATE----- +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 15672591315981621815 (0xd9803ac3d2f4da37) + Signature Algorithm: sha256WithRSAEncryption + Issuer: C=US, ST=Montana, L=Bozeman, O=Sawtooth, OU=Consulting, CN=www.wolfssl.com/emailAddress=info@wolfssl.com + Validity + Not Before: May 7 18:21:01 2015 GMT + Not After : Jan 31 18:21:01 2018 GMT + Subject: C=US, ST=Montana, L=Bozeman, O=Sawtooth, OU=Consulting, CN=www.wolfssl.com/emailAddress=info@wolfssl.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:bf:0c:ca:2d:14:b2:1e:84:42:5b:cd:38:1f:4a: + f2:4d:75:10:f1:b6:35:9f:df:ca:7d:03:98:d3:ac: + de:03:66:ee:2a:f1:d8:b0:7d:6e:07:54:0b:10:98: + 21:4d:80:cb:12:20:e7:cc:4f:de:45:7d:c9:72:77: + 32:ea:ca:90:bb:69:52:10:03:2f:a8:f3:95:c5:f1: + 8b:62:56:1b:ef:67:6f:a4:10:41:95:ad:0a:9b:e3: + a5:c0:b0:d2:70:76:50:30:5b:a8:e8:08:2c:7c:ed: + a7:a2:7a:8d:38:29:1c:ac:c7:ed:f2:7c:95:b0:95: + 82:7d:49:5c:38:cd:77:25:ef:bd:80:75:53:94:3c: + 3d:ca:63:5b:9f:15:b5:d3:1d:13:2f:19:d1:3c:db: + 76:3a:cc:b8:7d:c9:e5:c2:d7:da:40:6f:d8:21:dc: + 73:1b:42:2d:53:9c:fe:1a:fc:7d:ab:7a:36:3f:98: + de:84:7c:05:67:ce:6a:14:38:87:a9:f1:8c:b5:68: + cb:68:7f:71:20:2b:f5:a0:63:f5:56:2f:a3:26:d2: + b7:6f:b1:5a:17:d7:38:99:08:fe:93:58:6f:fe:c3: + 13:49:08:16:0b:a7:4d:67:00:52:31:67:23:4e:98: + ed:51:45:1d:b9:04:d9:0b:ec:d8:28:b3:4b:bd:ed: + 36:79 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + 27:8E:67:11:74:C3:26:1D:3F:ED:33:63:B3:A4:D8:1D:30:E5:E8:D5 + X509v3 Authority Key Identifier: + keyid:27:8E:67:11:74:C3:26:1D:3F:ED:33:63:B3:A4:D8:1D:30:E5:E8:D5 + DirName:/C=US/ST=Montana/L=Bozeman/O=Sawtooth/OU=Consulting/CN=www.wolfssl.com/emailAddress=info@wolfssl.com + serial:D9:80:3A:C3:D2:F4:DA:37 + + X509v3 Basic Constraints: + CA:TRUE + Signature Algorithm: sha256WithRSAEncryption + 7a:af:44:3b:aa:6f:53:42:b2:33:aa:43:5f:56:30:d3:b9:96: + 0b:9a:55:5a:39:2a:0b:4e:e4:2e:f1:95:66:c9:86:36:82:8d: + 63:7c:4d:a2:ee:48:ba:03:c7:90:d7:a7:c6:74:60:48:5f:31: + a2:f9:5e:3e:c3:82:e1:e5:2f:41:81:83:29:25:79:d1:53:00: + 69:3c:ed:0a:30:3b:41:1d:92:a1:2c:a8:9d:2c:e3:23:87:79: + e0:55:6e:91:a8:50:da:46:2f:c2:20:50:3e:2b:47:97:14:b0: + 7d:04:ba:45:51:d0:6e:e1:5a:a2:4b:84:9c:4d:cd:85:04:f9: + 28:31:82:93:bc:c7:59:49:91:03:e8:df:6a:e4:56:ad:6a:cb: + 1f:0d:37:e4:5e:bd:e7:9f:d5:ec:9d:3c:18:25:9b:f1:2f:50: + 7d:eb:31:cb:f1:63:22:9d:57:fc:f3:84:20:1a:c6:07:87:92: + 26:9e:15:18:59:33:06:dc:fb:b0:b6:76:5d:f1:c1:2f:c8:2f: + 62:9c:c0:d6:de:eb:65:77:f3:5c:a6:c3:88:27:96:75:b4:f4: + 54:cd:ff:2d:21:2e:96:f0:07:73:4b:e9:93:92:90:de:62:d9: + a3:3b:ac:6e:24:5f:27:4a:b3:94:70:ff:30:17:e7:7e:32:8f: + 65:b7:75:58 +-----BEGIN CERTIFICATE----- +MIIEqjCCA5KgAwIBAgIJANmAOsPS9No3MA0GCSqGSIb3DQEBCwUAMIGUMQswCQYD +VQQGEwJVUzEQMA4GA1UECAwHTW9udGFuYTEQMA4GA1UEBwwHQm96ZW1hbjERMA8G +A1UECgwIU2F3dG9vdGgxEzARBgNVBAsMCkNvbnN1bHRpbmcxGDAWBgNVBAMMD3d3 +dy53b2xmc3NsLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTAe +Fw0xNTA1MDcxODIxMDFaFw0xODAxMzExODIxMDFaMIGUMQswCQYDVQQGEwJVUzEQ +MA4GA1UECAwHTW9udGFuYTEQMA4GA1UEBwwHQm96ZW1hbjERMA8GA1UECgwIU2F3 +dG9vdGgxEzARBgNVBAsMCkNvbnN1bHRpbmcxGDAWBgNVBAMMD3d3dy53b2xmc3Ns +LmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTCCASIwDQYJKoZI +hvcNAQEBBQADggEPADCCAQoCggEBAL8Myi0Ush6EQlvNOB9K8k11EPG2NZ/fyn0D +mNOs3gNm7irx2LB9bgdUCxCYIU2AyxIg58xP3kV9yXJ3MurKkLtpUhADL6jzlcXx +i2JWG+9nb6QQQZWtCpvjpcCw0nB2UDBbqOgILHztp6J6jTgpHKzH7fJ8lbCVgn1J +XDjNdyXvvYB1U5Q8PcpjW58VtdMdEy8Z0TzbdjrMuH3J5cLX2kBv2CHccxtCLVOc +/hr8fat6Nj+Y3oR8BWfOahQ4h6nxjLVoy2h/cSAr9aBj9VYvoybSt2+xWhfXOJkI +/pNYb/7DE0kIFgunTWcAUjFnI06Y7VFFHbkE2Qvs2CizS73tNnkCAwEAAaOB/DCB ++TAdBgNVHQ4EFgQUJ45nEXTDJh0/7TNjs6TYHTDl6NUwgckGA1UdIwSBwTCBvoAU +J45nEXTDJh0/7TNjs6TYHTDl6NWhgZqkgZcwgZQxCzAJBgNVBAYTAlVTMRAwDgYD +VQQIDAdNb250YW5hMRAwDgYDVQQHDAdCb3plbWFuMREwDwYDVQQKDAhTYXd0b290 +aDETMBEGA1UECwwKQ29uc3VsdGluZzEYMBYGA1UEAwwPd3d3LndvbGZzc2wuY29t +MR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tggkA2YA6w9L02jcwDAYD +VR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAeq9EO6pvU0KyM6pDX1Yw07mW +C5pVWjkqC07kLvGVZsmGNoKNY3xNou5IugPHkNenxnRgSF8xovlePsOC4eUvQYGD +KSV50VMAaTztCjA7QR2SoSyonSzjI4d54FVukahQ2kYvwiBQPitHlxSwfQS6RVHQ +buFaokuEnE3NhQT5KDGCk7zHWUmRA+jfauRWrWrLHw035F6955/V7J08GCWb8S9Q +fesxy/FjIp1X/POEIBrGB4eSJp4VGFkzBtz7sLZ2XfHBL8gvYpzA1t7rZXfzXKbD +iCeWdbT0VM3/LSEulvAHc0vpk5KQ3mLZozusbiRfJ0qzlHD/MBfnfjKPZbd1WA== +-----END CERTIFICATE----- diff --git a/certs/server-revoked-key.pem b/certs/server-revoked-key.pem new file mode 100644 index 000000000..3cf5640ec --- /dev/null +++ b/certs/server-revoked-key.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpQIBAAKCAQEAsBQWOkPd4VBFT8+As91mlsfp9NzetmskG3ZIrMYjpafkBRm9 +t/be+v/tWzx5iqnV8fvryLHksqtScomTIly6zYo2KizRQOyoZg7Dds3ns6MKHt1K +B4IXgbreV862MoHHvRG76RUiTuIWrOPUwGiIbBH8wr0b2x395kPHGzO49OUbWTkS +OE0tm2RomPyNchKR8iQlbExKSFeSAMx+2NQ9uB3ynuqyIw9RDxFBHPUnABsIehI6 +BVsDJP6xeyD65KhYxsrOf76VARKdBeY5ExvAPlYuK592N97em+ANemMNpyJY2zHH +97RGXLq2S0ixGJpos2NH/a8SXy/+EMtYKzNohQIDAQABAoIBAQCfamBBekZ9gxZt +ztmgfvgt1WutZPdCwzgaoPnlazLE/X9FWuvYjeuN5n44V0VXVLK99q6fsufzF4d6 +6bHLr5b1Fog5oQAHPvysAfvYKU345sj37rPinla3/r7lUuLEUZnMRS0TNy4rqyiK +eW+akEnLRnHIwjxhIwNIId83cpmnJfE7ZV7svZvk6Ctc//prFa/Y2AwkZcM2j2iG +xc4kOXr0Y8DE4FYQEZgdJCoYfVDihcwtVXUGm+ZMBNhLzK/KuSxdjL6ySzdCSE9M +mS4ZJPManR9LOIGsKlFsJrGWnFOm/GOMkzdBSLoEqRogHhYsvn7oDnLMHqPA/gE0 +M85ytBkVAoGBAOO/tTCd94kDfkXar+5+KvcYwQbwnMIbrN0TiIudpaSnE0dBFqU3 +oNC2K+PoGBgwEsEr2ThZCMAbz7NQJYmmNlNlSMNBzeud59F3BqMk3J6k62E0+Fnt +C8OFfZ8V0vbdGehmeArEqHDcRJZBFsrUWb2/9/j4OYpnsozkp6H1pWQrAoGBAMXr +jouX1qXLfKvYEpOKaSf+yjfULjT33ib885Nw2xlRzI6wkjHFsb8DERK36PA3CakU +cdXb923tMMlLoCvSdDd6Qnx1TLRbYaJSFaOLt2we94AvjHtijM6vO7ftd1XvRWer +/Ip9NT9X1NZxP/NTyUL3DgRmXE4L32fr2FFQEJ4PAoGBAKr2QeFY83RatvNhEigJ +dd8/Kcc337SmacEa5KlJkgpjkMkwRvuHIqUJ2zCeDVg63hk7/TebPkJXnjaQt1z4 +9Fbt9Qz93MI+KsLGgqj9Bs/gJQE3biazFt2S25YMH+1IVCZspTgQIBF4h9Py0FU5 +ypPyAwdV7nvDE/lHu76MU7c5AoGBALUxR5ioc0vplMNF1wvXpRmGet7Nk1fOrESJ +QvzyTsNJTbo8EDscv/Mc/Z5jXA++c0uleenNrSGoCgffAk3cJ6U6em+ye3yKREH0 +X/cPy+ZiGzfxT+0NddcqOcPS1HOJz8Jvg43Nvte0sxd3KpK7W//AacbBZzPUTry2 +/5zBbdUlAoGAYglAtoHIC0mQxAe6PXy/QRmgj87fPGsbVFOUwBf8Il2UKpfX9blv +0rHb0kenc/DP7ZHZTgdc5qGgRyg0d3+O7W2rWTv1MiX85rUE03TCcyC2l1+M+iyx +6IdHDjYwa4Kt0nT1JxEMjJxe1uhzJfgYJlcz5Iy4ff0xb8/aH0veedc= +-----END RSA PRIVATE KEY----- diff --git a/configure.ac b/configure.ac index e66b68718..718675ae9 100644 --- a/configure.ac +++ b/configure.ac @@ -1414,7 +1414,7 @@ then fi -# CRL +# CRL AC_ARG_ENABLE([crl], [ --enable-crl Enable CRL (default: disabled)], [ ENABLED_CRL=$enableval ], @@ -1428,7 +1428,6 @@ fi AM_CONDITIONAL([BUILD_CRL], [test "x$ENABLED_CRL" = "xyes"]) - # CRL Monitor AC_ARG_ENABLE([crl-monitor], [ --enable-crl-monitor Enable CRL Monitor (default: disabled)], diff --git a/scripts/crl.test b/scripts/crl.test new file mode 100755 index 000000000..421359520 --- /dev/null +++ b/scripts/crl.test @@ -0,0 +1,95 @@ +#!/bin/bash + +#crl.test + +log_file="scripts/client_result.txt" +success_line="err = -361, CRL Cert revoked" +exit_code=-1 + +crl_port=11113 +#no_pid tells us process was never started if -1 +no_pid=-1 +#server_pid captured on startup, stores the id of the server process +server_pid=$no_pid + +function remove_ready_file() { + if test -e /tmp/wolfssl_server_ready; then + echo -e "removing exisitng server_ready file" + rm /tmp/wolfssl_server_ready + fi +} + +function remove_log_file() { + if test -e $log_file; then + echo -e "removing client log file" + rm $log_file + fi +} + +# trap this function so if user aborts with ^C or other kill signal we still +# get an exit that will in turn clean up the file system +function abort_trap() { + exit_code=-2 #different exit code in case of user interrupt + echo "got abort signal, exiting with $exit_code" + exit $exit_code +} +trap abort_trap INT TERM + + +# trap this function so that if we exit on an error the file system will still +# be restored and the other tests may still pass. Never call this function +# instead use "exit " and this function will run automatically +function restore_file_system() { + echo "in cleanup" + + if [ $server_pid != $no_pid ] + then + echo "killing server" + kill -9 $server_pid + fi + remove_ready_file + remove_log_file +} +trap restore_file_system EXIT + +function run_test() { + echo -e "\nStarting example server for crl test...\n" + + remove_ready_file + + # starts the server on crl_port, -R generates ready file to be used as a + # mutex lock, -c loads the revoked certificate. We capture the processid + # into the variable server_pid + ./examples/server/server -R -p $crl_port -c certs/server-revoked-cert.pem & + server_pid=$! + + while [ ! -s /tmp/wolfssl_server_ready ]; do + echo -e "waiting for server_ready file..." + sleep 0.1 + done + + # starts client on crl_port and redirects output to log_file + ./examples/client/client -p $crl_port &> $log_file + client_result=$? + + if test -e $log_file + then + while read line; + do + if [[ "x$success_line" == "x$line" ]] + then + echo "Successful Revocation!!!!" + fi + done < $log_file + fi +} + + +######### begin program ######### + +# run the test +run_test +exit_code=0 +echo "exiting with $exit_code" +exit $exit_code +########## end program ########## diff --git a/scripts/include.am b/scripts/include.am index 924634aa7..95ddbb4dd 100644 --- a/scripts/include.am +++ b/scripts/include.am @@ -16,4 +16,8 @@ dist_noinst_SCRIPTS+= scripts/google.test endif endif +if BUILD_CRL +dist_noinst_SCRIPTS+= scripts/crl.test +endif + EXTRA_DIST += scripts/testsuite.pcap