WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

fix qt unit test qsslcertificate 

fix trusted peer cert cache
pull/8060/head
Hideki Miyazaki 2024-09-26 12:14:26 +09:00
parent 878cf3afaa
commit fdb889303a
14 changed files with 733 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

161
certs/intermediate/ca_false_intermediate/gentestcert.sh 100755
View File

@ -0,0 +1,161 @@
#!/bin/bash
# Script for generating RSA CA and server certs based on it.
#
SERVER_PEM='test_sign_bynoca_srv.pem'
INTCA_PEM='test_int_not_cacert.pem'
CA_PEM='test_ca.pem'
CURRENT=$(cd $(dirname $0);pwd)
# OpenSSL configuration files
OPENSSL_BASE_CA_CONF='wolfssl_base.conf'
OPENSSL_CA_CONF='wolfssl_ca.conf'
OPENSSL_INTCA_CONF='wolfssl_int_ca.conf'
OPENSSL_SRV_CONF='wolfssl_srv.conf'
# SEt ver
CA_NAME="test_ca"
INTCA_NAME="int_ca"
SRVCERT_NAME="server_ext"
CRT_HOSTNAME="WOLFSSL"
CRT_DN="${CRT_HOSTNAME%% *}"
CRT_ALT_NAME="$(echo $CRT_HOSTNAME | sed -e "s/^/DNS:/" -e "s/ /,DNS:/g")"
CA_HOME=$(cd $(dirname $0);pwd)/pki/$CA_NAME
INT_CA_HOME="$CA_HOME/gen_int/$CRT_DN"
SRV_CRT_HOME="$CA_HOME/gen_srv/$CRT_DN"
Prepare_folder_file(){
mkdir -m 700 pki
# Create folders for CA
mkdir "$CA_HOME"/{,certs,db,gen_srv,gen_int}
mkdir -m 700 "$CA_HOME/private"
# Create folders for Intermediate CA
mkdir "$INT_CA_HOME"
mkdir "$INT_CA_HOME"/{,certs,db}
mkdir -m 700 "$INT_CA_HOME/private"
# Create folders for Server
mkdir "$SRV_CRT_HOME"
mkdir -m 700 "$SRV_CRT_HOME/private"
# Create and populate openssl CA files
touch "$CA_HOME"/db/index
openssl rand -hex 16 > "$CA_HOME"/db/serial
touch "$INT_CA_HOME"/db/index
openssl rand -hex 16 > "$INT_CA_HOME"/db/serial
# Copy openssl config and private key
cp "$OPENSSL_CA_CONF" "$CA_HOME"
cp ./"$CA_NAME".key ./pki/$CA_NAME/private/"$CA_NAME".key
cp "$OPENSSL_INTCA_CONF" "$INT_CA_HOME"
cp ./"$INTCA_NAME".key "$INT_CA_HOME"/private/"$INTCA_NAME".key
cp "$OPENSSL_SRV_CONF" "$SRV_CRT_HOME"
cp ./server.key "$SRV_CRT_HOME"/private/server.key
}
Generate_conf(){
# copy conf from base
cp $OPENSSL_BASE_CA_CONF $OPENSSL_CA_CONF
cp $OPENSSL_BASE_CA_CONF $OPENSSL_INTCA_CONF
# Replace contents
# For CA
sed -i "s/_CA_NAME_/$CA_NAME/" "$OPENSSL_CA_CONF"
sed -i "s/_CERT_NAME_/$INTCA_NAME/" "$OPENSSL_CA_CONF"
sed -i "s/_CA_DEPART_/Development/" "$OPENSSL_CA_CONF"
# For Intermediate CA
sed -i "s/_CA_NAME_/$INTCA_NAME/" "$OPENSSL_INTCA_CONF"
sed -i "s/_CERT_NAME_/$SRVCERT_NAME/" "$OPENSSL_INTCA_CONF"
sed -i "s/_CA_DEPART_/Product_Support/" "$OPENSSL_INTCA_CONF"
}
cleanup_files(){
rm -f wolfssl_ca.conf
rm -f wolfssl_int_ca.conf
rm -rf pki/
}
# clean up
if [ "$1" = "clean" ]; then
echo "Cleaning temp files"
cleanup_files
exit 0
fi
if [ "$1" = "cleanall" ]; then
echo "Cleaning all files"
rm -f ./"$SERVER_PEM"
rm -f ./"$INTCA_PEM"
rm -f ./"$CA_PEM"
cleanup_files
exit 0
fi
# Generate OpenSSL Conf files
Generate_conf
# Prepare folders and files
Prepare_folder_file
##########################################
## Create CA, Intermediate and Server Cert
##########################################
# Generate CA
cd "$CA_HOME"
# Generate CA private key and csr - use config file info
openssl req -new -config "$OPENSSL_CA_CONF" \
-out "$CA_NAME.csr" -key "private/$CA_NAME.key"
# Self-sign CA certificate - use config file info
# Note: Use extension from config "ca_ext" section
openssl ca -selfsign -config "$OPENSSL_CA_CONF" \
-notext -in "$CA_NAME.csr" -out "$CA_NAME.crt" -extensions ca_ext -batch
# Generate Intermediate CA
# cd into Cert generation folder
cd "$INT_CA_HOME"
# Create private key and csr
openssl req -new -config "$OPENSSL_INTCA_CONF" \
-out "$INTCA_NAME.csr" -key "private/$INTCA_NAME.key"
cd "$CA_HOME"
# Sign certificate with CA
openssl ca -config "$OPENSSL_CA_CONF" -notext \
-in "$INT_CA_HOME/$INTCA_NAME.csr" -out "$INT_CA_HOME/$INTCA_NAME.crt" \
-extensions "$INTCA_NAME" -batch
# cd into Cert generation folder
cd "$SRV_CRT_HOME"
# Create private key and csr
openssl req -new -config "$OPENSSL_SRV_CONF" \
-out server.csr -key private/server.key
# cd into intermediate CA home
cd "$CA_HOME/gen_int/WOLFSSL/"
# Sign certificate with CA
openssl ca -config "$OPENSSL_INTCA_CONF" -notext \
-in "$SRV_CRT_HOME/server.csr" -out "$SRV_CRT_HOME/server.crt" \
-extensions server_ext -batch
# cp generate certificates
cd $CURRENT
# CA
openssl x509 -in ./pki/$CA_NAME/$CA_NAME.crt -inform PEM -noout -text > ./pki/$CA_NAME/$CA_NAME.pem
cat ./pki/$CA_NAME/$CA_NAME.crt >> ./pki/$CA_NAME/$CA_NAME.pem
mv ./pki/$CA_NAME/$CA_NAME.pem $CA_PEM
# Intermediate CA
openssl x509 -in $INT_CA_HOME/$INTCA_NAME.crt -inform PEM -noout -text > $INT_CA_HOME/$INTCA_NAME.pem
cat $INT_CA_HOME/$INTCA_NAME.crt >> $INT_CA_HOME/$INTCA_NAME.pem
mv $INT_CA_HOME/$INTCA_NAME.pem $INTCA_PEM
# Server
openssl x509 -in $SRV_CRT_HOME/server.crt -inform PEM -noout -text > $SRV_CRT_HOME/server.pem
cat $SRV_CRT_HOME/server.crt >> $SRV_CRT_HOME/server.pem
mv $SRV_CRT_HOME/server.pem $SERVER_PEM
# clean up
cleanup_files
echo "Completed"

28
certs/intermediate/ca_false_intermediate/int_ca.key 100644
View File

@ -0,0 +1,28 @@
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC4VOnmv/SyU9w8
kloGnogOLqerpp0HNI8/fOU3+CYr4M0mETKuBvI7PkXBV0VLNpupt5MmAgi/H1QX
bejxNiBsQOLo278NgFYPoNm1OdazQ5PeX8+lNFJ7OEq8TBHSriwfJuJRyNaU5Mr+
qxcTDZx4+Mvr8cZbmVoSK8s5S6DT7CJmYjSdV52aB8ZFOj3psoLnEsavPKi5Wk+O
BRvQnWNy0yxjZ9k+Md39gZiEbezfQyy3UzHi7aUc6MrfUDOpmAwmuaE6I/caztFP
HpgZqT7sva20RPvOKtBhuVyxd27h9dzHr+ZD7rc8FohFRg5tVtccDq41/oRvy9CN
1uM99eyHAgMBAAECggEADBW/wq8caIHy/c2iiq3jbE/xZ4w5iKVmLDAQtHCtH/yn
C93eHWa7Lth6/kgDH6vph2D6YWg0u+2z4lgEXlFsIsIbnk9PNqAOrwuepQZbuyOt
Esvj8zLQ+DR37IxthrXV6Aeb7ZIQmhu960sQQjbcPATOacj6IOXsRSYLNtXB1OLu
Xo4UbjLX3uOrAg5uMsi/Z/2s9jy3eDBf8FWmM6fBDsejRl18MzY2Y7bYS1yL3762
4ydB4yHJEEkiFurtjgdX2pscF+ftivYrVqZDUWhM7htFLJz6bS4sRpgjfQegYs4f
RLTuef/+ozFVhpH/HuPrV2jH67T90Z5lHgZ6Nm5qwQKBgQDybcwCKcFFWKac84ln
JDJuqPHyyRgH09cia6C7Y/t1/caSJvJP6KR4c7TuEvIYpc6hSsO1Pd1k6ajFkDdN
IWYfOF3R6K3vR956LPWPdxkYWdONjmwBvVaKozWmxR01RHeGXk+VxFb7PBudAvEu
cGOzDEaTuE5RC1RxNHjZYxZ98QKBgQDCpoljVMR+/7+pwKoIEmw1FmH+DEEgL+so
U1pBcaPU1poBRYKH+1yah7M+eFhTEzV4XbJCjMYeynSCWMSqGXrHwWq0AmA3jhSM
OyDuwboTXVHCkqIuAs/Q/8A9dcyTejsgLuU6mLU1eXzNeWm0/0VjfvPgOziM7SHt
14tip/P59wKBgQDTY74yXKp0h3qw/QLg9wUqzRI8O/FCUgwTrXm4LNSF7EWMB33f
A+L2TR6FQevsZhgpOIIytcEpTz2lF73A+dCMhJ/6e0O/lBGAw1dUQ+uT+i+oDXpM
ggbGWM5dnx965Tq75dzLoSqfY6hIXtpjPgkRhTC9ekaAELsPA0wlcmuYYQKBgDVT
Llw6AsLQCY/Vqj8f3OkGQr44WTcaKZAYladMHJfYWsRyaHocUJg9CMvaaEgKASIC
eS1mJ3iT+isjam03Ib3LrRG3fOh7UgHAyRrfk7xuWlG1nhyAxLH6/o1X0j2sxLni
XwYYg7wslhYsZtsg+79wLhuF3c4twJfJ7vOOE3atAoGBAKiH+9h5SdQ2L4gjM+dl
0dr1fTZpJta+l0FIEiOdQcbGp7ia9G9WglV5HkzyhETG+wTNNuG8GD/jTlg23AVE
vVf2vPq7La3juAT7oOoEkm13vQ//2VUJum4g34dP4V9FpWP5FLiAAu9H8op5P9Hp
LqbpMcrAkbexh41ZEZlmzSx5
-----END PRIVATE KEY-----

28
certs/intermediate/ca_false_intermediate/server.key 100644
View File

@ -0,0 +1,28 @@
-----BEGIN PRIVATE KEY-----
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC6IGIrgaxYzvMi
XZ9GkLfppLP84bdp07YUh8u7MR67YPI/jGoNY1WiyANKjdajY937KO8xlXDMKJUf
8JyJ9PZWHgCBUxt4G/mf4xBljMZANiHNV1WyFHGaVznu2pgbr4ngwyv5oZM/TWVB
K2YdZpyVld8Z3I14RvQV62Rclxbs4uzK6+IDuEGBxfTKpOSr3u0a2qONAjmNACxd
fu+RsdeWumXBQ//UajX6F1DNdj4dvqRp9u5Hw3pJmoBv5puD4OhYcfvNbcG0FtI3
ZKa8sPT++/Rypjx5MnrAtTAhsTXf2UV/xPbFHJhtU9b/NsE4GLd2ExDIRWpSc2V+
ublm1DwnAgMBAAECggEAA92CTGb//kQl9nO9SAjfWOHLvxes6Gy2Hk0HpRaLDdcg
kMNIvIhwkdXXg6fYakI7rOiXtw7kbcj199jWV2MX7ofm+MiSDHeAQprDj2hSAale
IFaM+ArGpS7kjBpMCF8n3NwQwLljRnBEBwtwrnGgFNcs7+uNoI7QqNffmLCmkDrJ
BCK3kXXbjENOuzlddgxsb1mipsXot3uwDaByB8Tl2OtI7ezZvhCraeYZMyRXuq2o
JDPk3FZ9O/mPgULZrqnlvxyJmog2ajgyED4M0mqM29L4YB3MOOz8Wgeksp20VEQJ
lHJtpHK+zcodnT3rXGMj2A1Qu4HHoYEdKvAb8XzuUQKBgQD/nP7ZFOCJGR+q/Wu1
CSLYwO9YM8sn7gMy3R1C1Ps7UKvjVWDv9cjsgId7XnYSQQ/52kV8HbIMqr9EOlwS
pHkHmAbqDNhLY++hhqf9nPHo6e0AiMY4uF/JcfYb8A4PE8/x8Iv5HVjH9WYJFwcL
UNDgm0ULrSbRR7ULtaSpZjyXfwKBgQC6aHlpNIvqa3+KmFmZFI4Xx5EB6fHBy02R
PJKk/B2SVsW+kq0kAwsYdnS6rbkYS8ZmfyJKzvacXpDYvUfFV93s+ewoT5J2a4Ab
WmELmWABqqCwvyT7h2oO+hqLljGNIJxygR0iu9F/fHVYp8G/oHZBeDZEJt+PNR0G
cuG7/6zvWQKBgF/dforl1Iw2evUDFFkSMxp9yYYX7rJsBpEV8np1LEADsmORSsjU
MmXYkndHZxrTge1f2j2BWZx8kT1CcfOf8bBSaQ1wgdJMibvXp7trGCMVUIipw0XU
iEAh2H6D2pH3CT8gyy5Dvl9H/tub4k1xItWKBiwp5WwJ67GXj0jlCgZ7AoGARYmz
wQtZJpnzekBbLD/+weAwuAYNqb2tsgBmtCVY4r58Bhuxez2nZfjKktk7s1SRLqs+
n6mVVb/xSOlTXMrqfvy8nE0S1hpEL/AHQ8xzhCuixkyH/00Ew5GJVYkx8vO3aP/B
XrOx81z6aZgrLtEtTD8L/2CBBWtK6JzymK9IVAECgYAfoFaqRVl0JJlQJttfQtc+
cYyVzZEBzckIH3BriHuNwDpnPOq6iSx5JUp6mh03G3/3mHx4G45tD6GvsK53WIAH
TCrHQv6vRjrA2oay/AlO2x/ElBOkdOVo8x20YGAAhIRAh65rwFrdTREnfUwChwSV
QVeI7CdToIyIiZGhYmmO/g==
-----END PRIVATE KEY-----

28
certs/intermediate/ca_false_intermediate/test_ca.key 100644
View File

@ -0,0 +1,28 @@
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC8QEMO8Y4eCzs2
9n6qVnfSp9tVSxQQUtgkAVgmIJX+5g3MZef9vR2ZOSeXVXibOluq2SBjRlzrorJQ
AXY8r07l1+PNFpf4UQr70yaI1xO8VAlC/zmFqmE5zI8OjqbH4Ck8r6yaM+ZPNM20
VClvkoIAzlGnVe6vziHpNuGnDXXfMtYOFeNmeCFBe87VnOjFCZR+hHtZKmRrkUtL
9w30UJKP9QMNcyBMTnugjcpflM82HObhuxRBkBZoAkFTksbEbNOtVgUiSq6aKt78
6tiZolplL/5DrivplHCuNdyPE3Jhv7r8SLeh7VysXJxLxU1J2oZldzS7uq5uTPl9
9sKCkJzhAgMBAAECggEABxk4Ph3DMWRUhwnL9HHewlGEjoaOeuAY2OC5GXT0mwBD
SHAWS6XgMhkq4kS9j8LnVn2qADxUwCjqJuSrN/YXWEjoBOGDeQBbVOwdIZ9Ule8o
Sz+zBFSMpoCNa2vbI6HTBEAOluD6oAV6dUCQMG4am1usTg5KOhRgiHoCj8lM5s3j
/f0KWkJReql92o//bLDXDjeGGDtIzaWfIKpsW7gwPe6nHsR7n854sbkdRT9b6BMa
EZPg17XD8Dg1ZkvUemShrvgPrGFPMH/JFcvpX1s4/l2kM88xQEL+s45E4IyTT2gh
FlDFC3QXrFI7M7emid3rwXIVEkEIO4Aw4xW34OAVnQKBgQD5cJE/WojeHI3Pyo3L
sMDaWabzWWAAsev5EpDo41BalPDpBig29qO31afkIwIgCQyLNMXn9VqxoxILOg5d
uopBaPWHihmME5qgLp6F6nDeOYril1b1LU1/7G2Ehu9lGYLJd6hdQ6tC/iKMfrIz
fnsHEH/FC4woWmXdFMozujyZNQKBgQDBM7jeBtdIOOZhcwc98y9mQUr+ttlUODC6
BNI2xAcV6ZJg/y0JXby84jM0fP5MuCkGHdNvufpvT68Dn9NRhrOBz8JyhCy5m4Rz
/dIr3JUT5Y0r4+2l5MgfZMlcYCWESNcJPwchSstzAthLhtrgP2ZFGfzzZUZGAMxR
f6sZK7pWfQKBgQCYpp4NAm/eVeUndBNAw4PSXKlCJcENy9TYkdci3vHu7VVdlgoI
UPoyZ8ueXxpO1prZmks/QDTnnx9MxZPDIoS3sO8JqqclxV2Mh9s1oxq9tMNdFjb+
RmI2Vk9TmmxpF6qldtgPc3kcv4APMP4Ha3EJCrzWrtFwZJoQKUfxThkFvQKBgQCI
Scs0XJELMpBZ2AIY0m7ybEbSDfyba5P79SCxX3E8JOuMnxWPEN/uQocqlK3zQso1
tV6M5x3h3c0w+lLgpOwGO6AIlnLScAFsrXXQWSeUxI7kkkH3j78YXkmpb22ntpZy
wFJwSsngFPatuLC4FiE3x9Bnhl6fTTrUlwIEnJMzJQKBgFc5ej1NXuPWDlLKjC7w
0N4YPs5BJRuhoUxyajYC3FxiWvr5bTz7zqc5DAPcH0nGAH/UVWZzWXMUw+Je3dej
chkmVUuKjfTZTZHOBAqJDCNRfZcfzWnzAcXkcmsAHr53UKYnH8XGuHsPVHujQVu/
0Hx7AKuJK48fZeo8LTZufg1l
-----END PRIVATE KEY-----

80
certs/intermediate/ca_false_intermediate/test_ca.pem 100644
View File

@ -0,0 +1,80 @@
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
3b:1d:6e:96:2e:32:85:de:99:5a:63:dd:49:1c:eb:cc
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, ST = Wahington, O = Seattle, OU = Development, CN = www.wolfssl.com
Validity
Not Before: Oct 10 03:44:23 2024 GMT
Not After : Oct 8 03:44:23 2034 GMT
Subject: C = US, ST = Wahington, O = Seattle, OU = Development, CN = www.wolfssl.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:bc:40:43:0e:f1:8e:1e:0b:3b:36:f6:7e:aa:56:
77:d2:a7:db:55:4b:14:10:52:d8:24:01:58:26:20:
95:fe:e6:0d:cc:65:e7:fd:bd:1d:99:39:27:97:55:
78:9b:3a:5b:aa:d9:20:63:46:5c:eb:a2:b2:50:01:
76:3c:af:4e:e5:d7:e3:cd:16:97:f8:51:0a:fb:d3:
26:88:d7:13:bc:54:09:42:ff:39:85:aa:61:39:cc:
8f:0e:8e:a6:c7:e0:29:3c:af:ac:9a:33:e6:4f:34:
cd:b4:54:29:6f:92:82:00:ce:51:a7:55:ee:af:ce:
21:e9:36:e1:a7:0d:75:df:32:d6:0e:15:e3:66:78:
21:41:7b:ce:d5:9c:e8:c5:09:94:7e:84:7b:59:2a:
64:6b:91:4b:4b:f7:0d:f4:50:92:8f:f5:03:0d:73:
20:4c:4e:7b:a0:8d:ca:5f:94:cf:36:1c:e6:e1:bb:
14:41:90:16:68:02:41:53:92:c6:c4:6c:d3:ad:56:
05:22:4a:ae:9a:2a:de:fc:ea:d8:99:a2:5a:65:2f:
fe:43:ae:2b:e9:94:70:ae:35:dc:8f:13:72:61:bf:
ba:fc:48:b7:a1:ed:5c:ac:5c:9c:4b:c5:4d:49:da:
86:65:77:34:bb:ba:ae:6e:4c:f9:7d:f6:c2:82:90:
9c:e1
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature, Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Subject Key Identifier:
49:CB:00:BF:AC:AD:4B:18:2C:DB:69:21:1E:60:EF:00:4E:FC:69:52
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
24:1c:cf:b6:3e:20:6e:99:e8:36:b3:7e:2d:67:0d:cb:b5:1c:
69:ff:5a:bb:0b:2f:52:fd:d6:3e:73:5c:a2:47:8e:8d:1d:fc:
96:e7:e0:ca:e6:b6:3d:af:fa:f1:77:77:e6:2e:67:e6:44:d7:
84:36:ce:dc:cb:3e:3d:bf:bc:8b:48:53:30:fa:bf:43:81:5b:
e0:a3:a7:db:44:c2:29:cd:4c:8a:68:e8:b9:3e:5d:eb:e4:06:
17:6d:de:cf:76:e9:5a:6a:16:27:f8:6f:96:43:8a:4f:65:be:
3a:f2:7e:fd:ad:55:93:ad:ac:00:b4:b5:f3:85:b0:d7:83:6d:
ab:d0:8f:1a:23:36:e1:1f:c4:9d:54:e8:ee:20:cd:b9:da:56:
a7:92:5a:a5:bd:36:c5:a2:ea:ac:06:24:98:e5:32:0a:e0:00:
64:63:9c:7d:01:18:66:5a:7a:b1:d5:b4:24:9b:5e:8a:6b:a0:
25:eb:39:52:cd:12:61:d0:62:6c:19:e7:f5:ae:32:a3:aa:d5:
2f:05:fe:6f:cb:47:20:a0:32:1d:cb:88:96:59:ed:8e:69:dd:
cf:f0:6f:83:85:ff:0a:59:ef:80:94:16:99:a6:35:ee:a7:b8:
d4:e9:3c:4f:56:5b:77:0e:b5:bd:61:21:b9:93:ad:be:2c:55:
9b:bf:01:19
-----BEGIN CERTIFICATE-----
MIIDkjCCAnqgAwIBAgIQOx1uli4yhd6ZWmPdSRzrzDANBgkqhkiG9w0BAQsFADBj
MQswCQYDVQQGEwJVUzESMBAGA1UECAwJV2FoaW5ndG9uMRAwDgYDVQQKDAdTZWF0
dGxlMRQwEgYDVQQLDAtEZXZlbG9wbWVudDEYMBYGA1UEAwwPd3d3LndvbGZzc2wu
Y29tMB4XDTI0MTAxMDAzNDQyM1oXDTM0MTAwODAzNDQyM1owYzELMAkGA1UEBhMC
VVMxEjAQBgNVBAgMCVdhaGluZ3RvbjEQMA4GA1UECgwHU2VhdHRsZTEUMBIGA1UE
CwwLRGV2ZWxvcG1lbnQxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBALxAQw7xjh4LOzb2fqpWd9Kn21VLFBBS
2CQBWCYglf7mDcxl5/29HZk5J5dVeJs6W6rZIGNGXOuislABdjyvTuXX480Wl/hR
CvvTJojXE7xUCUL/OYWqYTnMjw6OpsfgKTyvrJoz5k80zbRUKW+SggDOUadV7q/O
Iek24acNdd8y1g4V42Z4IUF7ztWc6MUJlH6Ee1kqZGuRS0v3DfRQko/1Aw1zIExO
e6CNyl+UzzYc5uG7FEGQFmgCQVOSxsRs061WBSJKrpoq3vzq2JmiWmUv/kOuK+mU
cK413I8TcmG/uvxIt6HtXKxcnEvFTUnahmV3NLu6rm5M+X32woKQnOECAwEAAaNC
MEAwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEnL
AL+srUsYLNtpIR5g7wBO/GlSMA0GCSqGSIb3DQEBCwUAA4IBAQAkHM+2PiBumeg2
s34tZw3LtRxp/1q7Cy9S/dY+c1yiR46NHfyW5+DK5rY9r/rxd3fmLmfmRNeENs7c
yz49v7yLSFMw+r9DgVvgo6fbRMIpzUyKaOi5Pl3r5AYXbd7PdulaahYn+G+WQ4pP
Zb468n79rVWTrawAtLXzhbDXg22r0I8aIzbhH8SdVOjuIM252lanklqlvTbFouqs
BiSY5TIK4ABkY5x9ARhmWnqx1bQkm16Ka6Al6zlSzRJh0GJsGef1rjKjqtUvBf5v
y0cgoDIdy4iWWe2Oad3P8G+Dhf8KWe+AlBaZpjXup7jU6TxPVlt3DrW9YSG5k62+
LFWbvwEZ
-----END CERTIFICATE-----

87
certs/intermediate/ca_false_intermediate/test_int_not_cacert.pem 100644
View File

@ -0,0 +1,87 @@
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
3b:1d:6e:96:2e:32:85:de:99:5a:63:dd:49:1c:eb:cd
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, ST = Wahington, O = Seattle, OU = Development, CN = www.wolfssl.com
Validity
Not Before: Oct 10 03:44:23 2024 GMT
Not After : Oct 8 03:44:23 2034 GMT
Subject: C = US, ST = Wahington, O = Seattle, OU = Product_Support, CN = www.wolfssl.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:b8:54:e9:e6:bf:f4:b2:53:dc:3c:92:5a:06:9e:
88:0e:2e:a7:ab:a6:9d:07:34:8f:3f:7c:e5:37:f8:
26:2b:e0:cd:26:11:32:ae:06:f2:3b:3e:45:c1:57:
45:4b:36:9b:a9:b7:93:26:02:08:bf:1f:54:17:6d:
e8:f1:36:20:6c:40:e2:e8:db:bf:0d:80:56:0f:a0:
d9:b5:39:d6:b3:43:93:de:5f:cf:a5:34:52:7b:38:
4a:bc:4c:11:d2:ae:2c:1f:26:e2:51:c8:d6:94:e4:
ca:fe:ab:17:13:0d:9c:78:f8:cb:eb:f1:c6:5b:99:
5a:12:2b:cb:39:4b:a0:d3:ec:22:66:62:34:9d:57:
9d:9a:07:c6:45:3a:3d:e9:b2:82:e7:12:c6:af:3c:
a8:b9:5a:4f:8e:05:1b:d0:9d:63:72:d3:2c:63:67:
d9:3e:31:dd:fd:81:98:84:6d:ec:df:43:2c:b7:53:
31:e2:ed:a5:1c:e8:ca:df:50:33:a9:98:0c:26:b9:
a1:3a:23:f7:1a:ce:d1:4f:1e:98:19:a9:3e:ec:bd:
ad:b4:44:fb:ce:2a:d0:61:b9:5c:b1:77:6e:e1:f5:
dc:c7:af:e6:43:ee:b7:3c:16:88:45:46:0e:6d:56:
d7:1c:0e:ae:35:fe:84:6f:cb:d0:8d:d6:e3:3d:f5:
ec:87
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:FALSE
Netscape Cert Type:
SSL Server
X509v3 Subject Key Identifier:
D9:9F:9A:2E:FE:80:7F:EB:6C:92:A1:91:60:9B:65:7B:36:2A:F4:35
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication
X509v3 Authority Key Identifier:
49:CB:00:BF:AC:AD:4B:18:2C:DB:69:21:1E:60:EF:00:4E:FC:69:52
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
87:de:e3:93:74:f5:56:64:e7:d9:43:14:20:2e:69:8a:e7:c4:
aa:38:c7:61:49:f5:b6:aa:43:46:c3:a0:b7:91:9f:4d:b9:c1:
94:5c:89:5d:21:cb:b7:16:9b:d2:fb:d1:ea:bf:0d:9d:c5:2e:
f1:1d:4c:a3:14:22:1b:46:7c:f7:9f:cc:02:97:88:73:e0:12:
8e:14:59:ae:ac:39:59:2a:79:65:a7:65:19:8e:a8:d1:00:a3:
62:80:bb:4c:fc:d9:7e:46:e4:cc:fb:0b:81:91:52:8e:1d:7f:
fb:31:51:25:02:7d:5d:a3:c5:d9:9b:1a:94:4e:68:04:56:17:
04:8d:ba:ed:75:76:b2:f9:ef:d8:60:af:7a:6b:24:57:b9:02:
38:83:66:a5:97:dc:af:64:b7:33:3e:43:04:46:7f:79:83:7f:
c7:55:a5:78:1e:9d:b0:75:8c:6b:09:db:5f:0a:e7:0c:61:95:
70:9c:6a:6f:a7:8c:4d:bf:74:dd:ee:55:94:21:ba:63:d4:f1:
fb:af:fc:8f:76:8d:29:e7:0f:6e:ff:54:81:59:ac:10:0a:e5:
65:1c:bb:de:83:85:1c:5a:23:26:9c:e0:c9:50:8c:ac:cd:09:
9c:50:ed:e9:1d:c9:c3:a0:a3:da:00:b1:9b:03:b6:97:cc:eb:
02:a9:e2:41
-----BEGIN CERTIFICATE-----
MIID6DCCAtCgAwIBAgIQOx1uli4yhd6ZWmPdSRzrzTANBgkqhkiG9w0BAQsFADBj
MQswCQYDVQQGEwJVUzESMBAGA1UECAwJV2FoaW5ndG9uMRAwDgYDVQQKDAdTZWF0
dGxlMRQwEgYDVQQLDAtEZXZlbG9wbWVudDEYMBYGA1UEAwwPd3d3LndvbGZzc2wu
Y29tMB4XDTI0MTAxMDAzNDQyM1oXDTM0MTAwODAzNDQyM1owZzELMAkGA1UEBhMC
VVMxEjAQBgNVBAgMCVdhaGluZ3RvbjEQMA4GA1UECgwHU2VhdHRsZTEYMBYGA1UE
CwwPUHJvZHVjdF9TdXBwb3J0MRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20wggEi
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4VOnmv/SyU9w8kloGnogOLqer
pp0HNI8/fOU3+CYr4M0mETKuBvI7PkXBV0VLNpupt5MmAgi/H1QXbejxNiBsQOLo
278NgFYPoNm1OdazQ5PeX8+lNFJ7OEq8TBHSriwfJuJRyNaU5Mr+qxcTDZx4+Mvr
8cZbmVoSK8s5S6DT7CJmYjSdV52aB8ZFOj3psoLnEsavPKi5Wk+OBRvQnWNy0yxj
Z9k+Md39gZiEbezfQyy3UzHi7aUc6MrfUDOpmAwmuaE6I/caztFPHpgZqT7sva20
RPvOKtBhuVyxd27h9dzHr+ZD7rc8FohFRg5tVtccDq41/oRvy9CN1uM99eyHAgMB
AAGjgZMwgZAwDAYDVR0TAQH/BAIwADARBglghkgBhvhCAQEEBAMCBkAwHQYDVR0O
BBYEFNmfmi7+gH/rbJKhkWCbZXs2KvQ1MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUE
FjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwHwYDVR0jBBgwFoAUScsAv6ytSxgs22kh
HmDvAE78aVIwDQYJKoZIhvcNAQELBQADggEBAIfe45N09VZk59lDFCAuaYrnxKo4
x2FJ9baqQ0bDoLeRn025wZRciV0hy7cWm9L70eq/DZ3FLvEdTKMUIhtGfPefzAKX
iHPgEo4UWa6sOVkqeWWnZRmOqNEAo2KAu0z82X5G5Mz7C4GRUo4df/sxUSUCfV2j
xdmbGpROaARWFwSNuu11drL579hgr3prJFe5AjiDZqWX3K9ktzM+QwRGf3mDf8dV
pXgenbB1jGsJ218K5wxhlXCcam+njE2/dN3uVZQhumPU8fuv/I92jSnnD27/VIFZ
rBAK5WUcu96DhRxaIyac4MlQjKzNCZxQ7ekdycOgo9oAsZsDtpfM6wKp4kE=
-----END CERTIFICATE-----

90
certs/intermediate/ca_false_intermediate/test_sign_bynoca_srv.pem 100644
View File

@ -0,0 +1,90 @@
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
df:0d:6c:4b:d6:db:eb:35:5f:41:a1:3a:7a:56:16:93
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, ST = Wahington, O = Seattle, OU = Product_Support, CN = www.wolfssl.com
Validity
Not Before: Oct 10 03:44:23 2024 GMT
Not After : Oct 8 03:44:23 2034 GMT
Subject: C = US, ST = Wahington, O = Seattle, OU = Support, CN = www.wolfssl.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:ba:20:62:2b:81:ac:58:ce:f3:22:5d:9f:46:90:
b7:e9:a4:b3:fc:e1:b7:69:d3:b6:14:87:cb:bb:31:
1e:bb:60:f2:3f:8c:6a:0d:63:55:a2:c8:03:4a:8d:
d6:a3:63:dd:fb:28:ef:31:95:70:cc:28:95:1f:f0:
9c:89:f4:f6:56:1e:00:81:53:1b:78:1b:f9:9f:e3:
10:65:8c:c6:40:36:21:cd:57:55:b2:14:71:9a:57:
39:ee:da:98:1b:af:89:e0:c3:2b:f9:a1:93:3f:4d:
65:41:2b:66:1d:66:9c:95:95:df:19:dc:8d:78:46:
f4:15:eb:64:5c:97:16:ec:e2:ec:ca:eb:e2:03:b8:
41:81:c5:f4:ca:a4:e4:ab:de:ed:1a:da:a3:8d:02:
39:8d:00:2c:5d:7e:ef:91:b1:d7:96:ba:65:c1:43:
ff:d4:6a:35:fa:17:50:cd:76:3e:1d:be:a4:69:f6:
ee:47:c3:7a:49:9a:80:6f:e6:9b:83:e0:e8:58:71:
fb:cd:6d:c1:b4:16:d2:37:64:a6:bc:b0:f4:fe:fb:
f4:72:a6:3c:79:32:7a:c0:b5:30:21:b1:35:df:d9:
45:7f:c4:f6:c5:1c:98:6d:53:d6:ff:36:c1:38:18:
b7:76:13:10:c8:45:6a:52:73:65:7e:b9:b9:66:d4:
3c:27
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:FALSE
Netscape Cert Type:
SSL Server
X509v3 Subject Key Identifier:
10:71:71:98:BD:C2:B2:97:DD:6F:B6:CD:28:EA:23:0E:51:AE:44:34
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication
X509v3 Subject Alternative Name:
DNS:www.wolfssl.com, DNS:wolfssl.jp
X509v3 Authority Key Identifier:
D9:9F:9A:2E:FE:80:7F:EB:6C:92:A1:91:60:9B:65:7B:36:2A:F4:35
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
54:7d:68:93:69:e0:3b:ea:3d:d8:68:ae:b1:97:97:2b:17:5d:
76:7c:0d:0b:70:c5:a4:ec:3c:23:55:a5:bc:d7:dd:42:57:32:
dd:7e:9b:c9:b0:9c:8a:30:de:b6:7c:f9:ff:93:46:29:82:cf:
8a:05:bb:b2:64:cf:22:db:15:bd:8e:56:14:2e:a4:5c:44:c2:
3c:9d:3c:a0:dd:bd:a1:40:df:c3:8d:ff:71:73:6f:88:d6:57:
f2:c8:6c:20:18:ad:48:b8:2f:4c:41:ba:2a:f6:36:21:97:1b:
ee:7c:83:a8:43:80:08:8b:ac:a8:ed:df:dd:9c:7a:64:c9:6a:
16:09:3b:57:1d:fc:f3:db:82:8f:c1:0e:e3:48:b7:d1:e8:19:
1c:90:f0:b8:e6:ad:17:c5:82:b3:d5:15:bf:a3:c0:a6:4b:a7:
97:98:86:93:4b:b0:1b:0e:62:61:16:d0:68:c2:e2:22:8a:f5:
89:c7:bd:9d:38:65:0f:df:b1:38:9a:c7:e9:df:76:f4:5a:9f:
f5:2b:17:aa:9b:32:37:0a:72:93:8a:db:1d:b2:81:ff:0e:12:
b6:0a:31:46:7e:86:5e:0b:03:0d:7f:d0:bf:60:f2:f5:93:94:
f2:78:4f:80:34:b9:f7:66:ee:d6:b9:80:ca:bb:52:d0:e2:2f:
1a:ac:99:a7
-----BEGIN CERTIFICATE-----
MIIEDTCCAvWgAwIBAgIRAN8NbEvW2+s1X0GhOnpWFpMwDQYJKoZIhvcNAQELBQAw
ZzELMAkGA1UEBhMCVVMxEjAQBgNVBAgMCVdhaGluZ3RvbjEQMA4GA1UECgwHU2Vh
dHRsZTEYMBYGA1UECwwPUHJvZHVjdF9TdXBwb3J0MRgwFgYDVQQDDA93d3cud29s
ZnNzbC5jb20wHhcNMjQxMDEwMDM0NDIzWhcNMzQxMDA4MDM0NDIzWjBfMQswCQYD
VQQGEwJVUzESMBAGA1UECAwJV2FoaW5ndG9uMRAwDgYDVQQKDAdTZWF0dGxlMRAw
DgYDVQQLDAdTdXBwb3J0MRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20wggEiMA0G
CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6IGIrgaxYzvMiXZ9GkLfppLP84bdp
07YUh8u7MR67YPI/jGoNY1WiyANKjdajY937KO8xlXDMKJUf8JyJ9PZWHgCBUxt4
G/mf4xBljMZANiHNV1WyFHGaVznu2pgbr4ngwyv5oZM/TWVBK2YdZpyVld8Z3I14
RvQV62Rclxbs4uzK6+IDuEGBxfTKpOSr3u0a2qONAjmNACxdfu+RsdeWumXBQ//U
ajX6F1DNdj4dvqRp9u5Hw3pJmoBv5puD4OhYcfvNbcG0FtI3ZKa8sPT++/Rypjx5
MnrAtTAhsTXf2UV/xPbFHJhtU9b/NsE4GLd2ExDIRWpSc2V+ublm1DwnAgMBAAGj
gbswgbgwDAYDVR0TAQH/BAIwADARBglghkgBhvhCAQEEBAMCBkAwHQYDVR0OBBYE
FBBxcZi9wrKX3W+2zSjqIw5RrkQ0MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAU
BggrBgEFBQcDAgYIKwYBBQUHAwEwJgYDVR0RBB8wHYIPd3d3LndvbGZzc2wuY29t
ggp3b2xmc3NsLmpwMB8GA1UdIwQYMBaAFNmfmi7+gH/rbJKhkWCbZXs2KvQ1MA0G
CSqGSIb3DQEBCwUAA4IBAQBUfWiTaeA76j3YaK6xl5crF112fA0LcMWk7DwjVaW8
191CVzLdfpvJsJyKMN62fPn/k0Ypgs+KBbuyZM8i2xW9jlYULqRcRMI8nTyg3b2h
QN/Djf9xc2+I1lfyyGwgGK1IuC9MQboq9jYhlxvufIOoQ4AIi6yo7d/dnHpkyWoW
CTtXHfzz24KPwQ7jSLfR6BkckPC45q0XxYKz1RW/o8CmS6eXmIaTS7AbDmJhFtBo
wuIiivWJx72dOGUP37E4msfp33b0Wp/1KxeqmzI3CnKTitsdsoH/DhK2CjFGfoZe
CwMNf9C/YPL1k5TyeE+ANLn3Zu7WuYDKu1LQ4i8arJmn
-----END CERTIFICATE-----

72
certs/intermediate/ca_false_intermediate/wolfssl_base.conf 100644
View File

@ -0,0 +1,72 @@
# OpenSSL config: certificate authority (CA)
# Default value
[ default ]
ca_name = _CA_NAME_ # CA name
home = . # Top dir
default_ca = ca # Default CA section
name_opt = utf8,esc_ctrl,multiline,lname,align # Display UTF-8 characters
# Certificate request
[ req ]
default_bits = 2048 # RSA key size
encrypt_key = yes # Encrypted CA private key
default_md = sha256 # Message Digest to use
utf8 = yes # Input is UTF-8
string_mask = utf8only # Emit UTF-8 strings
prompt = no # Don't prompt for DN
distinguished_name = ca_dn # DN section
req_extensions = ca_ext # Desired extensions
# CA certificate info
[ ca_dn ]
countryName = "US" # CA cert info
stateOrProvinceName = "Wahington" # CA cert info
organizationName = "Seattle" # CA cert info
localityName = "WOLFSSL" # CA cert info
organizationalUnitName = "_CA_DEPART_" # CA cert info
commonName = "www.wolfssl.com" # Replaced during build proceduce
# Extensions for signing CA certificate
[ ca_ext ]
keyUsage = critical,keyCertSign,cRLSign,digitalSignature # Limit key usage
basicConstraints = critical,CA:true # Dont allow intermediary CA
subjectKeyIdentifier = hash # SKI validation
# CA operational settings
[ ca ]
default_ca = _CA_NAME_ # Default CA section
# CA Section
[ _CA_NAME_ ]
certificate = $home/$ca_name.crt # CA certificate
private_key = $home/private/$ca_name.key # CA private key
new_certs_dir = $home/certs # Generated certificates
database = $home/db/index # Index file of generated crt
serial = $home/db/serial # Serial number file
RANDFILE = $home/ca/private/random # Random file
unique_subject = no # Dont require unique subject
default_days = 3650 # How long to certify for
default_md = sha256 # Message Digest to use
policy = match_pol # Default naming policy
email_in_dn = no # Dont add email to cert DN
copy_extensions = copy # Copy extensions from CSR (!)
x509_extensions = server_ext # Default cert extensions
# Matching policy
# Enforce that all cert issued by the CA match criteria
# Useful for CA used internally with limited scope
[ match_pol ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
# Extension used when signing server cert
[ _CERT_NAME_ ]
basicConstraints = critical,CA:false # Dont allow intermediary CA
nsCertType = server # Certificate type
subjectKeyIdentifier = hash # SKI validation
keyUsage = critical,digitalSignature,keyEncipherment # Define key usage
extendedKeyUsage = clientAuth,serverAuth # key usage continued

26
certs/intermediate/ca_false_intermediate/wolfssl_srv.conf 100644
View File

@ -0,0 +1,26 @@
############################################
# OpenSSL config: generate server key/csr
############################################
# Certificate request
[ req ]
default_bits = 2048 # RSA key size
encrypt_key = no # Encrypted CA private key
default_md = sha256 # Message Digest to use
utf8 = yes # Input is UTF-8
string_mask = utf8only # Emit UTF-8 strings
prompt = no # Don't prompt for DN
distinguished_name = server_dn # DN section
req_extensions = server_ext # Desired extensions
# Server certificate info
[ server_dn ]
countryName = "US"
stateOrProvinceName = "Wahington"
organizationName = "Seattle"
localityName = "wolfSSL"
organizationalUnitName = "Support"
commonName = "www.wolfssl.com"
# Extension - add alternative name to cert
[ server_ext ]
subjectAltName = "DNS:www.wolfssl.com,DNS:wolfssl.jp"

10
certs/intermediate/include.am
View File

@ -40,4 +40,12 @@ EXTRA_DIST += \
certs/intermediate/server-int-cert.der \ certs/intermediate/server-int-cert.der \
certs/intermediate/server-int-cert.pem \ certs/intermediate/server-int-cert.pem \
certs/intermediate/server-int-ecc-cert.der \ certs/intermediate/server-int-ecc-cert.der \
certs/intermediate/server-int-ecc-cert.pem certs/intermediate/ca_false_intermediate/gentestcert.sh \
certs/intermediate/ca_false_intermediate/int_ca.key \
certs/intermediate/ca_false_intermediate/server.key \
certs/intermediate/ca_false_intermediate/test_ca.key \
certs/intermediate/ca_false_intermediate/test_ca.pem \
certs/intermediate/ca_false_intermediate/test_int_not_cacert.pem \
certs/intermediate/ca_false_intermediate/test_sign_bynoca_srv.pem \
certs/intermediate/ca_false_intermediate/wolfssl_base.conf \
certs/intermediate/ca_false_intermediate/wolfssl_srv.conf

18
src/ssl.c
View File

@ -5032,8 +5032,13 @@ int AlreadyTrustedPeer(WOLFSSL_CERT_MANAGER* cm, DecodedCert* cert)
return ret; return ret;
tp = cm->tpTable[row]; tp = cm->tpTable[row];
while (tp) { while (tp) {
if (XMEMCMP(cert->subjectHash, tp->subjectNameHash, if ((XMEMCMP(cert->subjectHash, tp->subjectNameHash,
SIGNER_DIGEST_SIZE) == 0) SIGNER_DIGEST_SIZE) == 0)
#ifndef WOLFSSL_NO_ISSUERHASH_TDPEER
&& (XMEMCMP(cert->issuerHash, tp->issuerHash,
SIGNER_DIGEST_SIZE) == 0)
#endif
)
ret = 1; ret = 1;
#ifndef NO_SKID #ifndef NO_SKID
if (cert->extSubjKeyIdSet) { if (cert->extSubjKeyIdSet) {
@ -5073,8 +5078,13 @@ TrustedPeerCert* GetTrustedPeer(void* vp, DecodedCert* cert)
tp = cm->tpTable[row]; tp = cm->tpTable[row];
while (tp) { while (tp) {
if (XMEMCMP(cert->subjectHash, tp->subjectNameHash, if ((XMEMCMP(cert->subjectHash, tp->subjectNameHash,
SIGNER_DIGEST_SIZE) == 0) SIGNER_DIGEST_SIZE) == 0)
#ifndef WOLFSSL_NO_ISSUERHASH_TDPEER
&& (XMEMCMP(cert->issuerHash, tp->issuerHash,
SIGNER_DIGEST_SIZE) == 0)
#endif
)
ret = tp; ret = tp;
#ifndef NO_SKID #ifndef NO_SKID
if (cert->extSubjKeyIdSet) { if (cert->extSubjKeyIdSet) {
@ -5340,6 +5350,10 @@ int AddTrustedPeer(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int verify)
#endif #endif
XMEMCPY(peerCert->subjectNameHash, cert->subjectHash, XMEMCPY(peerCert->subjectNameHash, cert->subjectHash,
SIGNER_DIGEST_SIZE); SIGNER_DIGEST_SIZE);
#ifndef WOLFSSL_NO_ISSUERHASH_TDPEER
XMEMCPY(peerCert->issuerHash, cert->issuerHash,
SIGNER_DIGEST_SIZE);
#endif
/* If Key Usage not set, all uses valid. */ /* If Key Usage not set, all uses valid. */
peerCert->next = NULL; peerCert->next = NULL;
cert->subjectCN = 0; cert->subjectCN = 0;

40
src/x509_str.c
View File

@ -239,17 +239,24 @@ int GetX509Error(int e)
} }
} }
static void SetupStoreCtxError_ex(WOLFSSL_X509_STORE_CTX* ctx, int ret,
int depth)
{
int error = GetX509Error(ret);
wolfSSL_X509_STORE_CTX_set_error(ctx, error);
wolfSSL_X509_STORE_CTX_set_error_depth(ctx, depth);
}
static void SetupStoreCtxError(WOLFSSL_X509_STORE_CTX* ctx, int ret) static void SetupStoreCtxError(WOLFSSL_X509_STORE_CTX* ctx, int ret)
{ {
int depth = 0; int depth = 0;
int error = GetX509Error(ret);
/* Set error depth */ /* Set error depth */
if (ctx->chain) if (ctx->chain)
depth = (int)ctx->chain->num; depth = (int)ctx->chain->num;
wolfSSL_X509_STORE_CTX_set_error(ctx, error); SetupStoreCtxError_ex(ctx, ret, depth);
wolfSSL_X509_STORE_CTX_set_error_depth(ctx, depth);
} }
static int X509StoreVerifyCert(WOLFSSL_X509_STORE_CTX* ctx) static int X509StoreVerifyCert(WOLFSSL_X509_STORE_CTX* ctx)
@ -265,7 +272,8 @@ static int X509StoreVerifyCert(WOLFSSL_X509_STORE_CTX* ctx)
SetupStoreCtxError(ctx, ret); SetupStoreCtxError(ctx, ret);
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT) #if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
if (ctx->store->verify_cb) if (ctx->store->verify_cb)
ret = ctx->store->verify_cb(ret >= 0 ? 1 : 0, ctx) == 1 ? 0 : ret; ret = ctx->store->verify_cb(ret >= 0 ? 1 : 0, ctx) == 1 ?
WOLFSSL_SUCCESS : ret;
#endif #endif
#ifndef NO_ASN_TIME #ifndef NO_ASN_TIME
@ -290,7 +298,7 @@ static int X509StoreVerifyCert(WOLFSSL_X509_STORE_CTX* ctx)
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT) #if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
if (ctx->store->verify_cb) if (ctx->store->verify_cb)
ret = ctx->store->verify_cb(ret >= 0 ? 1 : 0, ret = ctx->store->verify_cb(ret >= 0 ? 1 : 0,
ctx) == 1 ? 0 : -1; ctx) == 1 ? WOLFSSL_SUCCESS : -1;
#endif #endif
} }
#endif #endif
@ -393,21 +401,37 @@ int wolfSSL_X509_verify_cert(WOLFSSL_X509_STORE_CTX* ctx)
/* We found our issuer in the non-trusted cert list, add it /* We found our issuer in the non-trusted cert list, add it
* to the CM and verify the current cert against it */ * to the CM and verify the current cert against it */
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
/* OpenSSL doesn't allow the cert as CA if it is not CA:TRUE for
* intermediate certs.
*/
if (!issuer->isCa) {
/* error depth is current depth + 1 */
SetupStoreCtxError_ex(ctx, X509_V_ERR_INVALID_CA,
(ctx->chain) ? (int)(ctx->chain->num + 1) : 1);
if (ctx->store->verify_cb) {
ret = ctx->store->verify_cb(0, ctx);
if (ret != WOLFSSL_SUCCESS) {
goto exit;
}
}
} else {
#endif
ret = X509StoreAddCa(ctx->store, issuer, ret = X509StoreAddCa(ctx->store, issuer,
WOLFSSL_TEMP_CA); WOLFSSL_TEMP_CA);
if (ret != WOLFSSL_SUCCESS) { if (ret != WOLFSSL_SUCCESS) {
goto exit; goto exit;
} }
added = 1; added = 1;
ret = X509StoreVerifyCert(ctx); ret = X509StoreVerifyCert(ctx);
if (ret != WOLFSSL_SUCCESS) { if (ret != WOLFSSL_SUCCESS) {
goto exit; goto exit;
} }
/* Add it to the current chain and look at the issuer cert next */ /* Add it to the current chain and look at the issuer cert next */
wolfSSL_sk_X509_push(ctx->chain, ctx->current_cert); wolfSSL_sk_X509_push(ctx->chain, ctx->current_cert);
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
}
#endif
ctx->current_cert = issuer; ctx->current_cert = issuer;
} }
else if (ret == WC_NO_ERR_TRACE(WOLFSSL_FAILURE)) { else if (ret == WC_NO_ERR_TRACE(WOLFSSL_FAILURE)) {

72
tests/api.c
View File

@ -60335,6 +60335,75 @@ static int test_X509_STORE_untrusted_load_cert_to_stack(const char* filename,
return EXPECT_RESULT(); return EXPECT_RESULT();
} }
#if defined(OPENSSL_ALL)
static int last_errcode;
static int last_errdepth;
static int X509Callback(int ok, X509_STORE_CTX *ctx)
{
if (!ok) {
last_errcode = X509_STORE_CTX_get_error(ctx);
last_errdepth = X509_STORE_CTX_get_error_depth(ctx);
}
/* Always return OK to allow verification to continue.*/
return 1;
}
static int test_X509_STORE_InvalidCa(void)
{
EXPECT_DECLS;
const char* filename = "./certs/intermediate/ca_false_intermediate/"
"test_int_not_cacert.pem";
const char* srvfile = "./certs/intermediate/ca_false_intermediate/"
"test_sign_bynoca_srv.pem";
X509_STORE_CTX* ctx = NULL;
X509_STORE* str = NULL;
XFILE fp = XBADFILE;
X509* cert = NULL;
STACK_OF(X509)* untrusted = NULL;
last_errcode = 0;
last_errdepth = 0;
ExpectTrue((fp = XFOPEN(srvfile, "rb"))
!= XBADFILE);
ExpectNotNull(cert = PEM_read_X509(fp, 0, 0, 0 ));
if (fp != XBADFILE) {
XFCLOSE(fp);
fp = XBADFILE;
}
ExpectNotNull(str = X509_STORE_new());
ExpectNotNull(ctx = X509_STORE_CTX_new());
ExpectNotNull(untrusted = sk_X509_new_null());
/* create cert chain stack */
ExpectIntEQ(test_X509_STORE_untrusted_load_cert_to_stack(filename,
untrusted), TEST_SUCCESS);
X509_STORE_set_verify_cb(str, X509Callback);
ExpectIntEQ(X509_STORE_load_locations(str,
"./certs/intermediate/ca_false_intermediate/test_ca.pem",
NULL), 1);
ExpectIntEQ(X509_STORE_CTX_init(ctx, str, cert, untrusted), 1);
ExpectIntEQ(X509_verify_cert(ctx), 1);
ExpectIntEQ(last_errcode, X509_V_ERR_INVALID_CA);
X509_free(cert);
X509_STORE_free(str);
X509_STORE_CTX_free(ctx);
sk_X509_pop_free(untrusted, NULL);
return EXPECT_RESULT();
}
#endif /* OPENSSL_ALL */
static int test_X509_STORE_untrusted_certs(const char** filenames, int ret, static int test_X509_STORE_untrusted_certs(const char** filenames, int ret,
int err, int loadCA) int err, int loadCA)
{ {
@ -98041,6 +98110,9 @@ TEST_CASE testCases[] = {
TEST_DECL(test_wolfSSL_X509_STORE_CTX), TEST_DECL(test_wolfSSL_X509_STORE_CTX),
TEST_DECL(test_wolfSSL_X509_STORE_CTX_ex), TEST_DECL(test_wolfSSL_X509_STORE_CTX_ex),
TEST_DECL(test_X509_STORE_untrusted), TEST_DECL(test_X509_STORE_untrusted),
#if defined(OPENSSL_ALL)
TEST_DECL(test_X509_STORE_InvalidCa),
#endif
TEST_DECL(test_wolfSSL_X509_STORE_CTX_trusted_stack_cleanup), TEST_DECL(test_wolfSSL_X509_STORE_CTX_trusted_stack_cleanup),
TEST_DECL(test_wolfSSL_X509_STORE_CTX_get_issuer), TEST_DECL(test_wolfSSL_X509_STORE_CTX_get_issuer),
TEST_DECL(test_wolfSSL_X509_STORE_set_flags), TEST_DECL(test_wolfSSL_X509_STORE_set_flags),

4
wolfssl/wolfcrypt/asn.h
View File

@ -2206,6 +2206,10 @@ struct TrustedPeerCert {
#endif /* IGNORE_NAME_CONSTRAINTS */ #endif /* IGNORE_NAME_CONSTRAINTS */
byte subjectNameHash[SIGNER_DIGEST_SIZE]; byte subjectNameHash[SIGNER_DIGEST_SIZE];
/* sha hash of names in certificate */ /* sha hash of names in certificate */
#ifndef WOLFSSL_NO_ISSUERHASH_TDPEER
byte issuerHash[SIGNER_DIGEST_SIZE];
/* sha hash of issuer name in certificate */
#endif
#ifndef NO_SKID #ifndef NO_SKID
byte subjectKeyIdHash[SIGNER_DIGEST_SIZE]; byte subjectKeyIdHash[SIGNER_DIGEST_SIZE];
/* sha hash of SKID in certificate */ /* sha hash of SKID in certificate */