blob: 3022aae7c3f31573f3f92a81d08e502e87fa451a [file] [log] [blame]
Manuel Pégourié-Gonnard4be34492014-11-19 12:52:43 +01001This documents the X.509 CAs, certificates, and CRLS used for testing.
2
3Certification authorities
4-------------------------
5
6There are two main CAs for use as trusted roots:
7- test-ca.crt aka "C=NL, O=PolarSSL, CN=PolarSSL Test CA"
8 uses a RSA-2048 key
9- test-ca2*.crt aka "C=NL, O=PolarSSL, CN=Polarssl Test EC CA"
10 uses an EC key with NIST P-384 (aka secp384r1)
11 variants used to test the keyUsage extension
12The files test-ca_cat12 and test-ca_cat21 contain them concatenated both ways.
13
14Two intermediate CAs are signed by them:
15- test-int-ca.crt "C=NL, O=PolarSSL, CN=PolarSSL Test Intermediate CA"
16 uses RSA-4096, signed by test-ca2
17- test-int-ca2.crt "C=NL, O=PolarSSL, CN=PolarSSL Test Intermediate EC CA"
18 uses an EC key with NIST P-256, signed by test-ca
19
20Finally, other CAs for specific purposes:
21- enco-ca-prstr.pem: has its CN encoded as a printable string, but child cert
22 enco-cert-utf8str.pem has its issuer's CN encoded as a UTF-8 string.
23- test-ca-v1.crt: v1 "CA", signs
24 server1-v1.crt: v1 "intermediate CA", signs
25 server2-v1*.crt: EE cert (without of with chain in same file)
26
27End-entity certificates
28-----------------------
29
30Short information fields:
31
32- name or pattern
33- issuing CA: 1 -> test-ca.crt
34 2 -> test-ca2.crt
35 I1 -> test-int-ca.crt
36 I2 -> test-int-ca2.crt
37 O -> other
38- key type: R -> RSA, E -> EC
39- C -> there is a CRL revoking this cert (see below)
40- L -> CN=localhost (useful for local test servers)
41- P1, P2 if the file include parent (resp. parent + grandparent)
42- free-form comments
43
44List of certificates:
45
46- cert_example_multi*.crt: 1/O R: subjectAltName
47- cert_example_wildcard.crt: 1 R: wildcard in subject's CN
48- cert_md*.crt, cert_sha*.crt: 1 R: signature hash
49- cert_v1_with_ext.crt: 1 R: v1 with extensions (illegal)
50- cli2.crt: 2 E: basic
51- enco-cert-utf8str.pem: see enco-ca-prstr.pem above
52- server1*.crt: 1* R C*: misc *(server1-v1 see test-ca-v1.crt above)
53 *CRL for: .cert_type.crt, .crt, .key_usage.crt, .v1.crt
54- server2-v1*.crt: O R: see test-ca-v1.crt above
55- server2*.crt: 1 R L: misc
56- server3.crt: 1 E L: EC cert signed by RSA CA
57- server4.crt: 2 R L: RSA cert signed by EC CA
58- server5*.crt: 2* E L: misc *(except server5-selfsigned)
59 -sha*: hashes
60 -eku*: extendeKeyUsage (cli/srv = www client/server, cs = codesign, etc)
61 -ku*: keyUsage (ds = signatures, ke/ka = key exchange/agreement)
62- server6-ss-child.crt: O E: "child" of non-CA server5-selfsigned
63- server6.crt, server6.pem: 2 E L C: revoked
64- server7*.crt: I1 E L P1*: EC signed by RSA signed by EC *(except 7.crt)
65 *_space: with PEM error(s)
66- server8*.crt: I2 R L: RSA signed by EC signed by RSA (P1 for _int-ca2)
67- server9*.crt: 1 R C* L P1*: signed using RSASSA-PSS
68 *CRL for: 9.crt, -badsign, -with-ca (P1)
69
70Certificate revocation lists
71----------------------------
72
73Signing CA in parentheses (same meaning as certificates).
74
75- crl-ec-sha*: (2) server6.crt
76- crl-future.pem: (2) server6.crt + unkown
77- crl-rsa-pss-*.pem: (1) server9{,badsign,with-ca}.crt + cert_sha384.crt + unknown
78- crl.pem, crl_expired.pem: (1) server1{,.cert_type,.key_usage,.v1}.crt + unknown
79- crl_md*.pem: crl_sha*.pem: (1) same as crl.pem
80- crt_cat_*.pem: (1+2) concatenations in various orders:
81 ec = crl-ec-sha256.pem, ecfut = crl-future.pem
82 rsa = crl.pem, rsabadpem = same with pem error, rsaexp = crl_expired.pem
83
84Note: crl_future would revoke server9 and cert_sha384.crt if signed by CA 1
85 crl-rsa-pss* would revoke server6.crt if signed by CA 2