Manuel Pégourié-Gonnard | 4be3449 | 2014-11-19 12:52:43 +0100 | [diff] [blame^] | 1 | This documents the X.509 CAs, certificates, and CRLS used for testing. |
| 2 | |
| 3 | Certification authorities |
| 4 | ------------------------- |
| 5 | |
| 6 | There are two main CAs for use as trusted roots: |
| 7 | - test-ca.crt aka "C=NL, O=PolarSSL, CN=PolarSSL Test CA" |
| 8 | uses a RSA-2048 key |
| 9 | - test-ca2*.crt aka "C=NL, O=PolarSSL, CN=Polarssl Test EC CA" |
| 10 | uses an EC key with NIST P-384 (aka secp384r1) |
| 11 | variants used to test the keyUsage extension |
| 12 | The files test-ca_cat12 and test-ca_cat21 contain them concatenated both ways. |
| 13 | |
| 14 | Two intermediate CAs are signed by them: |
| 15 | - test-int-ca.crt "C=NL, O=PolarSSL, CN=PolarSSL Test Intermediate CA" |
| 16 | uses RSA-4096, signed by test-ca2 |
| 17 | - test-int-ca2.crt "C=NL, O=PolarSSL, CN=PolarSSL Test Intermediate EC CA" |
| 18 | uses an EC key with NIST P-256, signed by test-ca |
| 19 | |
| 20 | Finally, other CAs for specific purposes: |
| 21 | - enco-ca-prstr.pem: has its CN encoded as a printable string, but child cert |
| 22 | enco-cert-utf8str.pem has its issuer's CN encoded as a UTF-8 string. |
| 23 | - test-ca-v1.crt: v1 "CA", signs |
| 24 | server1-v1.crt: v1 "intermediate CA", signs |
| 25 | server2-v1*.crt: EE cert (without of with chain in same file) |
| 26 | |
| 27 | End-entity certificates |
| 28 | ----------------------- |
| 29 | |
| 30 | Short information fields: |
| 31 | |
| 32 | - name or pattern |
| 33 | - issuing CA: 1 -> test-ca.crt |
| 34 | 2 -> test-ca2.crt |
| 35 | I1 -> test-int-ca.crt |
| 36 | I2 -> test-int-ca2.crt |
| 37 | O -> other |
| 38 | - key type: R -> RSA, E -> EC |
| 39 | - C -> there is a CRL revoking this cert (see below) |
| 40 | - L -> CN=localhost (useful for local test servers) |
| 41 | - P1, P2 if the file include parent (resp. parent + grandparent) |
| 42 | - free-form comments |
| 43 | |
| 44 | List of certificates: |
| 45 | |
| 46 | - cert_example_multi*.crt: 1/O R: subjectAltName |
| 47 | - cert_example_wildcard.crt: 1 R: wildcard in subject's CN |
| 48 | - cert_md*.crt, cert_sha*.crt: 1 R: signature hash |
| 49 | - cert_v1_with_ext.crt: 1 R: v1 with extensions (illegal) |
| 50 | - cli2.crt: 2 E: basic |
| 51 | - enco-cert-utf8str.pem: see enco-ca-prstr.pem above |
| 52 | - server1*.crt: 1* R C*: misc *(server1-v1 see test-ca-v1.crt above) |
| 53 | *CRL for: .cert_type.crt, .crt, .key_usage.crt, .v1.crt |
| 54 | - server2-v1*.crt: O R: see test-ca-v1.crt above |
| 55 | - server2*.crt: 1 R L: misc |
| 56 | - server3.crt: 1 E L: EC cert signed by RSA CA |
| 57 | - server4.crt: 2 R L: RSA cert signed by EC CA |
| 58 | - server5*.crt: 2* E L: misc *(except server5-selfsigned) |
| 59 | -sha*: hashes |
| 60 | -eku*: extendeKeyUsage (cli/srv = www client/server, cs = codesign, etc) |
| 61 | -ku*: keyUsage (ds = signatures, ke/ka = key exchange/agreement) |
| 62 | - server6-ss-child.crt: O E: "child" of non-CA server5-selfsigned |
| 63 | - server6.crt, server6.pem: 2 E L C: revoked |
| 64 | - server7*.crt: I1 E L P1*: EC signed by RSA signed by EC *(except 7.crt) |
| 65 | *_space: with PEM error(s) |
| 66 | - server8*.crt: I2 R L: RSA signed by EC signed by RSA (P1 for _int-ca2) |
| 67 | - server9*.crt: 1 R C* L P1*: signed using RSASSA-PSS |
| 68 | *CRL for: 9.crt, -badsign, -with-ca (P1) |
| 69 | |
| 70 | Certificate revocation lists |
| 71 | ---------------------------- |
| 72 | |
| 73 | Signing CA in parentheses (same meaning as certificates). |
| 74 | |
| 75 | - crl-ec-sha*: (2) server6.crt |
| 76 | - crl-future.pem: (2) server6.crt + unkown |
| 77 | - crl-rsa-pss-*.pem: (1) server9{,badsign,with-ca}.crt + cert_sha384.crt + unknown |
| 78 | - crl.pem, crl_expired.pem: (1) server1{,.cert_type,.key_usage,.v1}.crt + unknown |
| 79 | - crl_md*.pem: crl_sha*.pem: (1) same as crl.pem |
| 80 | - crt_cat_*.pem: (1+2) concatenations in various orders: |
| 81 | ec = crl-ec-sha256.pem, ecfut = crl-future.pem |
| 82 | rsa = crl.pem, rsabadpem = same with pem error, rsaexp = crl_expired.pem |
| 83 | |
| 84 | Note: crl_future would revoke server9 and cert_sha384.crt if signed by CA 1 |
| 85 | crl-rsa-pss* would revoke server6.crt if signed by CA 2 |