blob: ce687d1c70de2af06d6f6f33e651b1049f2d92ea [file] [log] [blame]
Paul Bakker4593aea2009-02-09 22:32:35 +00001/*
2 * SSL certificate functionality tests
3 *
Paul Bakker77b385e2009-07-28 17:23:11 +00004 * Copyright (C) 2006-2009, Paul Bakker <polarssl_maintainer at polarssl.org>
5 * All rights reserved.
Paul Bakker4593aea2009-02-09 22:32:35 +00006 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License along
18 * with this program; if not, write to the Free Software Foundation, Inc.,
19 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
20 */
21
22#ifndef _CRT_SECURE_NO_DEPRECATE
23#define _CRT_SECURE_NO_DEPRECATE 1
24#endif
25
26#include <string.h>
27#include <stdio.h>
28
29#include "polarssl/certs.h"
30#include "polarssl/x509.h"
31
Paul Bakkerd98030e2009-05-02 15:13:40 +000032#if defined _MSC_VER && !defined snprintf
33#define snprintf _snprintf
34#endif
35
Paul Bakker40ea7de2009-05-03 10:18:48 +000036#define MAX_CLIENT_CERTS 8
Paul Bakker4593aea2009-02-09 22:32:35 +000037
38char *client_certificates[MAX_CLIENT_CERTS] =
39{
Paul Bakkerd98030e2009-05-02 15:13:40 +000040 "client1.crt",
41 "client2.crt",
Paul Bakker40ea7de2009-05-03 10:18:48 +000042 "server1.crt",
43 "server2.crt",
Paul Bakkerd98030e2009-05-02 15:13:40 +000044 "cert_sha224.crt",
45 "cert_sha256.crt",
46 "cert_sha384.crt",
47 "cert_sha512.crt"
Paul Bakker4593aea2009-02-09 22:32:35 +000048};
49
Paul Bakkera1d3e5f2009-03-28 17:30:26 +000050char *client_private_keys[MAX_CLIENT_CERTS] =
51{
Paul Bakkerd98030e2009-05-02 15:13:40 +000052 "client1.key",
53 "client2.key",
Paul Bakker40ea7de2009-05-03 10:18:48 +000054 "server1.key",
55 "server2.key",
Paul Bakkerd98030e2009-05-02 15:13:40 +000056 "cert_sha224.key",
57 "cert_sha256.key",
58 "cert_sha384.key",
59 "cert_sha512.key"
Paul Bakkera1d3e5f2009-03-28 17:30:26 +000060};
61
Paul Bakker4593aea2009-02-09 22:32:35 +000062int main( void )
63{
64 int ret, i;
Paul Bakkerd98030e2009-05-02 15:13:40 +000065 x509_cert cacert;
66 x509_crl crl;
67 char buf[10240];
68
69 memset( &cacert, 0, sizeof( x509_cert ) );
70 memset( &crl, 0, sizeof( x509_crl ) );
Paul Bakker4593aea2009-02-09 22:32:35 +000071
72 /*
73 * 1.1. Load the trusted CA
74 */
75 printf( "\n . Loading the CA root certificate ..." );
76 fflush( stdout );
77
Paul Bakker4593aea2009-02-09 22:32:35 +000078 /*
79 * Alternatively, you may load the CA certificates from a .pem or
80 * .crt file by calling x509parse_crtfile( &cacert, "myca.crt" ).
81 */
82 ret = x509parse_crtfile( &cacert, "ssl/test-ca/test-ca.crt" );
83 if( ret != 0 )
84 {
85 printf( " failed\n ! x509parse_crtfile returned %d\n\n", ret );
86 goto exit;
87 }
88
89 printf( " ok\n" );
90
Paul Bakker40ea7de2009-05-03 10:18:48 +000091 x509parse_cert_info( buf, 1024, "CRT: ", &cacert );
92 printf("%s\n", buf );
93
Paul Bakkerd98030e2009-05-02 15:13:40 +000094 /*
95 * 1.2. Load the CRL
96 */
97 printf( " . Loading the CRL ..." );
98 fflush( stdout );
99
100 ret = x509parse_crlfile( &crl, "ssl/test-ca/crl.pem" );
101 if( ret != 0 )
102 {
103 printf( " failed\n ! x509parse_crlfile returned %d\n\n", ret );
104 goto exit;
105 }
106
107 printf( " ok\n" );
108
109 x509parse_crl_info( buf, 1024, "CRL: ", &crl );
110 printf("%s\n", buf );
111
Paul Bakker4593aea2009-02-09 22:32:35 +0000112 for( i = 0; i < MAX_CLIENT_CERTS; i++ )
113 {
114 /*
Paul Bakkerd98030e2009-05-02 15:13:40 +0000115 * 1.3. Load own certificate
Paul Bakker4593aea2009-02-09 22:32:35 +0000116 */
Paul Bakkerd98030e2009-05-02 15:13:40 +0000117 char name[512];
118 int flags;
119 x509_cert clicert;
120 rsa_context rsa;
Paul Bakker4593aea2009-02-09 22:32:35 +0000121
122 memset( &clicert, 0, sizeof( x509_cert ) );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000123 memset( &rsa, 0, sizeof( rsa_context ) );
124
125 snprintf(name, 512, "ssl/test-ca/%s", client_certificates[i]);
126
127 printf( " . Loading the client certificate %s...", name );
128 fflush( stdout );
Paul Bakker4593aea2009-02-09 22:32:35 +0000129
130 ret = x509parse_crtfile( &clicert, name );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000131 if( ret != 0 )
132 {
133 printf( " failed\n ! x509parse_crt returned %d\n\n", ret );
134 goto exit;
135 }
Paul Bakker4593aea2009-02-09 22:32:35 +0000136
Paul Bakkerd98030e2009-05-02 15:13:40 +0000137 printf( " ok\n" );
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000138
139 /*
Paul Bakkerd98030e2009-05-02 15:13:40 +0000140 * 1.4. Verify certificate validity with CA certificate
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000141 */
Paul Bakkerd98030e2009-05-02 15:13:40 +0000142 printf( " . Verify the client certificate with CA certificate..." );
143 fflush( stdout );
144
Paul Bakker40ea7de2009-05-03 10:18:48 +0000145 ret = x509parse_verify( &clicert, &cacert, &crl, NULL, &flags );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000146 if( ret != 0 )
147 {
Paul Bakker40ea7de2009-05-03 10:18:48 +0000148 if( ret == POLARSSL_ERR_X509_CERT_VERIFY_FAILED )
149 {
Paul Bakker860d36b2009-05-03 17:29:56 +0000150 if( flags & BADCERT_CN_MISMATCH )
151 printf( " CN_MISMATCH " );
152 if( flags & BADCERT_EXPIRED )
153 printf( " EXPIRED " );
154 if( flags & BADCERT_REVOKED )
Paul Bakker40ea7de2009-05-03 10:18:48 +0000155 printf( " REVOKED " );
Paul Bakker860d36b2009-05-03 17:29:56 +0000156 if( flags & BADCERT_NOT_TRUSTED )
157 printf( " NOT_TRUSTED " );
158 if( flags & BADCRL_NOT_TRUSTED )
159 printf( " CRL_NOT_TRUSTED " );
160 if( flags & BADCRL_EXPIRED )
161 printf( " CRL_EXPIRED " );
Paul Bakker40ea7de2009-05-03 10:18:48 +0000162 } else {
163 printf( " failed\n ! x509parse_verify returned %d\n\n", ret );
164 goto exit;
165 }
Paul Bakkerd98030e2009-05-02 15:13:40 +0000166 }
167
168 printf( " ok\n" );
169
170 /*
171 * 1.5. Load own private key
172 */
173 snprintf(name, 512, "ssl/test-ca/%s", client_private_keys[i]);
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000174
175 printf( " . Loading the client private key %s...", name );
176 fflush( stdout );
177
Paul Bakkerd98030e2009-05-02 15:13:40 +0000178 ret = x509parse_keyfile( &rsa, name, NULL );
179 if( ret != 0 )
180 {
181 printf( " failed\n ! x509parse_key returned %d\n\n", ret );
182 goto exit;
183 }
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000184
Paul Bakkerd98030e2009-05-02 15:13:40 +0000185 printf( " ok\n" );
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000186
Paul Bakkerd98030e2009-05-02 15:13:40 +0000187 /*
188 * 1.5. Verify certificate validity with private key
189 */
190 printf( " . Verify the client certificate with private key..." );
191 fflush( stdout );
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000192
Paul Bakkerd98030e2009-05-02 15:13:40 +0000193 ret = mpi_cmp_mpi(&rsa.N, &clicert.rsa.N);
194 if( ret != 0 )
195 {
196 printf( " failed\n ! mpi_cmp_mpi for N returned %d\n\n", ret );
197 goto exit;
198 }
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000199
Paul Bakkerd98030e2009-05-02 15:13:40 +0000200 ret = mpi_cmp_mpi(&rsa.E, &clicert.rsa.E);
201 if( ret != 0 )
202 {
203 printf( " failed\n ! mpi_cmp_mpi for E returned %d\n\n", ret );
204 goto exit;
205 }
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000206
Paul Bakkerd98030e2009-05-02 15:13:40 +0000207 ret = rsa_check_privkey( &rsa );
208 if( ret != 0 )
209 {
210 printf( " failed\n ! rsa_check_privkey returned %d\n\n", ret );
211 goto exit;
212 }
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000213
Paul Bakkerd98030e2009-05-02 15:13:40 +0000214 printf( " ok\n" );
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000215
Paul Bakkerd98030e2009-05-02 15:13:40 +0000216 x509_free( &clicert );
217 rsa_free( &rsa );
Paul Bakker4593aea2009-02-09 22:32:35 +0000218 }
219
220exit:
Paul Bakker4593aea2009-02-09 22:32:35 +0000221 x509_free( &cacert );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000222 x509_crl_free( &crl );
Paul Bakker4593aea2009-02-09 22:32:35 +0000223
224#ifdef WIN32
225 printf( " + Press Enter to exit this program.\n" );
226 fflush( stdout ); getchar();
227#endif
228
229 return( ret );
230}