mirror of
https://boringssl.googlesource.com/boringssl
synced 2026-07-21 14:43:51 +00:00
David Benjamin
945f4a5d8f
Change-Id: If581dcdf063c3b45237a424f0dade7a033151893 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/83267 Commit-Queue: Adam Langley <agl@google.com> Auto-Submit: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
1.2 KiB
1.2 KiB
This test verifies behavior when a certificate has an unparsable/unsupported SPKI. It should be handled equivalently to a certificate with a failed signature verification: further processing should be shortcircuited. The certificate chain has 2 problems:
- leaf is expired
- intermediate has invalid SPKI
The verification should fail with only the SPKI parsing error, since further processing should be short-circuited.
Instructions for generating test certificate chain:
cp ../expired-target/chain.pem .- extract intermediate cert to
int-pre.pem print_certificates --output=der2ascii int-pre.pem > int.derascii- edit
int.derasciito replace SPKI OID with something invalid - extract the TBSCertificate part of the certificate to
int.tbs.derasciiascii2der < int.tbs.derascii > int.tbs.der - generate new signature:
openssl pkeyutl -sign -rawin -in int.tbs.der -digest sha256 -inkey ../expired-target/keys/Root.key -out - | xxd -p -c 0 - replace the signature hex in
int.derascii ascii2der < int.derascii > int.derprint_certificates --output=openssl_text,pem int.der > int.pem- replace the intermediate certificate in
chain.pemwith the contents ofint.pem