README 3.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687
  1. This directory contains test data for verifying certificate chains.
  2. Tests are grouped into directories that contain the keys, python to generate
  3. chains, and test expectations. "DIR" is used as a generic placeholder below to
  4. identify such a directory.
  5. ===============================
  6. DIR/generate-chains.py
  7. ===============================
  8. Python script that generates one or more ".pem" file containing a sequence of
  9. CERTIFICATE blocks. In most cases it will generate a single chain called
  10. "chain.pem".
  11. ===============================
  12. DIR/keys/*.key
  13. ===============================
  14. The keys used (as well as generated) by the .py file generate-chains.py. The
  15. private keys shouldn't be needed to run the tests, however are useful when
  16. re-generating the test data to have stable results (at least for signature
  17. types which are deterministic, like RSASSA PKCS#1 which is used by most of the
  18. certificates data).
  19. ===============================
  20. DIR/*.pem
  21. ===============================
  22. A sequence of CERTIFICATE blocks that was created by the generate-chains.py
  23. script. (Although in a few cases there are manually created .pem files that
  24. lack a generator script).
  25. ===============================
  26. DIR/*.test
  27. ===============================
  28. A sequence of key-value pairs that identify the inputs to certificate
  29. verification, as well as the expected outputs. The format is essentially a
  30. newline separated sequence of key/value pairs:
  31. key: value\n
  32. All keys must be specified by tests, although they can be in any order.
  33. The possible keys are:
  34. "chain" - The value is a file path (relative to the test file) to a .pem
  35. containing the CERTIFICATE chain.
  36. "last_cert_trust" - The value identifies the trustedness of the last
  37. certificate in the chain (i.e. whether it is a trust anchor or not). This
  38. maps to the CertificateTrustType enum. Possible values are:
  39. "TRUSTED_ANCHOR"
  40. "TRUSTED_ANCHOR_WITH_EXPIRATION"
  41. "TRUSTED_ANCHOR_WITH_CONSTRAINTS"
  42. "UNSPECIFIED"
  43. "DISTRUSTED"
  44. "utc_time" - A string encoding for the generalized time at which verification
  45. should be done. Example "150302120000Z"
  46. "key_purpose" - The expected EKU to use when verifying. Maps to
  47. KeyPurpose enum. Possible values are:
  48. "ANY_EKU"
  49. "SERVER_AUTH"
  50. "CLIENT_AUTH"
  51. "errors" - This has special parsing rules: it is interpreted as the
  52. final key in the file. All lines after "errors:\n" are read as being the
  53. error string (this allows embedding newlines in it).
  54. Additionally, it is possible to add python-style comments by starting a line
  55. with "#".
  56. ===============================
  57. pkits_errors/*.txt
  58. ===============================
  59. These files contain the expected errors for PKITS tests
  60. (third_party/nist-pkits). The file name correspond so the PKITS tests number.
  61. They are baselined specifically for VerifyCertificateChain().
  62. ===============================
  63. generate-all.sh
  64. ===============================
  65. Runs all of the generate-chains.py scripts and cleans up the temp files
  66. afterwards.