certificate-validation.spec.js 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317
  1. /*
  2. * Copyright 2018 Scytl Secure Electronic Voting SA
  3. *
  4. * All rights reserved
  5. *
  6. * See our extended copyright notice in *file 'Copyright.txt' which is part of this source code package
  7. */
  8. /* jshint node:true */
  9. 'use strict';
  10. var certificate = require('../lib/index');
  11. describe('The certificate module should be able to ...', function() {
  12. var rootCertificatePem_ =
  13. '-----BEGIN CERTIFICATE-----MIIEKjCCAxKgAwIBAgIQQtWFdPN4NAvUIWyyJyUlbTANBgkqhkiG9w0BAQsFADBUMRAwDgYDVQQDDAdSb290IENOMRYwFAYDVQQLDA1Sb290IE9yZyBVbml0MREwDwYDVQQKDAhSb290IE9yZzEVMBMGA1UEBhMMUm9vdCBDb3VudHJ5MB4XDTE0MDYxODEwMjMyOFoXDTE1MDYxODEwMjMyOFowVDEQMA4GA1UEAwwHUm9vdCBDTjEWMBQGA1UECwwNUm9vdCBPcmcgVW5pdDERMA8GA1UECgwIUm9vdCBPcmcxFTATBgNVBAYTDFJvb3QgQ291bnRyeTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ4AidkWId1zr4IZgItjE9uv38eB8fIGJGEts2n/XNh/EJ7NYZyBzvKSJR83v7LVJjc4pup5crWyS0B5lQ7uuD3/XZ9QpQFtnGiqlKOKH45zsw3ekaHEAco07L2dZznBuQTGLTlhrmvkCFRa8b8WYC+k90oUPvSd/9S4kA1Jlo9JDKHLer0SbjZCcVRXoLSBKmGWE0xSNfmNuZNONDRbtHvSA8A10AOtxKii9w464MXYzmPil7uM1Og1HC+FXCmkzLNfqQ31Om0jra3nLmrCpBJjRPX7svVnoxajRqpazVQnmJjjpzV7yNLwnR9W8OPwqanXcbxmTkrXMxfLxiVXDFUCAwEAAaOB9zCB9DAPBgNVHRMBAf8EBTADAQH/MDUGCCsGAQUFBwEBAQH/BCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AudGhhd3RlLmNvbTA0BgNVHR8BAf8EKjAoMCagJKAihiBodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9wY2EzLmNybDArBgNVHREBAf8EITAfpB0wGzEZMBcGA1UEAwwQUHJpdmF0ZUxhYmVsMy0xNTAOBgNVHQ8BAf8EBAMCAQYwNwYDVR0lAQH/BC0wKwYIKwYBBQUHAwEGCCsGAQUFBwMCBgpghkgBhvhFAQgBBglghkgBhvhCBAEwDQYJKoZIhvcNAQELBQADggEBADmtmjApZAXIkGLaZCdkRnhel53BtEdQnG990Oo/tBBboqy2ipum9ByTj3hNWJB3zuPN77rkrek9rbookNcCgVWhHtTk1lUpUK6ZohDsZh8k0MqIhkz+X+HiWGRsEOptjsCaknyWcWb4aXAevMAQMPm/ktkpQ8AOxAq+gtieewWQZP3kGPhBBCfn8TGjdrn9+ymf8EIbAUFXQ8m+oWeNlrdWhqzRXwQbj4EDds1kZdTo0nCYUdH+XEBF9nMyhAxSQWzCKQQTRFWv1dr3dKapzfgrdH8wEgvptiBYCY62O5+3DxiNK/VWquHz6S5GqIwkmSPDPMUU/qK3SNG3xIL1U1k=-----END CERTIFICATE-----';
  14. var leafCertificatePem_ =
  15. '-----BEGIN CERTIFICATE-----MIIEMzCCAxugAwIBAgIQRbaPaToIM+VS/d6etgYZ4jANBgkqhkiG9w0BAQsFADBUMRAwDgYDVQQDDAdSb290IENOMRYwFAYDVQQLDA1Sb290IE9yZyBVbml0MREwDwYDVQQKDAhSb290IE9yZzEVMBMGA1UEBhMMUm9vdCBDb3VudHJ5MB4XDTE0MDYxODEwMjMyOFoXDTE1MDYxODEwMjMyOFowYDETMBEGA1UEAwwKU3ViamVjdCBDTjEZMBcGA1UECwwQU3ViamVjdCBPcmcgVW5pdDEUMBIGA1UECgwLU3ViamVjdCBPcmcxGDAWBgNVBAYTD1N1YmplY3QgQ291bnRyeTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIJcqWVOOW539qKZ0SPmOdVaqLgabw0998SAfzrW8Cs8FaYvia4wRbX5N97RPbf3UkbO/QiveB0YQlnDoi2tqlj643mfUgYhMknK4SL0WVQReNcwYMEDbkbyQrCpgKpWWhTSQ2cRD+K3qZpQZ9Qn1RZn615jiqsD+Re5fWbbnL3kc7H5hdclTxZFvEzLgd2KjIsspsqh5UvLowrLuSPLaYD28LsXTDmPeHzYUl62JGPCLl9YNc3av2dY5bjmkf1KiuFKZ27iWh/xdFYAzYloenEw9AxRhJNG+9IucFOENy/0ul2UEb0rgA6Am4cASrhS+aVuZ/OuaC1W+Ut8LlXVmhsCAwEAAaOB9DCB8TAMBgNVHRMBAf8EAjAAMDUGCCsGAQUFBwEBAQH/BCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AudGhhd3RlLmNvbTA0BgNVHR8BAf8EKjAoMCagJKAihiBodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9wY2EzLmNybDArBgNVHREBAf8EITAfpB0wGzEZMBcGA1UEAwwQUHJpdmF0ZUxhYmVsMy0xNTAOBgNVHQ8BAf8EBAMCBsAwNwYDVR0lAQH/BC0wKwYIKwYBBQUHAwEGCCsGAQUFBwMCBgpghkgBhvhFAQgBBglghkgBhvhCBAEwDQYJKoZIhvcNAQELBQADggEBAAWZDJD6bg4ohHewszrAbL2tdUNxhrwCgNaHUhwNK43kiLGH0U9innhL1i0jP1VHNkL1G/+ZCo1qzh/Usji/jtlurfAWtrXku6VRF9NP+itKOY5jJ91Ijkc7t4dgoeJq6iMHn6JbDKIQ88r/Ikd0GdF04o5Qjqq1HlUVmqyIOHeHFla4i4tOxTyUBj34eE1No/xmaKYV1QtR1dqSHblR7OagEo7Dd3fXp7iSrKrXaN0Ef/6zeF3zjU5SMKcUcU9d3CbhS/CrGb+UGlqTXgzPXQWESH9AqBNl67+HF3mYktDQOZYPT5WRO5IKSko2cy9pP9UCsLk4oU3xyOxacWDpk1k=-----END CERTIFICATE-----';
  16. var issuerValidationData_ = {
  17. issuer: {
  18. commonName: 'Root CN',
  19. organizationalUnit: 'Root Org Unit',
  20. organization: 'Root Org',
  21. country: 'Root Country'
  22. }
  23. };
  24. var subjectValidationData_ = {
  25. subject: {
  26. commonName: 'Subject CN',
  27. organizationalUnit: 'Subject Org Unit',
  28. organization: 'Subject Org',
  29. country: 'Subject Country'
  30. }
  31. };
  32. var certificateValidator_;
  33. beforeAll(function() {
  34. certificateValidator_ = certificate.newService().newValidator();
  35. });
  36. describe('create a certificate service that should be able to ..', function() {
  37. describe('create a CertficateValidator object that should be able to', function() {
  38. it('successfully validate a certificate that contains the expected issuer DN.',
  39. function() {
  40. var validations = certificateValidator_.validate(
  41. leafCertificatePem_, issuerValidationData_);
  42. expect(validations.length).toBe(0);
  43. });
  44. it('usuccessfully validate a certificate that contains an unexpected issuer common name',
  45. function() {
  46. var validationData = clone(issuerValidationData_);
  47. validationData.issuer.commonName = 'Different Root CN';
  48. var validations = certificateValidator_.validate(
  49. leafCertificatePem_, validationData);
  50. expect(validations).toEqual(['ISSUER']);
  51. });
  52. it('usuccessfully validate a certificate that contains an unexpected issuer organizational unit',
  53. function() {
  54. var validationData = clone(issuerValidationData_);
  55. validationData.issuer.organizationalUnit = 'Different Root Org Unit';
  56. var validations = certificateValidator_.validate(
  57. leafCertificatePem_, validationData);
  58. expect(validations).toEqual(['ISSUER']);
  59. });
  60. it('usuccessfully validate a certificate that contains an unexpected issuer organization',
  61. function() {
  62. var validationData = clone(issuerValidationData_);
  63. validationData.issuer.organization = 'Different Root Org';
  64. var validations = certificateValidator_.validate(
  65. leafCertificatePem_, validationData);
  66. expect(validations).toEqual(['ISSUER']);
  67. });
  68. it('usuccessfully validate a certificate that contains an unexpected issuer country',
  69. function() {
  70. var validationData = clone(issuerValidationData_);
  71. validationData.issuer.country = 'Different Root Country';
  72. var validations = certificateValidator_.validate(
  73. leafCertificatePem_, validationData);
  74. expect(validations).toEqual(['ISSUER']);
  75. });
  76. it('successfully validate a certificate that contains the expected subject DN.',
  77. function() {
  78. var validations = certificateValidator_.validate(
  79. leafCertificatePem_, subjectValidationData_);
  80. expect(validations.length).toBe(0);
  81. });
  82. it('usuccessfully validate a certificate that contains an unexpected subject common name',
  83. function() {
  84. var validationData = clone(subjectValidationData_);
  85. validationData.subject.commonName = 'Different Subject CN';
  86. var validations = certificateValidator_.validate(
  87. leafCertificatePem_, validationData);
  88. expect(validations).toEqual(['SUBJECT']);
  89. });
  90. it('usuccessfully validate a certificate that contains an unexpected subject organizational unit',
  91. function() {
  92. var validationData = clone(subjectValidationData_);
  93. validationData.subject.organizationalUnit =
  94. 'Different Subject Org Unit';
  95. var validations = certificateValidator_.validate(
  96. leafCertificatePem_, validationData);
  97. expect(validations).toEqual(['SUBJECT']);
  98. });
  99. it('usuccessfully validate a certificate that contains an unexpected subject organization',
  100. function() {
  101. var validationData = clone(subjectValidationData_);
  102. validationData.subject.organization = 'Different Subject Org';
  103. var validations = certificateValidator_.validate(
  104. leafCertificatePem_, validationData);
  105. expect(validations).toEqual(['SUBJECT']);
  106. });
  107. it('usuccessfully validate a certificate that contains an unexpected subject country',
  108. function() {
  109. var validationData = clone(subjectValidationData_);
  110. validationData.subject.country = 'Different Subject Country';
  111. var validations = certificateValidator_.validate(
  112. leafCertificatePem_, validationData);
  113. expect(validations).toEqual(['SUBJECT']);
  114. });
  115. it('successfully validate a certificate when the validation time is within the certificate validity period',
  116. function() {
  117. var validationData = {time: '2014-12-25\'T\'00:00:00Z'};
  118. var validations = certificateValidator_.validate(
  119. leafCertificatePem_, validationData);
  120. expect(validations.length).toBe(0);
  121. });
  122. it('successfully validate a certificate when the validation time is exactly the certificate starting time of validity',
  123. function() {
  124. var validationData = {time: '2014-06-18\'T\'10:23:28Z'};
  125. var validations = certificateValidator_.validate(
  126. leafCertificatePem_, validationData);
  127. expect(validations.length).toBe(0);
  128. });
  129. it('successfully validate a certificate when the validation time is exactly the certificate ending time of validity',
  130. function() {
  131. var validationData = {time: '2015-06-18\'T\'10:23:28Z'};
  132. var validations = certificateValidator_.validate(
  133. leafCertificatePem_, validationData);
  134. expect(validations.length).toBe(0);
  135. });
  136. it('usuccessfully validate a certificate when the validation time is before the certificate starting time of validity',
  137. function() {
  138. var validationData = {time: '2014-05-18\'T\'10:23:28Z'};
  139. var validations = certificateValidator_.validate(
  140. leafCertificatePem_, validationData);
  141. expect(validations).toEqual(['TIME']);
  142. });
  143. it('usuccessfully validate a certificate when the validation time is after the certificate ending time of validity',
  144. function() {
  145. var validationData = {time: '2015-07-18\'T\'10:23:28Z'};
  146. var validations = certificateValidator_.validate(
  147. leafCertificatePem_, validationData);
  148. expect(validations).toEqual(['TIME']);
  149. });
  150. it('usuccessfully validate a certificate when the validation time is specified as a single character',
  151. function() {
  152. var validationData = {time: 'a'};
  153. var validations = certificateValidator_.validate(
  154. leafCertificatePem_, validationData);
  155. expect(validations).toEqual(['TIME']);
  156. });
  157. it('usuccessfully validate a certificate when the validation time is specified as three characters',
  158. function() {
  159. var validationData = {time: 'abc'};
  160. var validations = certificateValidator_.validate(
  161. leafCertificatePem_, validationData);
  162. expect(validations).toEqual(['TIME']);
  163. });
  164. it('usuccessfully validate a certificate whose validation time is specified as twenty characters',
  165. function() {
  166. var validationData = {time: 'aaaaaaaaaaaaaaaaaaaa'};
  167. var validations = certificateValidator_.validate(
  168. leafCertificatePem_, validationData);
  169. expect(validations).toEqual(['TIME']);
  170. });
  171. it('usuccessfully validate a leaf certificate when the validation key type is specified as CA',
  172. function() {
  173. var validationData = {keyType: 'CA'};
  174. var validations = certificateValidator_.validate(
  175. leafCertificatePem_, validationData);
  176. expect(validations).toEqual(['KEY_TYPE']);
  177. });
  178. it('successfully validate a certificate of key type Sign when the validation key type is specified as Sign',
  179. function() {
  180. var validationData = {keyType: 'Sign'};
  181. var validations = certificateValidator_.validate(
  182. leafCertificatePem_, validationData);
  183. expect(validations.length).toBe(0);
  184. });
  185. it('successfully validate a certificate of key type CA when the validation key type is specified as CA',
  186. function() {
  187. var validationData = {keyType: 'CA'};
  188. var validations = certificateValidator_.validate(
  189. rootCertificatePem_, validationData);
  190. expect(validations.length).toBe(0);
  191. });
  192. it('usuccessfully validate a certificate of key type Sign when the validation key type is specified as CA',
  193. function() {
  194. var validationData = {keyType: 'CA'};
  195. var validations = certificateValidator_.validate(
  196. leafCertificatePem_, validationData);
  197. expect(validations).toEqual(['KEY_TYPE']);
  198. });
  199. it('usuccessfully validate a certificate of key type Sign when the validation key type is specified as Encryption',
  200. function() {
  201. var validationData = {keyType: 'Encryption'};
  202. var validations = certificateValidator_.validate(
  203. leafCertificatePem_, validationData);
  204. expect(validations).toEqual(['KEY_TYPE']);
  205. });
  206. it('usuccessfully validate a certificate of key type CA when the validation key type is specified as Sign',
  207. function() {
  208. var validationData = {keyType: 'Sign'};
  209. var validations = certificateValidator_.validate(
  210. rootCertificatePem_, validationData);
  211. expect(validations).toEqual(['KEY_TYPE']);
  212. });
  213. it('usuccessfully validate a certificate of key type CA when the validation key type is specified as Encryption',
  214. function() {
  215. var validationData = {keyType: 'Encryption'};
  216. var validations = certificateValidator_.validate(
  217. rootCertificatePem_, validationData);
  218. expect(validations).toEqual(['KEY_TYPE']);
  219. });
  220. it('successfully validate a root certificate when the validation signing certificate is specified as the root certificate itself',
  221. function() {
  222. var validationData = {issuerCertificatePem: rootCertificatePem_};
  223. var validations = certificateValidator_.validate(
  224. rootCertificatePem_, validationData);
  225. expect(validations.length).toBe(0);
  226. });
  227. it('successfully validate a leaf certificate when the validation signing certificate is specified as its parent certificate',
  228. function() {
  229. var validationData = {issuerCertificatePem: rootCertificatePem_};
  230. var validations = certificateValidator_.validate(
  231. leafCertificatePem_, validationData);
  232. expect(validations.length).toBe(0);
  233. });
  234. it('usuccessfully validate a root certificate when the validation signing certificate is specified as another certificate',
  235. function() {
  236. var validationData = {issuerCertificatePem: leafCertificatePem_};
  237. var validations = certificateValidator_.validate(
  238. rootCertificatePem_, validationData);
  239. expect(validations).toEqual(['SIGNATURE']);
  240. });
  241. it('usuccessfully validate a leaf certificate when the validation signing certificate is specified as the leaf certificate itself',
  242. function() {
  243. var validationData = {issuerCertificatePem: leafCertificatePem_};
  244. var validations = certificateValidator_.validate(
  245. leafCertificatePem_, validationData);
  246. expect(validations).toEqual(['SIGNATURE']);
  247. });
  248. });
  249. });
  250. function clone(object) {
  251. return JSON.parse(JSON.stringify(object));
  252. }
  253. });