2
0

certificates.spec.js 73 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978
  1. /*
  2. * Copyright 2018 Scytl Secure Electronic Voting SA
  3. *
  4. * All rights reserved
  5. *
  6. * See our extended copyright notice in *file 'Copyright.txt' which is part of this source code package
  7. */
  8. describe(
  9. 'Certificates: ', function() {
  10. 'use strict';
  11. var _rootCertificatePem =
  12. '-----BEGIN CERTIFICATE-----MIIEKjCCAxKgAwIBAgIQQtWFdPN4NAvUIWyyJyUlbTANBgkqhkiG9w0BAQsFADBUMRAwDgYDVQQDDAdSb290IENOMRYwFAYDVQQLDA1Sb290IE9yZyBVbml0MREwDwYDVQQKDAhSb290IE9yZzEVMBMGA1UEBhMMUm9vdCBDb3VudHJ5MB4XDTE0MDYxODEwMjMyOFoXDTE1MDYxODEwMjMyOFowVDEQMA4GA1UEAwwHUm9vdCBDTjEWMBQGA1UECwwNUm9vdCBPcmcgVW5pdDERMA8GA1UECgwIUm9vdCBPcmcxFTATBgNVBAYTDFJvb3QgQ291bnRyeTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ4AidkWId1zr4IZgItjE9uv38eB8fIGJGEts2n/XNh/EJ7NYZyBzvKSJR83v7LVJjc4pup5crWyS0B5lQ7uuD3/XZ9QpQFtnGiqlKOKH45zsw3ekaHEAco07L2dZznBuQTGLTlhrmvkCFRa8b8WYC+k90oUPvSd/9S4kA1Jlo9JDKHLer0SbjZCcVRXoLSBKmGWE0xSNfmNuZNONDRbtHvSA8A10AOtxKii9w464MXYzmPil7uM1Og1HC+FXCmkzLNfqQ31Om0jra3nLmrCpBJjRPX7svVnoxajRqpazVQnmJjjpzV7yNLwnR9W8OPwqanXcbxmTkrXMxfLxiVXDFUCAwEAAaOB9zCB9DAPBgNVHRMBAf8EBTADAQH/MDUGCCsGAQUFBwEBAQH/BCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AudGhhd3RlLmNvbTA0BgNVHR8BAf8EKjAoMCagJKAihiBodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9wY2EzLmNybDArBgNVHREBAf8EITAfpB0wGzEZMBcGA1UEAwwQUHJpdmF0ZUxhYmVsMy0xNTAOBgNVHQ8BAf8EBAMCAQYwNwYDVR0lAQH/BC0wKwYIKwYBBQUHAwEGCCsGAQUFBwMCBgpghkgBhvhFAQgBBglghkgBhvhCBAEwDQYJKoZIhvcNAQELBQADggEBADmtmjApZAXIkGLaZCdkRnhel53BtEdQnG990Oo/tBBboqy2ipum9ByTj3hNWJB3zuPN77rkrek9rbookNcCgVWhHtTk1lUpUK6ZohDsZh8k0MqIhkz+X+HiWGRsEOptjsCaknyWcWb4aXAevMAQMPm/ktkpQ8AOxAq+gtieewWQZP3kGPhBBCfn8TGjdrn9+ymf8EIbAUFXQ8m+oWeNlrdWhqzRXwQbj4EDds1kZdTo0nCYUdH+XEBF9nMyhAxSQWzCKQQTRFWv1dr3dKapzfgrdH8wEgvptiBYCY62O5+3DxiNK/VWquHz6S5GqIwkmSPDPMUU/qK3SNG3xIL1U1k=-----END CERTIFICATE-----';
  13. var _rootRsaPublicKeyPem =
  14. '-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAngCJ2RYh3XOvghmAi2MT26/fx4Hx8gYkYS2zaf9c2H8Qns1hnIHO8pIlHze/stUmNzim6nlytbJLQHmVDu64Pf9dn1ClAW2caKqUo4ofjnOzDd6RocQByjTsvZ1nOcG5BMYtOWGua+QIVFrxvxZgL6T3ShQ+9J3/1LiQDUmWj0kMoct6vRJuNkJxVFegtIEqYZYTTFI1+Y25k040NFu0e9IDwDXQA63EqKL3DjrgxdjOY+KXu4zU6DUcL4VcKaTMs1+pDfU6bSOtrecuasKkEmNE9fuy9WejFqNGqlrNVCeYmOOnNXvI0vCdH1bw4/CpqddxvGZOStczF8vGJVcMVQIDAQAB-----END PUBLIC KEY-----';
  15. var _rootSerialNumber = '88837713778966677489555326888277517677';
  16. var _rootNotBefore = '1403087008';
  17. var _rootNotAfter = '1434623008';
  18. var _rootCn = 'Root CN';
  19. // var _rootOrg = 'Root Org';
  20. // var _rootOrgUnit = 'Root Org Unit';
  21. var _rootCountry = 'Root Country';
  22. var _userRsaPublicKeyPem =
  23. '-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAglypZU45bnf2opnRI+Y51VqouBpvDT33xIB/OtbwKzwVpi+JrjBFtfk33tE9t/dSRs79CK94HRhCWcOiLa2qWPrjeZ9SBiEyScrhIvRZVBF41zBgwQNuRvJCsKmAqlZaFNJDZxEP4repmlBn1CfVFmfrXmOKqwP5F7l9ZtucveRzsfmF1yVPFkW8TMuB3YqMiyymyqHlS8ujCsu5I8tpgPbwuxdMOY94fNhSXrYkY8IuX1g1zdq/Z1jluOaR/UqK4UpnbuJaH/F0VgDNiWh6cTD0DFGEk0b70i5wU4Q3L/S6XZQRvSuADoCbhwBKuFL5pW5n865oLVb5S3wuVdWaGwIDAQAB-----END PUBLIC KEY-----';
  24. var _userCertificatePem =
  25. '-----BEGIN CERTIFICATE-----MIIEMzCCAxugAwIBAgIQRbaPaToIM+VS/d6etgYZ4jANBgkqhkiG9w0BAQsFADBUMRAwDgYDVQQDDAdSb290IENOMRYwFAYDVQQLDA1Sb290IE9yZyBVbml0MREwDwYDVQQKDAhSb290IE9yZzEVMBMGA1UEBhMMUm9vdCBDb3VudHJ5MB4XDTE0MDYxODEwMjMyOFoXDTE1MDYxODEwMjMyOFowYDETMBEGA1UEAwwKU3ViamVjdCBDTjEZMBcGA1UECwwQU3ViamVjdCBPcmcgVW5pdDEUMBIGA1UECgwLU3ViamVjdCBPcmcxGDAWBgNVBAYTD1N1YmplY3QgQ291bnRyeTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIJcqWVOOW539qKZ0SPmOdVaqLgabw0998SAfzrW8Cs8FaYvia4wRbX5N97RPbf3UkbO/QiveB0YQlnDoi2tqlj643mfUgYhMknK4SL0WVQReNcwYMEDbkbyQrCpgKpWWhTSQ2cRD+K3qZpQZ9Qn1RZn615jiqsD+Re5fWbbnL3kc7H5hdclTxZFvEzLgd2KjIsspsqh5UvLowrLuSPLaYD28LsXTDmPeHzYUl62JGPCLl9YNc3av2dY5bjmkf1KiuFKZ27iWh/xdFYAzYloenEw9AxRhJNG+9IucFOENy/0ul2UEb0rgA6Am4cASrhS+aVuZ/OuaC1W+Ut8LlXVmhsCAwEAAaOB9DCB8TAMBgNVHRMBAf8EAjAAMDUGCCsGAQUFBwEBAQH/BCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AudGhhd3RlLmNvbTA0BgNVHR8BAf8EKjAoMCagJKAihiBodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9wY2EzLmNybDArBgNVHREBAf8EITAfpB0wGzEZMBcGA1UEAwwQUHJpdmF0ZUxhYmVsMy0xNTAOBgNVHQ8BAf8EBAMCBsAwNwYDVR0lAQH/BC0wKwYIKwYBBQUHAwEGCCsGAQUFBwMCBgpghkgBhvhFAQgBBglghkgBhvhCBAEwDQYJKoZIhvcNAQELBQADggEBAAWZDJD6bg4ohHewszrAbL2tdUNxhrwCgNaHUhwNK43kiLGH0U9innhL1i0jP1VHNkL1G/+ZCo1qzh/Usji/jtlurfAWtrXku6VRF9NP+itKOY5jJ91Ijkc7t4dgoeJq6iMHn6JbDKIQ88r/Ikd0GdF04o5Qjqq1HlUVmqyIOHeHFla4i4tOxTyUBj34eE1No/xmaKYV1QtR1dqSHblR7OagEo7Dd3fXp7iSrKrXaN0Ef/6zeF3zjU5SMKcUcU9d3CbhS/CrGb+UGlqTXgzPXQWESH9AqBNl67+HF3mYktDQOZYPT5WRO5IKSko2cy9pP9UCsLk4oU3xyOxacWDpk1k=-----END CERTIFICATE-----';
  26. var _userSerialNumber = '92664638458902967092551440174596626914';
  27. var _userNotBefore = '1403087008';
  28. var _userNotAfter = '1434623008';
  29. var _userCn = 'Subject CN';
  30. // var _userOrg = 'Subject Org';
  31. // var _userOrgUnit = 'Subject Org Unit';
  32. var _userCountry = 'Subject Country';
  33. // Test opening root certificate.
  34. describe('Should be loaded if cryptolib is called with *: ', function() {
  35. it('should be defined a certificates.service objects', function() {
  36. cryptolib('*', function(box) {
  37. expect(box.certificates.service).toBeDefined();
  38. });
  39. });
  40. });
  41. describe('Root Certificate ...', function() {
  42. describe('should be able to ..', function() {
  43. it('retrieve its fields and public key, when certificate was generated using Java.',
  44. function() {
  45. cryptolib('certificates', function(box) {
  46. // Retrieve root certificate.
  47. var rootCertificate =
  48. new box.certificates.service.load(_rootCertificatePem);
  49. // Check whether expected fields can be retrieved from root
  50. // certificate.
  51. expect(
  52. new forge.jsbn.BigInteger(
  53. rootCertificate.getSerialNumber(), box.BASE_16_RADIX))
  54. .toEqual(new forge.jsbn.BigInteger(_rootSerialNumber));
  55. var notBefore = rootCertificate.getNotBefore()
  56. .getTime()
  57. .toString()
  58. .substring(0, box.EPOCH_TIME_LENGTH);
  59. expect(notBefore).toBe(_rootNotBefore);
  60. var notAfter = rootCertificate.getNotAfter()
  61. .getTime()
  62. .toString()
  63. .substring(0, box.EPOCH_TIME_LENGTH);
  64. expect(notAfter).toBe(_rootNotAfter);
  65. expect(rootCertificate.getSubjectCN()).toBe(_rootCn);
  66. expect(rootCertificate.getSubjectCountry()).toBe(_rootCountry);
  67. expect(rootCertificate.getIssuerCN()).toBe(_rootCn);
  68. expect(rootCertificate.getIssuerCountry()).toBe(_rootCountry);
  69. // Retrieve public key from root certificate.
  70. var rootPublicKeyPem =
  71. rootCertificate.getPublicKey().toString().replace(
  72. /(\r\n|\n|\r)/gm, '');
  73. var rootPublicKey =
  74. forge.pki.publicKeyFromPem(rootPublicKeyPem);
  75. // Check whether public key retrieved from root certificate is
  76. // same as original.
  77. expect(rootPublicKeyPem).toBe(_rootRsaPublicKeyPem);
  78. var rootPublicKeyOrig =
  79. forge.pki.publicKeyFromPem(_rootRsaPublicKeyPem);
  80. expect(rootPublicKey.e).toEqual(rootPublicKeyOrig.e);
  81. expect(rootPublicKey.n).toEqual(rootPublicKeyOrig.n);
  82. // Retrieve key usage extension fields.
  83. var keyUsageExtension = rootCertificate.getKeyUsageExtension();
  84. // Check whether expected key usage flags can be retrieved from
  85. // certificate.
  86. expect(keyUsageExtension.digitalSignature()).toBe(false);
  87. expect(keyUsageExtension.nonRepudiation()).toBe(false);
  88. expect(keyUsageExtension.keyEncipherment()).toBe(false);
  89. expect(keyUsageExtension.dataEncipherment()).toBe(false);
  90. expect(keyUsageExtension.keyAgreement()).toBe(false);
  91. expect(keyUsageExtension.keyCertSign()).toBe(true);
  92. expect(keyUsageExtension.crlSign()).toBe(true);
  93. expect(keyUsageExtension.encipherOnly()).toBe(false);
  94. expect(keyUsageExtension.decipherOnly()).toBe(false);
  95. // Check whether signature of root certificate with its own
  96. // public key (since it is self-signed).
  97. expect(rootCertificate.verify(_rootCertificatePem)).toBe(true);
  98. });
  99. });
  100. });
  101. });
  102. // Test opening user certificate.
  103. describe('User Certificate ...', function() {
  104. describe('should be able to ..', function() {
  105. it('retrieve its fields and public key, when certificate was generated using Java.',
  106. function() {
  107. cryptolib('certificates', function(box) {
  108. // Retrieve user certificate.
  109. var userCertificate =
  110. new box.certificates.CryptoX509Certificate(
  111. _userCertificatePem);
  112. // Check whether expected fields can be retrieved from user
  113. // certificate.
  114. expect(
  115. new forge.jsbn.BigInteger(
  116. userCertificate.getSerialNumber(), box.BASE_16_RADIX))
  117. .toEqual(new forge.jsbn.BigInteger(_userSerialNumber));
  118. var notBefore = userCertificate.getNotBefore()
  119. .getTime()
  120. .toString()
  121. .substring(0, box.EPOCH_TIME_LENGTH);
  122. expect(notBefore).toBe(_userNotBefore);
  123. var notAfter = userCertificate.getNotAfter()
  124. .getTime()
  125. .toString()
  126. .substring(0, box.EPOCH_TIME_LENGTH);
  127. expect(notAfter).toBe(_userNotAfter);
  128. expect(userCertificate.getSubjectCN()).toBe(_userCn);
  129. expect(userCertificate.getSubjectCountry()).toBe(_userCountry);
  130. expect(userCertificate.getIssuerCN()).toBe(_rootCn);
  131. expect(userCertificate.getIssuerCountry()).toBe(_rootCountry);
  132. // Retrieve public key from user certificate.
  133. var userPublicKeyPem =
  134. userCertificate.getPublicKey().toString().replace(
  135. /(\r\n|\n|\r)/gm, '');
  136. var userPublicKey =
  137. forge.pki.publicKeyFromPem(userPublicKeyPem);
  138. // Check whether public key retrieved from certificate is same
  139. // as original.
  140. expect(userPublicKeyPem).toBe(_userRsaPublicKeyPem);
  141. var userPublicKeyOrig =
  142. forge.pki.publicKeyFromPem(_userRsaPublicKeyPem);
  143. expect(userPublicKey.e).toEqual(userPublicKeyOrig.e);
  144. expect(userPublicKey.n).toEqual(userPublicKeyOrig.n);
  145. // Retrieve key usage extension fields.
  146. var keyUsageExtension = userCertificate.getKeyUsageExtension();
  147. // Check whether expected key usage flags can be retrieved from
  148. // certificate.
  149. expect(keyUsageExtension.digitalSignature()).toBe(true);
  150. expect(keyUsageExtension.nonRepudiation()).toBe(true);
  151. expect(keyUsageExtension.keyEncipherment()).toBe(false);
  152. expect(keyUsageExtension.dataEncipherment()).toBe(false);
  153. expect(keyUsageExtension.keyAgreement()).toBe(false);
  154. expect(keyUsageExtension.keyCertSign()).toBe(false);
  155. expect(keyUsageExtension.crlSign()).toBe(false);
  156. expect(keyUsageExtension.encipherOnly()).toBe(false);
  157. expect(keyUsageExtension.decipherOnly()).toBe(false);
  158. // Verify signature of user certificate with root certificate's
  159. // public key.
  160. var rootCertificate =
  161. new box.certificates.CryptoX509Certificate(
  162. _rootCertificatePem);
  163. expect(rootCertificate.verify(_userCertificatePem)).toBe(true);
  164. });
  165. });
  166. });
  167. });
  168. it('should exist a validator object', function() {
  169. cryptolib('certificates', function(box) {
  170. var validator = new box.certificates.CryptoX509CertificateValidator();
  171. expect(validator).toBeDefined();
  172. });
  173. });
  174. describe('Validator', function() {
  175. it('should validate the subject DN', function() {
  176. cryptolib('certificates', function(box) {
  177. var validationData = {
  178. subject: {
  179. commonName: 'Subject CN',
  180. organization: 'Subject Org',
  181. organizationUnit: 'Subject Org Unit',
  182. country: 'Subject Country'
  183. }
  184. };
  185. var validator = new box.certificates.CryptoX509CertificateValidator(
  186. validationData);
  187. var validations = validator.validate(_userCertificatePem);
  188. expect(validations.length).toBe(0);
  189. });
  190. });
  191. it('should fail the validation if subject CN is different from what expected',
  192. function() {
  193. cryptolib('certificates', function(box) {
  194. var validationData = {
  195. subject: {
  196. commonName: 'Subject CN1',
  197. organization: 'Subject Org',
  198. organizationUnit: 'Subject Org Unit',
  199. country: 'Subject Country'
  200. }
  201. };
  202. var validator =
  203. new box.certificates.CryptoX509CertificateValidator(
  204. validationData);
  205. var validations = validator.validate(_userCertificatePem);
  206. expect(validations).toContain('SUBJECT');
  207. });
  208. });
  209. it('should fail the validation if subject O is different from what expected',
  210. function() {
  211. cryptolib('certificates', function(box) {
  212. var validationData = {
  213. subject: {
  214. commonName: 'Subject CN',
  215. organization: 'Subject Org1',
  216. organizationUnit: 'Subject Org Unit',
  217. country: 'Subject Country'
  218. }
  219. };
  220. var validator =
  221. new box.certificates.CryptoX509CertificateValidator(
  222. validationData);
  223. var validations = validator.validate(_userCertificatePem);
  224. expect(validations).toContain('SUBJECT');
  225. });
  226. });
  227. it('should fail the validation if subject OU is different from what expected',
  228. function() {
  229. cryptolib('certificates', function(box) {
  230. var validationData = {
  231. subject: {
  232. commonName: 'Subject CN',
  233. organization: 'Subject Org',
  234. organizationUnit: 'Subject Org Unit1',
  235. country: 'Subject Country'
  236. }
  237. };
  238. var validator =
  239. new box.certificates.CryptoX509CertificateValidator(
  240. validationData);
  241. var validations = validator.validate(_userCertificatePem);
  242. expect(validations).toContain('SUBJECT');
  243. });
  244. });
  245. it('should fail the validation if subject C is different from what expected',
  246. function() {
  247. cryptolib('certificates', function(box) {
  248. var validationData = {
  249. subject: {
  250. commonName: 'Subject CN',
  251. organization: 'Subject Org',
  252. organizationUnit: 'Subject Org Unit',
  253. country: 'Subject CountryC'
  254. }
  255. };
  256. var validator =
  257. new box.certificates.CryptoX509CertificateValidator(
  258. validationData);
  259. var validations = validator.validate(_userCertificatePem);
  260. expect(validations).toContain('SUBJECT');
  261. });
  262. });
  263. it('should fail the validation if subject CN is different from what expected',
  264. function() {
  265. cryptolib('certificates', function(box) {
  266. var validationData = {
  267. issuer: {
  268. commonName: 'Subject CN1',
  269. organization: 'Subject Org',
  270. organizationUnit: 'Subject Org Unit',
  271. country: 'Subject Country'
  272. }
  273. };
  274. var validator =
  275. new box.certificates.CryptoX509CertificateValidator(
  276. validationData);
  277. var validations = validator.validate(_userCertificatePem);
  278. expect(validations).toContain('ISSUER');
  279. });
  280. });
  281. it('should fail the validation if issuer is different from what expected',
  282. function() {
  283. cryptolib('certificates', function(box) {
  284. var validationData = {
  285. issuer: {
  286. commonName: 'Subject CN',
  287. organization: 'Subject Org1',
  288. organizationUnit: 'Subject Org Unit',
  289. country: 'Subject Country'
  290. }
  291. };
  292. var validator =
  293. new box.certificates.CryptoX509CertificateValidator(
  294. validationData);
  295. var validations = validator.validate(_userCertificatePem);
  296. expect(validations).toContain('ISSUER');
  297. });
  298. });
  299. it('should fail the validation if subject is different from what expected',
  300. function() {
  301. cryptolib('certificates', function(box) {
  302. var validationData = {
  303. issuer: {
  304. commonName: 'Subject CN',
  305. organization: 'Subject Org',
  306. organizationUnit: 'Subject Org Unit1',
  307. country: 'Subject Country'
  308. }
  309. };
  310. var validator =
  311. new box.certificates.CryptoX509CertificateValidator(
  312. validationData);
  313. var validations = validator.validate(_userCertificatePem);
  314. expect(validations).toContain('ISSUER');
  315. });
  316. });
  317. it('should fail the validation if issuer is different from what expected',
  318. function() {
  319. cryptolib('certificates', function(box) {
  320. var validationData = {
  321. issuer: {
  322. commonName: 'Subject CN',
  323. organization: 'Subject Org',
  324. organizationUnit: 'Subject Org Unit',
  325. country: 'Subject CountryC'
  326. }
  327. };
  328. var validator =
  329. new box.certificates.CryptoX509CertificateValidator(
  330. validationData);
  331. var validations = validator.validate(_userCertificatePem);
  332. expect(validations).toContain('ISSUER');
  333. });
  334. });
  335. it('should validate that time is between notBefore and notAfter',
  336. function() {
  337. cryptolib('certificates', function(box) {
  338. var validationData = {time: '2014-12-25\'T\'00:00:00Z'};
  339. var validator =
  340. new box.certificates.CryptoX509CertificateValidator(
  341. validationData);
  342. var validations = validator.validate(_userCertificatePem);
  343. expect(validations.length).toBe(0);
  344. });
  345. });
  346. it('should fail the validation if time is not between notBefore and notAfter',
  347. function() {
  348. cryptolib('certificates', function(box) {
  349. var validationData = {time: '2016-12-25\'T\'00:00:00Z'};
  350. var validator =
  351. new box.certificates.CryptoX509CertificateValidator(
  352. validationData);
  353. var validations = validator.validate(_userCertificatePem);
  354. expect(validations).toContain('TIME');
  355. });
  356. });
  357. it('106356 should not fail the validation if time equals notBefore',
  358. function() {
  359. cryptolib('certificates', function(box) {
  360. var validationData = {time: '2014-06-18\'T\'10:23:28Z'};
  361. var validator =
  362. new box.certificates.CryptoX509CertificateValidator(
  363. validationData);
  364. var validations = validator.validate(_userCertificatePem);
  365. expect(validations).not.toContain('TIME');
  366. });
  367. });
  368. it('106356 should not fail the validation if time equals notAfter',
  369. function() {
  370. cryptolib('certificates', function(box) {
  371. var validationData = {time: '2015-06-18\'T\'10:23:28Z'};
  372. var validator =
  373. new box.certificates.CryptoX509CertificateValidator(
  374. validationData);
  375. var validations = validator.validate(_userCertificatePem);
  376. expect(validations).not.toContain('TIME');
  377. });
  378. });
  379. it('should fail the validation if time is invalid - 1 character',
  380. function() {
  381. cryptolib('certificates', function(box) {
  382. var validationData = {time: 'a'};
  383. var validator =
  384. new box.certificates.CryptoX509CertificateValidator(
  385. validationData);
  386. var validations = validator.validate(_userCertificatePem);
  387. expect(validations).toContain('TIME');
  388. });
  389. });
  390. it('should fail the validation if time is invalid - 3 characters',
  391. function() {
  392. cryptolib('certificates', function(box) {
  393. var validationData = {time: 'abc'};
  394. var validator =
  395. new box.certificates.CryptoX509CertificateValidator(
  396. validationData);
  397. var validations = validator.validate(_userCertificatePem);
  398. expect(validations).toContain('TIME');
  399. });
  400. });
  401. it('should fail the validation if time is invalid 20 characters',
  402. function() {
  403. cryptolib('certificates', function(box) {
  404. var validationData = {time: 'aaaaaaaaaaaaaaaaaaaa'};
  405. var validator =
  406. new box.certificates.CryptoX509CertificateValidator(
  407. validationData);
  408. var validations = validator.validate(_userCertificatePem);
  409. expect(validations).toContain('TIME');
  410. });
  411. });
  412. it('should fail if that the flag CA is set to false if keyType validation parameter is CA',
  413. function() {
  414. cryptolib('certificates', function(box) {
  415. var validationData = {keyType: 'CA'};
  416. var validator =
  417. new box.certificates.CryptoX509CertificateValidator(
  418. validationData);
  419. var validations = validator.validate(_userCertificatePem);
  420. expect(validations).toContain('KEY_TYPE');
  421. });
  422. });
  423. it('should validate that if the Key Type is CA, then the key usage should be set to keycertSign, cRLSign',
  424. function() {
  425. cryptolib('certificates', function(box) {
  426. var validationData = {keyType: 'CA'};
  427. var validator =
  428. new box.certificates.CryptoX509CertificateValidator(
  429. validationData);
  430. var validations = validator.validate(_userCertificatePem);
  431. expect(validations).toContain('KEY_TYPE');
  432. });
  433. });
  434. it('should validate that if the Key Type is Sign, then the key usage should be set to digitalSignature, nonRepudiation',
  435. function() {
  436. cryptolib('certificates', function(box) {
  437. var validationData = {keyType: 'Sign'};
  438. var validator =
  439. new box.certificates.CryptoX509CertificateValidator(
  440. validationData);
  441. var validations = validator.validate(_userCertificatePem);
  442. expect(validations).not.toContain('KEY_TYPE');
  443. });
  444. });
  445. it('should validate that if the Key Type is Encryption, then the key usage should be set to keyEncipherment, dataEncipherment',
  446. function() {
  447. cryptolib('certificates', function(box) {
  448. var validationData = {keyType: 'Encryption'};
  449. var validator =
  450. new box.certificates.CryptoX509CertificateValidator(
  451. validationData);
  452. var validations = validator.validate(_userCertificatePem);
  453. expect(validations).toContain('KEY_TYPE');
  454. });
  455. });
  456. it('should validate that if the Key Type is Signature, then the certificate has to be verified with the public provided',
  457. function() {
  458. cryptolib('certificates', function(box) {
  459. var validationData = {caCertificatePem: _rootCertificatePem};
  460. var validator =
  461. new box.certificates.CryptoX509CertificateValidator(
  462. validationData);
  463. var validations = validator.validate(_userCertificatePem);
  464. expect(validations).not.toContain('SIGNATURE');
  465. });
  466. });
  467. });
  468. it('should exist a validator chain method', function() {
  469. cryptolib('certificates', function(box) {
  470. expect(box.certificates.service.validateX509CertificateChain)
  471. .toBeDefined();
  472. });
  473. });
  474. describe('Chain validator', function() {
  475. it('should validate a chain of certificates - valid dates', function() {
  476. cryptolib('certificates', function(box) {
  477. var chain = {
  478. leaf: {
  479. pem:
  480. '-----BEGIN CERTIFICATE-----MIICCzCCAXSgAwIBAgIBATANBgkqhkiG9w0BAQUFADBHMRswGQYDVQQDDBJ3aGl0ZSBpbnRlcm1lZGlhdGUxDjAMBgNVBAoMBXNjeXRsMQswCQYDVQQLDAJzZTELMAkGA1UEBhMCRVMwHhcNMTQwOTA1MTAxNDEzWhcNMjQwODEzMTAxNDEzWjA/MRMwEQYDVQQDDAp3aGl0ZSBsZWFmMQ4wDAYDVQQKDAVzY3l0bDELMAkGA1UECwwCc2UxCzAJBgNVBAYTAkVTMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3yWZQRc5xk14TIL3/2UGVgNz94dHq7vg4ORduUvtio4nVMSriQNSPnEbAfV9FR8qA6UCzqXQroNX6eSpQfJ4MblyUWUj7VYtY/jC2UxGcE4GJxhngiwfO+It2ejTr6I7EPlj7pwPOVTDWByaDsYWtJ3JeaVhR9Tcf5L+H5k7HTQIDAQABow8wDTALBgNVHQ8EBAMCBsAwDQYJKoZIhvcNAQEFBQADgYEAQNoV1G2zwceE1/4VppH3eJYi8u1CUWUoaQe1rH3owm9CH9/OfS+MicUIW/7yRi86rtATnhTcfN34E18AwbJsmESBnCkx+WaVZ/WC1jGJ/Dd5rgxvRfZpwd1RKivKzZsoYm19PVFRDg9K9qqA6dkuq29wTnwMV48rQPkfix9lWjg=-----END CERTIFICATE-----',
  481. keytype: 'Sign',
  482. subject: {
  483. commonName: 'white leaf',
  484. organization: 'scytl',
  485. organizationUnit: 'se',
  486. country: 'ES'
  487. },
  488. time: '2014-12-25\'T\'00:00:00Z'
  489. },
  490. root:
  491. '-----BEGIN CERTIFICATE-----MIICSDCCAbGgAwIBAgIJAPJ2LYuwqa81MA0GCSqGSIb3DQEBBQUAMD0xETAPBgNVBAMMCHdoaXRlIGNhMQ4wDAYDVQQKDAVzY3l0bDELMAkGA1UECwwCc2UxCzAJBgNVBAYTAkVTMB4XDTE0MDkwNTA5MzQwNloXDTI0MDkwMjA5MzQwNlowPTERMA8GA1UEAwwId2hpdGUgY2ExDjAMBgNVBAoMBXNjeXRsMQswCQYDVQQLDAJzZTELMAkGA1UEBhMCRVMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALnpKp2eeY1hC4V8E1nUIZJpJVhAZk3oJeEbq0Xi2uSYrh6wmfuQIHFs5rYF4yHoGvf+PM66od8ccHa1GNGB/b6lFb4/+2vEvYWA51OWY9BBdgjhAsqoks9ANNDQ1oxX4dqLwjM/GDDg2v9xoT9tj0CaJnieQbhMkH8oQveBBR57AgMBAAGjUDBOMB0GA1UdDgQWBBRwKg/RntWH8EvCkEX3jtHuvSpbwTAfBgNVHSMEGDAWgBRwKg/RntWH8EvCkEX3jtHuvSpbwTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBADk/OOoc2tbfxja95RqH22EcAVJ/mDin2ev9cXhZ2A2xh4SrUad0fNsyFnY+m3EzfA0KPrI46sEPDeuWqwnGAYccmp7ylVIS6edYRvnI5mdLze2CnuDNJYQzZXjASQF2ih5wTNm3VMZkN0SqGQZiOCa9NQHPfmNj8mJe0Ooj2b3o-----END CERTIFICATE-----',
  492. certificates: {
  493. pems: [
  494. '-----BEGIN CERTIFICATE-----MIICGjCCAYOgAwIBAgIBATANBgkqhkiG9w0BAQUFADA9MREwDwYDVQQDDAh3aGl0ZSBjYTEOMAwGA1UECgwFc2N5dGwxCzAJBgNVBAsMAnNlMQswCQYDVQQGEwJFUzAeFw0xNDA5MDUwOTM1MThaFw0yNDA4MjMwOTM1MThaMEcxGzAZBgNVBAMMEndoaXRlIGludGVybWVkaWF0ZTEOMAwGA1UECgwFc2N5dGwxCzAJBgNVBAsMAnNlMQswCQYDVQQGEwJFUzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwUmpmT/rNcxIP8Xulj0RcbdvaNGJNoEPMzEGztguB+mKsTPgJIlrKvdskY5NIPd1+hzS+HjvW11uwyT2FnmyfKBqND4EH5BqU8Ph4bAyrT950DPcOGE4vG0fLO0jTD3h0n4d4yugWmrND2sScFZQsGLbgOYX4QM8vV+owoKNRxMCAwEAAaMgMB4wDwYDVR0TBAgwBgEB/wIBADALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEFBQADgYEAF0B5LQDo3uRs9dSkxp39ER64XIa6XYV0zdbq+fqHg8Qcoggpox7vwmc6YoCNQpfY2zLiIUMbb6VMP4pkp7jZMju9TBKPOjMFrQKom0cowT/gYdokgnsk8yUYOdo46GJR43PjFLTiQk5JDawWaECbhcgyLf59AalX9z9dbY0AwqI=-----END CERTIFICATE-----'
  495. ],
  496. subjects: [{
  497. commonName: 'white intermediate',
  498. organization: 'scytl',
  499. organizationUnit: 'se',
  500. country: 'ES'
  501. }]
  502. }
  503. };
  504. var validation =
  505. box.certificates.service.validateX509CertificateChain(chain);
  506. expect(validation).toEqual([[], []]);
  507. });
  508. });
  509. it('should validate a chain of certificates generated by java', function() {
  510. cryptolib('certificates.service', function(box) {
  511. var chain = {
  512. leaf: {
  513. pem:
  514. '-----BEGIN CERTIFICATE-----MIIDeDCCAmCgAwIBAgIVAJ81fEEjKAKK8Yg5D654L3suMkbVMA0GCSqGSIb3DQEBCwUAMFExEjAQBgNVBAMMCVZvdGVycyBDQTETMBEGA1UECwwKc2cxMDAxLTAwMDEOMAwGA1UECgwFTlNXRUMxCTAHBgNVBAcMADELMAkGA1UEBhMCQVUwHhcNMTQwOTA4MDc0NDExWhcNMTUwOTA4MDc0MzU0WjB4MTkwNwYDVQQDDDBWb3RlclNpZ24gNDExNTQ5NzQxMjM5NzMxMjgwNDQ0MjI3NzQxNzUxODczMDY5OTcxEzARBgNVBAsMCnNnMTAwMS0wMDAxDjAMBgNVBAoMBU5TV0VDMQkwBwYDVQQHDAAxCzAJBgNVBAYTAkFVMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqYeNTbS15+IpxgXEXivFK5Rt3I5du1NDgYdxRRebYqWi/0t2LsyAljZkAqWbgyQswJbXwpuhJmlSlz2RNr04PBxxm93BMoVGXlbVGEGAmk3ZkwVB0VjSFZkJHvARmJ9oudYC7uUyxtr8brPB16Q8FIv2j9CSPMWUXa0YbxLFgdZmJ6Ulu5B3RToBvpXL0aFNiIpIm4Vz5f0N4f+AxV1CV8vwzoQpefuGuss32WIi1vrhx0j1+K6hWGx8xgID/yKEIBPsKupjjcPhNxdzZepI0FOSpPnjjVMHHWgEaiRloRk66T7FiKOPkanazQBbo/zULRrKfvXkQ4NAnoV29T7GBwIDAQABoyAwHjAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIGwDANBgkqhkiG9w0BAQsFAAOCAQEADghhwPmZ2LTPhtVyKtBa1ljNcNODVRrLFX05h9ZIVojteI6BGE+xM/IagfsaOrK804T0psbdWEpWQJqXJtbI5TEiFAbliVdFOKv7Al5jnd2HNqauU3YWoZ2jy32wbtBnTpR8E8ILJLsMMyvy+ZSRUKyHaboOsphy1dtyncACNnuLhLtSC1IeB2LbFOLZWnU7dnKETAwMCBJ3ELlhFIPPwLLQjkLtX3Z4kYWRNUB/ePoKGfXPhBYXaY4KE135kA+5GNpIRwzZmh8VrDo3aTLEAJZD0xDv4ohir5FWcnMPdUvmwfya/mZZhns94y5aiql/kTJPl0f0G1t0AOkRYqbB/w==-----END CERTIFICATE-----',
  515. keytype: 'Sign',
  516. subject: {
  517. commonName:
  518. 'VoterSign 41154974123973128044422774175187306997',
  519. organization: 'NSWEC',
  520. organizationUnit: 'sg1001-000',
  521. country: 'AU'
  522. },
  523. time: '2014-12-25\'T\'00:00:00Z'
  524. },
  525. root:
  526. '-----BEGIN CERTIFICATE-----MIIDYzCCAkugAwIBAgIUax82wdIaGWRKCH3J1h1u4Ij4F7AwDQYJKoZIhvcNAQELBQAwWTEaMBgGA1UEAwwRRWxlY3Rpb24gRXZlbnQgQ0ExEzARBgNVBAsMCnNnMTAwMS0wMDAxDjAMBgNVBAoMBU5TV0VDMQkwBwYDVQQHDAAxCzAJBgNVBAYTAkFVMB4XDTE0MDkwODA3NDM1NloXDTE1MDkwODA3NDM1NFowWTEaMBgGA1UEAwwRRWxlY3Rpb24gRXZlbnQgQ0ExEzARBgNVBAsMCnNnMTAwMS0wMDAxDjAMBgNVBAoMBU5TV0VDMQkwBwYDVQQHDAAxCzAJBgNVBAYTAkFVMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgXYi9cTerqmun+SS56tByn9Z9OYwP2cS8NkvHO0Pv04lTEJ//1jo8uUpn3kza4m5lgUFEr6hl+e+G21yk/NrieD4Ke008Be0F9arSedsYyQvqcg1VcssY3+mtbz8osOH8f/jB6cMkASrzESvDOIM45MkaFlAYqkxN4q819qaOgWvlotkQKUKu+Dnb59Cpqf8MQ2nVv+mEwXVZiVCKquOnEN29vqppI8GigE1jqRkKx5mIwmUBYWrOalWVexMNJVSAqyxlJ1ozgKC6Z/o37l/pRFJMG1iIiAiMRucokWn7p9414O+3O4OuDP1lkBG7PxzmOHEl3WrJ7hseGLWIF/mcwIDAQABoyMwITAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAO89PQSEeZkGxydWgFJ61DKq6eiaNjCRXKorH3yDCd7wwuOiKamJRojk29zrLZR+0BrYGVLV4JPj/0ZStNtbQfz1jeadEVdrpjlk9NfNgPcYIbb9tENNNFRqeQR8JB1K+qOELZt87jX9wg1jzgAo0kSHDAIIADDOhX//lzeE2amaXgYYHmLtdKpZI2lXKj1VmdeeR/wGtpkXGkDO65FkvcY65lj25wzksanpk/juy4ENLoY1AvC6f30Kw7CSduoctsB58MOPPtlR6rA7EmSWUAdfTmobB3kHOm6OZN+nikUhC73l1kS9mZXg/oabO7yoOmRQ7ttqqNmecaB7EnS5nHg==-----END CERTIFICATE-----',
  527. certificates: {
  528. pems: [
  529. '-----BEGIN CERTIFICATE-----MIIDWzCCAkOgAwIBAgIULFolrOnoUb8h6GroW8JoRZtvSrcwDQYJKoZIhvcNAQELBQAwWTEaMBgGA1UEAwwRRWxlY3Rpb24gRXZlbnQgQ0ExEzARBgNVBAsMCnNnMTAwMS0wMDAxDjAMBgNVBAoMBU5TV0VDMQkwBwYDVQQHDAAxCzAJBgNVBAYTAkFVMB4XDTE0MDkwODA3NDM1N1oXDTE1MDkwODA3NDM1NFowUTESMBAGA1UEAwwJVm90ZXJzIENBMRMwEQYDVQQLDApzZzEwMDEtMDAwMQ4wDAYDVQQKDAVOU1dFQzEJMAcGA1UEBwwAMQswCQYDVQQGEwJBVTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALAjG+fLhtK6FS0iLdAPscY9jCGYjROueU0F+ans8a5e214RDNS2WdnYhJSuPRcbftztncze6vCD0/KSZO6MTwagqx7iudFhSITJA96tTDT0pEQ/fInkcJbOh8LYAHukEXYPxQSiHTD52UTLwPpAVd/DhBflf7LKL0VEjXuDifU/EvVDp96g6yoyHMiv6REsIrr8o2cSI5UbrxPIX7V/fAwfHKDyRp2ECrqaMmz/7dKWjhB0zoBQGI7r4WCIDmUbU9psn90a5y6xj5XhuF6HzozaZH1IibCTULdTQEUfs4dPaF+5oWlCZrF+dkBTXQh4Pm1h+iOboCk+8FcZtt4ijC0CAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBAD96TL6FvCMtoRJqjowqVRSQTAhnCcPesmG6+yzz9YXWu46koEM/XkeZm+wtIF6YC2R59vAvbFNtrnkThvFG3sDXDUAeDS4vrVr8S0BApbHDa94ri7Km8aYrPhwy5sDOsq5QR//RZORPOJaMeZHiJA0MP31GJJjwcJJs4uOm3sQHEdNArSEp8+Dzim3X/EY6NWo8COeKEwcPSm0c/jMung1NYKFV6CGF/jOOEcrESNdnBWi7LYAWn/ba9XiyuKhD26bLX1L20IFEO+EvcnEvLrhulmRe/bZsLkyZMieZqh+w3KFUe2F452J6o+/i2TbHcn8/c2B9T490/dV5w8sB1bM=-----END CERTIFICATE-----'
  530. ],
  531. subjects: [{
  532. commonName: 'Voters CA',
  533. organization: 'NSWEC',
  534. organizationUnit: 'sg1001-000',
  535. country: 'AU'
  536. }]
  537. }
  538. };
  539. var validation =
  540. box.certificates.service.validateX509CertificateChain(chain);
  541. expect(validation).toEqual([[], []]);
  542. });
  543. });
  544. it('should have a function that flatten the failed validation array',
  545. function() {
  546. cryptolib('certificates.service', function(box) {
  547. var validationFailed =
  548. [['SIGNATURE', 'NOT_AFTER'], ['NOT_BEFORE']];
  549. var validationFailedFlattened =
  550. ['signature_0', 'not_after_0', 'not_before_1'];
  551. expect(box.certificates.service.flattenFailedValidations(
  552. validationFailed))
  553. .toEqual(validationFailedFlattened);
  554. });
  555. });
  556. });
  557. // commented when validations were commented
  558. describe('Bug #97033', function() {
  559. it('should not validate a chain of certificates because of an invalid not after in one certificate',
  560. function() {
  561. cryptolib('certificates', function(box) {
  562. var chain = {
  563. leaf: {
  564. pem:
  565. '-----BEGIN CERTIFICATE-----MIIDszCCApugAwIBAgIJALAhpG3UDbqKMA0GCSqGSIb3DQEBCwUAME8xCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDjAMBgNVBAMMBVNlY1FBMB4XDTE0MTAyMzE1MTMxMVoXDTE1MTAyMzE1MTMxMVowVjELMAkGA1UEBhMCRVMxEzARBgNVBAgMClRlc3QtU3RhdGUxDjAMBgNVBAoMBVNjeXRsMQswCQYDVQQLDAJRQTEVMBMGA1UEAwwMU2VjRW5kRW50aXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1isXtrHkDvChE1jGCSnleAc547Hnswxhuf3XcTs6cG4y5oOgLgEZrbzHAe6Z47wBmt/35OC5oIa5tgmWBs7QVnAZ4PZWAdZTAq2J5TBQCcpilw2Kc5NHp231Ckw52pHT6/O4VieeZdOA/+PCbL7/4PrQ/Uq/23W1kHvUqToJTRwrOZFMg8QfTlo3RYN6xFmlW6hXCCHkolqihbK44jX6FELCLwbE1dw43eao5Pnbxw//2jyqReC2qrpcKQ4MdgJJYgK9rA+zCCj0m7H+LsNyiat4OTYvDVx9Lg7nmjgD2cFWewLDE9t4QVST41vYgWObJjisLyGsbEwLfOjXkf8jrQIDAQABo4GKMIGHMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgbAMC0GCWCGSAGG+EIBDQQgFh5TY3l0bCBRQSBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFLBtuBGwweIxC3h8ILFblDSg2x8SMB8GA1UdIwQYMBaAFL0z1LklZYtSH+ayTVfCjxPfiDf4MA0GCSqGSIb3DQEBCwUAA4IBAQBDTsidJItoNaPPp+idbBCLm8VrNxlVpWYQ4KmA6glCw5z7TcH1JW+GsfSxXfXo2bFGtxDFsjZCV76fBwoQVAvJ6ntCyn/vrslSQy6RvArM2e7Di6h6ND500so0a5mfycN7rauhj0tWcmZv3zExJcwgtar/P3BHYpfN9/eG46NpxRq4Sq9uwfYEH9lzAfZ3xgLWgIRAEoF6b2VRMU9ApVX/Ifai17+0JKhNkmBp63EUJCcXNSjTV4UtKTO2QFply4hOqluhMkFZDqFsbzB+mrSQcCget+6ymCVdTaN3GwVuW4CKIoR85Nr+3OV1VupDz3bnzqDjeiTNIJEV6aONP2zD-----END CERTIFICATE-----',
  566. keytype: 'Sign',
  567. subject: {
  568. commonName: 'SecEndEntity',
  569. organization: 'Scytl',
  570. organizationUnit: 'QA',
  571. country: 'ES'
  572. }
  573. },
  574. root:
  575. '-----BEGIN CERTIFICATE-----MIIDgDCCAmigAwIBAgIJALAhpG3UDbqIMA0GCSqGSIb3DQEBCwUAMFAxCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDzANBgNVBAMMBlNlY0RldjAeFw0xNDEwMjMxNTExMTJaFw0yNDEwMjAxNTExMTJaMFAxCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDzANBgNVBAMMBlNlY0RldjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKanbx9BsuYLjq4RVAS269FD2Gtpp3YkcvKHwHO5XI89+pJELO9CVnyIvEmon3ndbvPTqM3D/HOvl0M4/kPFeHij8d24iM48GVbYfLVBrV3BtKe24pHeIagSn6hl9ouiknbvDBqF8qZcBTNhnH8yX7isoJf3TShBpTOdyJ6XkDOQ+R0GtS1M4NN9BS74oGt0REC17VlBrO6JyR9rNswk4abqqpF7ekw1yXxcnrqa480+oyEcY9ji5QNoP9kGyibeB08seeB+wlt0fCWcJXtecsnPRpBNJmhLr4ziNyXoIOCEeVMA/MFx7vrrl+pkyhd49rQybbctv/mQGUM4QG6IZ3cCAwEAAaNdMFswHQYDVR0OBBYEFA56IIf2S8G0LjsIlSASdPBgMi2kMB8GA1UdIwQYMBaAFA56IIf2S8G0LjsIlSASdPBgMi2kMAwGA1UdEwQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQCE15Vvk+I+iR2RutD1+Mm8Yx1J8dtObqUYeIVh/xJlCA2zTBB2MPdNz6IroIHqb4/ZYd2l9ZtNkIyCZ3PV5ulV1ShQD6H2gXmE1AnwQeojqrdKQYAehcDOYWxMAZNBK1piimEpQCCSiBlNKG4f14GTjqpI4WuqcZ7DGQtWqR3LVpNsKCdE9OHZo/Ep4Kp1AwQ+qhmLl0wA1SmHP7+0nxRI5i5w0Yl8NQx/v6W4j7ohWOwzpRRZ4rCz856oOVJqDDOMWqQfqYKQGY4WROpM447OsQ+svno3JVbqtvMDoRLBu6GEJtSl2DOvccPSqI2cxotsBzF+Ppz9EpeWtW+Wut6k-----END CERTIFICATE-----',
  576. certificates: {
  577. pems: [
  578. '-----BEGIN CERTIFICATE-----MIIDsDCCApigAwIBAgIJALAhpG3UDbqJMA0GCSqGSIb3DQEBCwUAMFAxCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDzANBgNVBAMMBlNlY0RldjAeFw0xNDEwMjMxNTEyMTZaFw0xNTEwMjMxNTEyMTZaME8xCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDjAMBgNVBAMMBVNlY1FBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyR4qNaHpEoj/48+iJtJUJuXv4i/KEKRKwrTYOVbDplyfTg0KMO+zeDd5SyE/aBnANetlZo8Ku0m1LPbUdge67Jzj3jinZ+iUQbkKr15YgMjehb3Y0V/02ImIr4+w8oXBGIN6eDpRt7tKrCPuyeRiWOZqIae7t5KY5enQ2NC6YbteTwjO/O1ldTnFo3xeDiuQ7P3zBmkAXaAxDxEE9dh61mB/QXVeJpphTgF8yoRWeZhl1S9YnNfTvMyXih8WzY/DlRTKs9JnqRmI7YhLDV95v3Aah1FhelG+l3FsWciE3brcZDa0Y+zumck2sy35PU3TF7RxifUumCEiNHEaawV7xQIDAQABo4GNMIGKMAwGA1UdEwQFMAMBAf8wLQYJYIZIAYb4QgENBCAWHlNjeXRsIFFBIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUvTPUuSVli1If5rJNV8KPE9+IN/gwHwYDVR0jBBgwFoAUDnogh/ZLwbQuOwiVIBJ08GAyLaQwCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQB/R7kXa2NblyepSBkdjIQNEvxmaryje9MQLJg+kRaWjpkWz0OW+a9vYoK+6hAt15RYFWNASTHF6StSe0En9F35fzaU8/XUxoKH5pmm7aypVIN7mWWV+XMv8iao1kP2tcpnk5tsvnuqBfqcU22r+oLLcnJ1hWy2kijtIBGEe+kxhZi2twlDG66RQpEZA2CmDjLHYbAXF7wnqiY9PSKwXcKPjcHXxs8LgPbbZjLRZ2FSvfgya/9drHfu7QYHRBFFHYljdgcpF/Z/nerocmvTgX8iuOu133JA3JmMOy3E7riVUfRkKh4Nnivh9S5mCKSff0yW4i+kJJ9TuAuDi30FN3tR-----END CERTIFICATE-----'
  579. ],
  580. subjects: [{
  581. commonName: 'SecQA',
  582. organization: 'Scytl',
  583. organizationUnit: 'QA',
  584. country: 'ES'
  585. }]
  586. }
  587. };
  588. var validations =
  589. box.certificates.service.validateX509CertificateChain(chain);
  590. expect(box.certificates.service.flattenFailedValidations(
  591. validations))
  592. .toEqual(['not_after_0']);
  593. });
  594. });
  595. });
  596. describe('Bug #97011', function() {
  597. it('certificate: no failed validations if add Time Reference validation for Leaf Certificate, set it the first day certificate is valid (at exact valid time or a few hours after to skip time zone conversion effect) and run validation',
  598. function() {
  599. cryptolib('certificates', function(box) {
  600. var validationData = {time: '2014-07-18\'T\'12:23:28Z'};
  601. var validator =
  602. new box.certificates.CryptoX509CertificateValidator(
  603. validationData);
  604. var validations = validator.validate(_userCertificatePem);
  605. expect(validations).toEqual([]);
  606. });
  607. });
  608. it('chain: no failed validations if add Time Reference validation for Leaf Certificate, set it the first day certificate is valid (at exact valid time or a few hours after to skip time zone conversion effect) and run validation',
  609. function() {
  610. cryptolib('certificates', function(box) {
  611. var chain = {
  612. leaf: {
  613. pem:
  614. '-----BEGIN CERTIFICATE-----MIIDszCCApugAwIBAgIJALAhpG3UDbqKMA0GCSqGSIb3DQEBCwUAME8xCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDjAMBgNVBAMMBVNlY1FBMB4XDTE0MTAyMzE1MTMxMVoXDTE1MTAyMzE1MTMxMVowVjELMAkGA1UEBhMCRVMxEzARBgNVBAgMClRlc3QtU3RhdGUxDjAMBgNVBAoMBVNjeXRsMQswCQYDVQQLDAJRQTEVMBMGA1UEAwwMU2VjRW5kRW50aXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1isXtrHkDvChE1jGCSnleAc547Hnswxhuf3XcTs6cG4y5oOgLgEZrbzHAe6Z47wBmt/35OC5oIa5tgmWBs7QVnAZ4PZWAdZTAq2J5TBQCcpilw2Kc5NHp231Ckw52pHT6/O4VieeZdOA/+PCbL7/4PrQ/Uq/23W1kHvUqToJTRwrOZFMg8QfTlo3RYN6xFmlW6hXCCHkolqihbK44jX6FELCLwbE1dw43eao5Pnbxw//2jyqReC2qrpcKQ4MdgJJYgK9rA+zCCj0m7H+LsNyiat4OTYvDVx9Lg7nmjgD2cFWewLDE9t4QVST41vYgWObJjisLyGsbEwLfOjXkf8jrQIDAQABo4GKMIGHMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgbAMC0GCWCGSAGG+EIBDQQgFh5TY3l0bCBRQSBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFLBtuBGwweIxC3h8ILFblDSg2x8SMB8GA1UdIwQYMBaAFL0z1LklZYtSH+ayTVfCjxPfiDf4MA0GCSqGSIb3DQEBCwUAA4IBAQBDTsidJItoNaPPp+idbBCLm8VrNxlVpWYQ4KmA6glCw5z7TcH1JW+GsfSxXfXo2bFGtxDFsjZCV76fBwoQVAvJ6ntCyn/vrslSQy6RvArM2e7Di6h6ND500so0a5mfycN7rauhj0tWcmZv3zExJcwgtar/P3BHYpfN9/eG46NpxRq4Sq9uwfYEH9lzAfZ3xgLWgIRAEoF6b2VRMU9ApVX/Ifai17+0JKhNkmBp63EUJCcXNSjTV4UtKTO2QFply4hOqluhMkFZDqFsbzB+mrSQcCget+6ymCVdTaN3GwVuW4CKIoR85Nr+3OV1VupDz3bnzqDjeiTNIJEV6aONP2zD-----END CERTIFICATE-----',
  615. keytype: 'Sign',
  616. subject: {
  617. commonName: 'SecEndEntity',
  618. organization: 'Scytl',
  619. organizationUnit: 'QA',
  620. country: 'ES'
  621. },
  622. time: '2014-10-23\'T\'19:11:28Z'
  623. },
  624. root:
  625. '-----BEGIN CERTIFICATE-----MIIDgDCCAmigAwIBAgIJALAhpG3UDbqIMA0GCSqGSIb3DQEBCwUAMFAxCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDzANBgNVBAMMBlNlY0RldjAeFw0xNDEwMjMxNTExMTJaFw0yNDEwMjAxNTExMTJaMFAxCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDzANBgNVBAMMBlNlY0RldjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKanbx9BsuYLjq4RVAS269FD2Gtpp3YkcvKHwHO5XI89+pJELO9CVnyIvEmon3ndbvPTqM3D/HOvl0M4/kPFeHij8d24iM48GVbYfLVBrV3BtKe24pHeIagSn6hl9ouiknbvDBqF8qZcBTNhnH8yX7isoJf3TShBpTOdyJ6XkDOQ+R0GtS1M4NN9BS74oGt0REC17VlBrO6JyR9rNswk4abqqpF7ekw1yXxcnrqa480+oyEcY9ji5QNoP9kGyibeB08seeB+wlt0fCWcJXtecsnPRpBNJmhLr4ziNyXoIOCEeVMA/MFx7vrrl+pkyhd49rQybbctv/mQGUM4QG6IZ3cCAwEAAaNdMFswHQYDVR0OBBYEFA56IIf2S8G0LjsIlSASdPBgMi2kMB8GA1UdIwQYMBaAFA56IIf2S8G0LjsIlSASdPBgMi2kMAwGA1UdEwQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQCE15Vvk+I+iR2RutD1+Mm8Yx1J8dtObqUYeIVh/xJlCA2zTBB2MPdNz6IroIHqb4/ZYd2l9ZtNkIyCZ3PV5ulV1ShQD6H2gXmE1AnwQeojqrdKQYAehcDOYWxMAZNBK1piimEpQCCSiBlNKG4f14GTjqpI4WuqcZ7DGQtWqR3LVpNsKCdE9OHZo/Ep4Kp1AwQ+qhmLl0wA1SmHP7+0nxRI5i5w0Yl8NQx/v6W4j7ohWOwzpRRZ4rCz856oOVJqDDOMWqQfqYKQGY4WROpM447OsQ+svno3JVbqtvMDoRLBu6GEJtSl2DOvccPSqI2cxotsBzF+Ppz9EpeWtW+Wut6k-----END CERTIFICATE-----',
  626. certificates: {
  627. pems: [
  628. '-----BEGIN CERTIFICATE-----MIIDsDCCApigAwIBAgIJALAhpG3UDbqJMA0GCSqGSIb3DQEBCwUAMFAxCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDzANBgNVBAMMBlNlY0RldjAeFw0xNDEwMjMxNTEyMTZaFw0xNTEwMjMxNTEyMTZaME8xCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDjAMBgNVBAMMBVNlY1FBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyR4qNaHpEoj/48+iJtJUJuXv4i/KEKRKwrTYOVbDplyfTg0KMO+zeDd5SyE/aBnANetlZo8Ku0m1LPbUdge67Jzj3jinZ+iUQbkKr15YgMjehb3Y0V/02ImIr4+w8oXBGIN6eDpRt7tKrCPuyeRiWOZqIae7t5KY5enQ2NC6YbteTwjO/O1ldTnFo3xeDiuQ7P3zBmkAXaAxDxEE9dh61mB/QXVeJpphTgF8yoRWeZhl1S9YnNfTvMyXih8WzY/DlRTKs9JnqRmI7YhLDV95v3Aah1FhelG+l3FsWciE3brcZDa0Y+zumck2sy35PU3TF7RxifUumCEiNHEaawV7xQIDAQABo4GNMIGKMAwGA1UdEwQFMAMBAf8wLQYJYIZIAYb4QgENBCAWHlNjeXRsIFFBIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUvTPUuSVli1If5rJNV8KPE9+IN/gwHwYDVR0jBBgwFoAUDnogh/ZLwbQuOwiVIBJ08GAyLaQwCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQB/R7kXa2NblyepSBkdjIQNEvxmaryje9MQLJg+kRaWjpkWz0OW+a9vYoK+6hAt15RYFWNASTHF6StSe0En9F35fzaU8/XUxoKH5pmm7aypVIN7mWWV+XMv8iao1kP2tcpnk5tsvnuqBfqcU22r+oLLcnJ1hWy2kijtIBGEe+kxhZi2twlDG66RQpEZA2CmDjLHYbAXF7wnqiY9PSKwXcKPjcHXxs8LgPbbZjLRZ2FSvfgya/9drHfu7QYHRBFFHYljdgcpF/Z/nerocmvTgX8iuOu133JA3JmMOy3E7riVUfRkKh4Nnivh9S5mCKSff0yW4i+kJJ9TuAuDi30FN3tR-----END CERTIFICATE-----'
  629. ],
  630. subjects: [{
  631. commonName: 'SecQA',
  632. organization: 'Scytl',
  633. organizationUnit: 'QA',
  634. country: 'ES'
  635. }]
  636. }
  637. };
  638. var validations =
  639. box.certificates.service.validateX509CertificateChain(chain);
  640. expect(box.certificates.service.flattenFailedValidations(
  641. validations))
  642. .not.toContain('time_0');
  643. });
  644. });
  645. it('certificate: failed validations if add Time Reference validation for Leaf Certificate, set it the last day certificate is valid (a minut after valid time expires or a few hours after to skip time zone conversion effect) and run validation',
  646. function() {
  647. cryptolib('certificates', function(box) {
  648. var validationData = {time: '2015-07-18\'T\'12:24:28Z'};
  649. var validator =
  650. new box.certificates.CryptoX509CertificateValidator(
  651. validationData);
  652. var validations = validator.validate(_userCertificatePem);
  653. expect(validations).toEqual(['TIME']);
  654. });
  655. });
  656. it('chain: failed validations if add Time Reference validation for Leaf Certificate, set it the last day certificate is valid (a minut after valid time expires or a few hours after to skip time zone conversion effect) and run validation',
  657. function() {
  658. cryptolib('certificates', function(box) {
  659. var chain = {
  660. leaf: {
  661. pem:
  662. '-----BEGIN CERTIFICATE-----MIIDszCCApugAwIBAgIJALAhpG3UDbqKMA0GCSqGSIb3DQEBCwUAME8xCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDjAMBgNVBAMMBVNlY1FBMB4XDTE0MTAyMzE1MTMxMVoXDTE1MTAyMzE1MTMxMVowVjELMAkGA1UEBhMCRVMxEzARBgNVBAgMClRlc3QtU3RhdGUxDjAMBgNVBAoMBVNjeXRsMQswCQYDVQQLDAJRQTEVMBMGA1UEAwwMU2VjRW5kRW50aXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1isXtrHkDvChE1jGCSnleAc547Hnswxhuf3XcTs6cG4y5oOgLgEZrbzHAe6Z47wBmt/35OC5oIa5tgmWBs7QVnAZ4PZWAdZTAq2J5TBQCcpilw2Kc5NHp231Ckw52pHT6/O4VieeZdOA/+PCbL7/4PrQ/Uq/23W1kHvUqToJTRwrOZFMg8QfTlo3RYN6xFmlW6hXCCHkolqihbK44jX6FELCLwbE1dw43eao5Pnbxw//2jyqReC2qrpcKQ4MdgJJYgK9rA+zCCj0m7H+LsNyiat4OTYvDVx9Lg7nmjgD2cFWewLDE9t4QVST41vYgWObJjisLyGsbEwLfOjXkf8jrQIDAQABo4GKMIGHMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgbAMC0GCWCGSAGG+EIBDQQgFh5TY3l0bCBRQSBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFLBtuBGwweIxC3h8ILFblDSg2x8SMB8GA1UdIwQYMBaAFL0z1LklZYtSH+ayTVfCjxPfiDf4MA0GCSqGSIb3DQEBCwUAA4IBAQBDTsidJItoNaPPp+idbBCLm8VrNxlVpWYQ4KmA6glCw5z7TcH1JW+GsfSxXfXo2bFGtxDFsjZCV76fBwoQVAvJ6ntCyn/vrslSQy6RvArM2e7Di6h6ND500so0a5mfycN7rauhj0tWcmZv3zExJcwgtar/P3BHYpfN9/eG46NpxRq4Sq9uwfYEH9lzAfZ3xgLWgIRAEoF6b2VRMU9ApVX/Ifai17+0JKhNkmBp63EUJCcXNSjTV4UtKTO2QFply4hOqluhMkFZDqFsbzB+mrSQcCget+6ymCVdTaN3GwVuW4CKIoR85Nr+3OV1VupDz3bnzqDjeiTNIJEV6aONP2zD-----END CERTIFICATE-----',
  663. keytype: 'Sign',
  664. subject: {
  665. commonName: 'SecEndEntity',
  666. organization: 'Scytl',
  667. organizationUnit: 'QA',
  668. country: 'ES'
  669. },
  670. time: '2015-10-23\'T\'19:12:28Z'
  671. },
  672. root:
  673. '-----BEGIN CERTIFICATE-----MIIDgDCCAmigAwIBAgIJALAhpG3UDbqIMA0GCSqGSIb3DQEBCwUAMFAxCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDzANBgNVBAMMBlNlY0RldjAeFw0xNDEwMjMxNTExMTJaFw0yNDEwMjAxNTExMTJaMFAxCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDzANBgNVBAMMBlNlY0RldjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKanbx9BsuYLjq4RVAS269FD2Gtpp3YkcvKHwHO5XI89+pJELO9CVnyIvEmon3ndbvPTqM3D/HOvl0M4/kPFeHij8d24iM48GVbYfLVBrV3BtKe24pHeIagSn6hl9ouiknbvDBqF8qZcBTNhnH8yX7isoJf3TShBpTOdyJ6XkDOQ+R0GtS1M4NN9BS74oGt0REC17VlBrO6JyR9rNswk4abqqpF7ekw1yXxcnrqa480+oyEcY9ji5QNoP9kGyibeB08seeB+wlt0fCWcJXtecsnPRpBNJmhLr4ziNyXoIOCEeVMA/MFx7vrrl+pkyhd49rQybbctv/mQGUM4QG6IZ3cCAwEAAaNdMFswHQYDVR0OBBYEFA56IIf2S8G0LjsIlSASdPBgMi2kMB8GA1UdIwQYMBaAFA56IIf2S8G0LjsIlSASdPBgMi2kMAwGA1UdEwQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQCE15Vvk+I+iR2RutD1+Mm8Yx1J8dtObqUYeIVh/xJlCA2zTBB2MPdNz6IroIHqb4/ZYd2l9ZtNkIyCZ3PV5ulV1ShQD6H2gXmE1AnwQeojqrdKQYAehcDOYWxMAZNBK1piimEpQCCSiBlNKG4f14GTjqpI4WuqcZ7DGQtWqR3LVpNsKCdE9OHZo/Ep4Kp1AwQ+qhmLl0wA1SmHP7+0nxRI5i5w0Yl8NQx/v6W4j7ohWOwzpRRZ4rCz856oOVJqDDOMWqQfqYKQGY4WROpM447OsQ+svno3JVbqtvMDoRLBu6GEJtSl2DOvccPSqI2cxotsBzF+Ppz9EpeWtW+Wut6k-----END CERTIFICATE-----',
  674. certificates: {
  675. pems: [
  676. '-----BEGIN CERTIFICATE-----MIIDsDCCApigAwIBAgIJALAhpG3UDbqJMA0GCSqGSIb3DQEBCwUAMFAxCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDzANBgNVBAMMBlNlY0RldjAeFw0xNDEwMjMxNTEyMTZaFw0xNTEwMjMxNTEyMTZaME8xCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDjAMBgNVBAMMBVNlY1FBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyR4qNaHpEoj/48+iJtJUJuXv4i/KEKRKwrTYOVbDplyfTg0KMO+zeDd5SyE/aBnANetlZo8Ku0m1LPbUdge67Jzj3jinZ+iUQbkKr15YgMjehb3Y0V/02ImIr4+w8oXBGIN6eDpRt7tKrCPuyeRiWOZqIae7t5KY5enQ2NC6YbteTwjO/O1ldTnFo3xeDiuQ7P3zBmkAXaAxDxEE9dh61mB/QXVeJpphTgF8yoRWeZhl1S9YnNfTvMyXih8WzY/DlRTKs9JnqRmI7YhLDV95v3Aah1FhelG+l3FsWciE3brcZDa0Y+zumck2sy35PU3TF7RxifUumCEiNHEaawV7xQIDAQABo4GNMIGKMAwGA1UdEwQFMAMBAf8wLQYJYIZIAYb4QgENBCAWHlNjeXRsIFFBIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUvTPUuSVli1If5rJNV8KPE9+IN/gwHwYDVR0jBBgwFoAUDnogh/ZLwbQuOwiVIBJ08GAyLaQwCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQB/R7kXa2NblyepSBkdjIQNEvxmaryje9MQLJg+kRaWjpkWz0OW+a9vYoK+6hAt15RYFWNASTHF6StSe0En9F35fzaU8/XUxoKH5pmm7aypVIN7mWWV+XMv8iao1kP2tcpnk5tsvnuqBfqcU22r+oLLcnJ1hWy2kijtIBGEe+kxhZi2twlDG66RQpEZA2CmDjLHYbAXF7wnqiY9PSKwXcKPjcHXxs8LgPbbZjLRZ2FSvfgya/9drHfu7QYHRBFFHYljdgcpF/Z/nerocmvTgX8iuOu133JA3JmMOy3E7riVUfRkKh4Nnivh9S5mCKSff0yW4i+kJJ9TuAuDi30FN3tR-----END CERTIFICATE-----'
  677. ],
  678. subjects: [{
  679. commonName: 'SecQA',
  680. organization: 'Scytl',
  681. organizationUnit: 'QA',
  682. country: 'ES'
  683. }]
  684. }
  685. };
  686. var validations =
  687. box.certificates.service.validateX509CertificateChain(chain);
  688. expect(box.certificates.service.flattenFailedValidations(
  689. validations))
  690. .toContain('time_0');
  691. });
  692. });
  693. });
  694. // commented when validations were commented
  695. describe('Bug #97028', function() {
  696. it('it should not be not_before_2 missing if there is an error in the second certicate of the chain',
  697. function() {
  698. cryptolib('certificates', function(box) {
  699. var chain = {
  700. leaf: {
  701. pem:
  702. '-----BEGIN CERTIFICATE-----MIIDszCCApugAwIBAgIJAJZdx2FxigSQMA0GCSqGSIb3DQEBCwUAME8xCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDjAMBgNVBAMMBVNlY1FBMB4XDTE0MTAyMzE1MzYxOVoXDTE1MTAyMzE1MzYxOVowVjELMAkGA1UEBhMCRVMxEzARBgNVBAgMClRlc3QtU3RhdGUxDjAMBgNVBAoMBVNjeXRsMQswCQYDVQQLDAJRQTEVMBMGA1UEAwwMU2VjRW5kRW50aXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwFcomvOSzm2HkrOodZ93pyCxkpW7CVUMYC9zusJ7SdHEhcMib+44+rcfjnxPLmSO9xZTRYQo1DXwktEqkMutNih+YB51MPddKFylvMP9cUKkT1sIJzoIhRXC+xOtPAILfYx2XsNJCuRrEKM27JrC2xIVCBIiJuNz6UyFe7ZvtKmt+n40Nsi4Mcx0DhGRuZ3uhuA5OEotbG6VZZVhAovYFh09x+GyT1Dpug8NRD+mM+g1qJkhNZ+MST/rtw5DB++S+VwVLyVfxrTNycUafWWHAIMsjRlp6qlgfK32yY6N0haZXvP4RcXYSIWZK5ON+6r5lIY/FBR2m7eiGxlxdPkr7QIDAQABo4GKMIGHMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgbAMC0GCWCGSAGG+EIBDQQgFh5TY3l0bCBRQSBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFAOC8miWiUpLGw0TQzpjMUhAyYtvMB8GA1UdIwQYMBaAFDK0r97umjjsFvU6NAkgEvKeaIMVMA0GCSqGSIb3DQEBCwUAA4IBAQAQH64q51KivF3lUd78nOvHzuv04pUGihcVnYm3MTnXiODpwj4f6s5sZnAUWB+BOCJ1btaJvNAWUpnOH36nLr+qKV5mIxOyiKQWxY0tunySctsOpSscW/OfatvOUdkjshC7QuNq0fhjYh8SGO9Bk4ePO0uaIEWWywaH0wHVJPFaETklFXg3TZr61T5scrDEfs+lk+fQjkJ0YiS4e5VKfS7uVPLtDLgT9sx3l1QlVV2xZ8jF7hPpTy0JX8adp0NEQd+kfFFQuuSnY0QfLKtut9LHIjrl2q2sLfi0ibJ+uokCY85XZeyPzovIaSu3b2941E3dxL6UbDCEJyjlffybakyN-----END CERTIFICATE-----',
  703. keytype: 'Sign',
  704. subject: {
  705. commonName: 'SecEndEntity',
  706. organization: 'Scytl',
  707. organizationUnit: 'QA',
  708. country: 'ES'
  709. },
  710. },
  711. root:
  712. '-----BEGIN CERTIFICATE-----MIIDgDCCAmigAwIBAgIJAJZdx2FxigSOMA0GCSqGSIb3DQEBCwUAMFAxCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDzANBgNVBAMMBlNlY0RldjAeFw0xNDEwMjMxNTQ0MzdaFw0yNDEwMjAxNTQ0MzdaMFAxCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDzANBgNVBAMMBlNlY0RldjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL4xWFqJpuQtcbywy9aYeH1X8cvlueJNPG/ixZsZjXY5KUdq7bjBLDlns49UWw96uxbU+JEL5aKMibtA8sJP9ZhDKY15ps9+wtceFnkT0g0IZ1shupQPEOKH2UfIS5/2teL7vjCplX3mDX8YOgzLqlqFrVtifejH2ETRzpDFc7K/P3KtSQqGKYUEZw5olCdLcg9Fp+I9QVkNGGr6Ds16BGWnb6Pgm5NOegdoOJLF6vZkhvyTYz9/Tg2men/HJLCVCXhbYwfUcu0ezj8w5G6zCdxVrqSTvjHVzp0kskVGRZjlrEOFLvswOGTjAon/U4iuBtqR+pLZg4Law+ETujPJPs0CAwEAAaNdMFswHQYDVR0OBBYEFKh4F63r8K3uM97VcdOYg3vylSHzMB8GA1UdIwQYMBaAFKh4F63r8K3uM97VcdOYg3vylSHzMAwGA1UdEwQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQAq2bLqJ+cLtnivXrNP5j9YL031zAO6xQDehxqasKOb7e6pdB8NKAOwa7smXCRsJxphT2vTv+VsecD/b8D3irEV000pbemeVmyrnOyaJxTCjBRvhjIbOmaBZ5k0KfxDubT8xx9H8Im+jxX0tZU5IQuTBG+Izd+5Dm5kxAhh7JDzclUYfUMDYrv43/7zm5wPkRqqK5SY7J4CPMiW3Uzxpc+uPCwydMSTYbDTdNN5nf0eDGepm2h/iewfickgkCFoNe6b3nxlQiK8EL9FUSKeq+1AWVnT3riC8C/CXTZwKo3ULXkKe3Jl3mvVYjkz/O/3NzeTfFdktuNaSh28Wrzlb9h4-----END CERTIFICATE-----',
  713. certificates: {
  714. pems: [
  715. '-----BEGIN CERTIFICATE-----MIIDsDCCApigAwIBAgIJAJZdx2FxigSPMA0GCSqGSIb3DQEBCwUAMFAxCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDzANBgNVBAMMBlNlY0RldjAeFw0xNDEwMjMxNTQyMDJaFw0xNTEwMjMxNTQyMDJaME8xCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDjAMBgNVBAMMBVNlY1FBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlvRn5OjWMaQfWCknqnsTzupcpx6zPQCLDe9DbizYRBghJcr4UlxI1uLsCHHzEMXCta5rJ+PSQ+TZ71PP7Ep3JyLAYObhVM8ltQyAKm8fgZa/FhCer46O3CohiD0Cdjg3r+qGOB+OKcGigXnNSoEsBlJ7HTzi5egiSg6D1Mx4uNw35F15ahTDxzIT/HN/Dnl3fEGzuJFebhSxj3u/+EEFJQrYvl62bUzzpXKlg/1C8BUYUXcPqhuUwZhyxE/DKyunA489XwpvN11y9NgygKb45qFAi9WmXil7q5JkW8iBqhXWbAoGiYf8nG5OanQBHERmAYAzJBI3QCK+6WiDXCRT/wIDAQABo4GNMIGKMAwGA1UdEwQFMAMBAf8wLQYJYIZIAYb4QgENBCAWHlNjeXRsIFFBIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUMrSv3u6aOOwW9To0CSAS8p5ogxUwHwYDVR0jBBgwFoAUqHgXrevwre4z3tVx05iDe/KVIfMwCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQA/Jxb3/gHb6mGyTEti+g3Zs5nrX64dtbFPWEgpyKu2jZ0ZoyllAUThIBjwvPw0hI3LqTOG06CCrgrPmndakasc5bJTEokshoI/IxTp/itME3ZBx/TUpu6v3baHYQ5C3HcKGhJxScikeO/Gh17A71Q4wA1PbLQ8jHCgfAFIODbXNRcYj8BVpv+7rXY/px4ai2UEf6ZAQZ3H6OyN9PGRA4EABJEiBsRNJvzcUcfq1JHF02FNlhFn8ZZXxOzpSc9bYX8trJGgB6GXDj2BPnFzsz1+ksNW6CaLU9AuuS2Bj/NseF2WVRwi3nCIvAPbpgAhivIHZOxY/eNRjJijo7+OKG40-----END CERTIFICATE-----'
  716. ],
  717. subjects: [{
  718. commonName: 'SecQA',
  719. organization: 'Scytl',
  720. organizationUnit: 'QA',
  721. country: 'ES'
  722. }]
  723. }
  724. };
  725. var validations =
  726. box.certificates.service.validateX509CertificateChain(chain);
  727. expect(box.certificates.service.flattenFailedValidations(
  728. validations))
  729. .toContain('not_before_0');
  730. expect(box.certificates.service.flattenFailedValidations(
  731. validations))
  732. .toContain('not_before_1');
  733. });
  734. });
  735. });
  736. describe('Bug #96959', function() {
  737. it('The subject error should be related to the right certificate in the chain',
  738. function() {
  739. cryptolib('certificates', function(box) {
  740. var chain = {
  741. leaf: {
  742. pem:
  743. '-----BEGIN CERTIFICATE-----MIICCzCCAXSgAwIBAgIBATANBgkqhkiG9w0BAQUFADBHMRswGQYDVQQDDBJ3aGl0ZSBpbnRlcm1lZGlhdGUxDjAMBgNVBAoMBXNjeXRsMQswCQYDVQQLDAJzZTELMAkGA1UEBhMCRVMwHhcNMTQwOTA1MTAxNDEzWhcNMjQwODEzMTAxNDEzWjA/MRMwEQYDVQQDDAp3aGl0ZSBsZWFmMQ4wDAYDVQQKDAVzY3l0bDELMAkGA1UECwwCc2UxCzAJBgNVBAYTAkVTMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3yWZQRc5xk14TIL3/2UGVgNz94dHq7vg4ORduUvtio4nVMSriQNSPnEbAfV9FR8qA6UCzqXQroNX6eSpQfJ4MblyUWUj7VYtY/jC2UxGcE4GJxhngiwfO+It2ejTr6I7EPlj7pwPOVTDWByaDsYWtJ3JeaVhR9Tcf5L+H5k7HTQIDAQABow8wDTALBgNVHQ8EBAMCBsAwDQYJKoZIhvcNAQEFBQADgYEAQNoV1G2zwceE1/4VppH3eJYi8u1CUWUoaQe1rH3owm9CH9/OfS+MicUIW/7yRi86rtATnhTcfN34E18AwbJsmESBnCkx+WaVZ/WC1jGJ/Dd5rgxvRfZpwd1RKivKzZsoYm19PVFRDg9K9qqA6dkuq29wTnwMV48rQPkfix9lWjg=-----END CERTIFICATE-----',
  744. keytype: 'Sign',
  745. subject: {
  746. commonName: 'white leaf',
  747. organization: 'scytl',
  748. organizationUnit: 'se',
  749. country: 'ES'
  750. },
  751. time: '2014-12-25\'T\'00:00:00Z'
  752. },
  753. root:
  754. '-----BEGIN CERTIFICATE-----MIICSDCCAbGgAwIBAgIJAPJ2LYuwqa81MA0GCSqGSIb3DQEBBQUAMD0xETAPBgNVBAMMCHdoaXRlIGNhMQ4wDAYDVQQKDAVzY3l0bDELMAkGA1UECwwCc2UxCzAJBgNVBAYTAkVTMB4XDTE0MDkwNTA5MzQwNloXDTI0MDkwMjA5MzQwNlowPTERMA8GA1UEAwwId2hpdGUgY2ExDjAMBgNVBAoMBXNjeXRsMQswCQYDVQQLDAJzZTELMAkGA1UEBhMCRVMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALnpKp2eeY1hC4V8E1nUIZJpJVhAZk3oJeEbq0Xi2uSYrh6wmfuQIHFs5rYF4yHoGvf+PM66od8ccHa1GNGB/b6lFb4/+2vEvYWA51OWY9BBdgjhAsqoks9ANNDQ1oxX4dqLwjM/GDDg2v9xoT9tj0CaJnieQbhMkH8oQveBBR57AgMBAAGjUDBOMB0GA1UdDgQWBBRwKg/RntWH8EvCkEX3jtHuvSpbwTAfBgNVHSMEGDAWgBRwKg/RntWH8EvCkEX3jtHuvSpbwTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBADk/OOoc2tbfxja95RqH22EcAVJ/mDin2ev9cXhZ2A2xh4SrUad0fNsyFnY+m3EzfA0KPrI46sEPDeuWqwnGAYccmp7ylVIS6edYRvnI5mdLze2CnuDNJYQzZXjASQF2ih5wTNm3VMZkN0SqGQZiOCa9NQHPfmNj8mJe0Ooj2b3o-----END CERTIFICATE-----',
  755. certificates: {
  756. pems: [
  757. '-----BEGIN CERTIFICATE-----MIICGjCCAYOgAwIBAgIBATANBgkqhkiG9w0BAQUFADA9MREwDwYDVQQDDAh3aGl0ZSBjYTEOMAwGA1UECgwFc2N5dGwxCzAJBgNVBAsMAnNlMQswCQYDVQQGEwJFUzAeFw0xNDA5MDUwOTM1MThaFw0yNDA4MjMwOTM1MThaMEcxGzAZBgNVBAMMEndoaXRlIGludGVybWVkaWF0ZTEOMAwGA1UECgwFc2N5dGwxCzAJBgNVBAsMAnNlMQswCQYDVQQGEwJFUzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwUmpmT/rNcxIP8Xulj0RcbdvaNGJNoEPMzEGztguB+mKsTPgJIlrKvdskY5NIPd1+hzS+HjvW11uwyT2FnmyfKBqND4EH5BqU8Ph4bAyrT950DPcOGE4vG0fLO0jTD3h0n4d4yugWmrND2sScFZQsGLbgOYX4QM8vV+owoKNRxMCAwEAAaMgMB4wDwYDVR0TBAgwBgEB/wIBADALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEFBQADgYEAF0B5LQDo3uRs9dSkxp39ER64XIa6XYV0zdbq+fqHg8Qcoggpox7vwmc6YoCNQpfY2zLiIUMbb6VMP4pkp7jZMju9TBKPOjMFrQKom0cowT/gYdokgnsk8yUYOdo46GJR43PjFLTiQk5JDawWaECbhcgyLf59AalX9z9dbY0AwqI=-----END CERTIFICATE-----'
  758. ],
  759. subjects: [{
  760. commonName: 'white intermediate wrong',
  761. organization: 'scytl',
  762. organizationUnit: 'se',
  763. country: 'ES'
  764. }]
  765. }
  766. };
  767. var validations =
  768. box.certificates.service.validateX509CertificateChain(chain);
  769. expect(box.certificates.service.flattenFailedValidations(
  770. validations))
  771. .toContain('subject_1');
  772. });
  773. });
  774. });
  775. describe('Bug #96958', function() {
  776. it('a Sign KeyType for Leaf Certificate must relult in a KEY_TYPE error if checked with CA',
  777. function() {
  778. cryptolib('certificates', function(box) {
  779. var chain = {
  780. leaf: {
  781. pem:
  782. '-----BEGIN CERTIFICATE-----MIICCzCCAXSgAwIBAgIBATANBgkqhkiG9w0BAQUFADBHMRswGQYDVQQDDBJ3aGl0ZSBpbnRlcm1lZGlhdGUxDjAMBgNVBAoMBXNjeXRsMQswCQYDVQQLDAJzZTELMAkGA1UEBhMCRVMwHhcNMTQwOTA1MTAxNDEzWhcNMjQwODEzMTAxNDEzWjA/MRMwEQYDVQQDDAp3aGl0ZSBsZWFmMQ4wDAYDVQQKDAVzY3l0bDELMAkGA1UECwwCc2UxCzAJBgNVBAYTAkVTMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3yWZQRc5xk14TIL3/2UGVgNz94dHq7vg4ORduUvtio4nVMSriQNSPnEbAfV9FR8qA6UCzqXQroNX6eSpQfJ4MblyUWUj7VYtY/jC2UxGcE4GJxhngiwfO+It2ejTr6I7EPlj7pwPOVTDWByaDsYWtJ3JeaVhR9Tcf5L+H5k7HTQIDAQABow8wDTALBgNVHQ8EBAMCBsAwDQYJKoZIhvcNAQEFBQADgYEAQNoV1G2zwceE1/4VppH3eJYi8u1CUWUoaQe1rH3owm9CH9/OfS+MicUIW/7yRi86rtATnhTcfN34E18AwbJsmESBnCkx+WaVZ/WC1jGJ/Dd5rgxvRfZpwd1RKivKzZsoYm19PVFRDg9K9qqA6dkuq29wTnwMV48rQPkfix9lWjg=-----END CERTIFICATE-----',
  783. keyType: 'CA',
  784. subject: {
  785. commonName: 'white leaf',
  786. organization: 'scytl',
  787. organizationUnit: 'se',
  788. country: 'ES'
  789. },
  790. time: '2014-12-25\'T\'00:00:00Z'
  791. },
  792. root:
  793. '-----BEGIN CERTIFICATE-----MIICSDCCAbGgAwIBAgIJAPJ2LYuwqa81MA0GCSqGSIb3DQEBBQUAMD0xETAPBgNVBAMMCHdoaXRlIGNhMQ4wDAYDVQQKDAVzY3l0bDELMAkGA1UECwwCc2UxCzAJBgNVBAYTAkVTMB4XDTE0MDkwNTA5MzQwNloXDTI0MDkwMjA5MzQwNlowPTERMA8GA1UEAwwId2hpdGUgY2ExDjAMBgNVBAoMBXNjeXRsMQswCQYDVQQLDAJzZTELMAkGA1UEBhMCRVMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALnpKp2eeY1hC4V8E1nUIZJpJVhAZk3oJeEbq0Xi2uSYrh6wmfuQIHFs5rYF4yHoGvf+PM66od8ccHa1GNGB/b6lFb4/+2vEvYWA51OWY9BBdgjhAsqoks9ANNDQ1oxX4dqLwjM/GDDg2v9xoT9tj0CaJnieQbhMkH8oQveBBR57AgMBAAGjUDBOMB0GA1UdDgQWBBRwKg/RntWH8EvCkEX3jtHuvSpbwTAfBgNVHSMEGDAWgBRwKg/RntWH8EvCkEX3jtHuvSpbwTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBADk/OOoc2tbfxja95RqH22EcAVJ/mDin2ev9cXhZ2A2xh4SrUad0fNsyFnY+m3EzfA0KPrI46sEPDeuWqwnGAYccmp7ylVIS6edYRvnI5mdLze2CnuDNJYQzZXjASQF2ih5wTNm3VMZkN0SqGQZiOCa9NQHPfmNj8mJe0Ooj2b3o-----END CERTIFICATE-----',
  794. certificates: {
  795. pems: [
  796. '-----BEGIN CERTIFICATE-----MIICGjCCAYOgAwIBAgIBATANBgkqhkiG9w0BAQUFADA9MREwDwYDVQQDDAh3aGl0ZSBjYTEOMAwGA1UECgwFc2N5dGwxCzAJBgNVBAsMAnNlMQswCQYDVQQGEwJFUzAeFw0xNDA5MDUwOTM1MThaFw0yNDA4MjMwOTM1MThaMEcxGzAZBgNVBAMMEndoaXRlIGludGVybWVkaWF0ZTEOMAwGA1UECgwFc2N5dGwxCzAJBgNVBAsMAnNlMQswCQYDVQQGEwJFUzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwUmpmT/rNcxIP8Xulj0RcbdvaNGJNoEPMzEGztguB+mKsTPgJIlrKvdskY5NIPd1+hzS+HjvW11uwyT2FnmyfKBqND4EH5BqU8Ph4bAyrT950DPcOGE4vG0fLO0jTD3h0n4d4yugWmrND2sScFZQsGLbgOYX4QM8vV+owoKNRxMCAwEAAaMgMB4wDwYDVR0TBAgwBgEB/wIBADALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEFBQADgYEAF0B5LQDo3uRs9dSkxp39ER64XIa6XYV0zdbq+fqHg8Qcoggpox7vwmc6YoCNQpfY2zLiIUMbb6VMP4pkp7jZMju9TBKPOjMFrQKom0cowT/gYdokgnsk8yUYOdo46GJR43PjFLTiQk5JDawWaECbhcgyLf59AalX9z9dbY0AwqI=-----END CERTIFICATE-----'
  797. ],
  798. subjects: [{
  799. commonName: 'white intermediate',
  800. organization: 'scytl',
  801. organizationUnit: 'se',
  802. country: 'ES'
  803. }]
  804. }
  805. };
  806. var validations =
  807. box.certificates.service.validateX509CertificateChain(chain);
  808. expect(box.certificates.service.flattenFailedValidations(
  809. validations))
  810. .toContain('key_type_0');
  811. });
  812. });
  813. it('a Sign KeyType for Leaf Certificate must result in a KEY_TYPE error if checked with Encryption',
  814. function() {
  815. cryptolib('certificates', function(box) {
  816. var chain = {
  817. leaf: {
  818. pem:
  819. '-----BEGIN CERTIFICATE-----MIICCzCCAXSgAwIBAgIBATANBgkqhkiG9w0BAQUFADBHMRswGQYDVQQDDBJ3aGl0ZSBpbnRlcm1lZGlhdGUxDjAMBgNVBAoMBXNjeXRsMQswCQYDVQQLDAJzZTELMAkGA1UEBhMCRVMwHhcNMTQwOTA1MTAxNDEzWhcNMjQwODEzMTAxNDEzWjA/MRMwEQYDVQQDDAp3aGl0ZSBsZWFmMQ4wDAYDVQQKDAVzY3l0bDELMAkGA1UECwwCc2UxCzAJBgNVBAYTAkVTMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3yWZQRc5xk14TIL3/2UGVgNz94dHq7vg4ORduUvtio4nVMSriQNSPnEbAfV9FR8qA6UCzqXQroNX6eSpQfJ4MblyUWUj7VYtY/jC2UxGcE4GJxhngiwfO+It2ejTr6I7EPlj7pwPOVTDWByaDsYWtJ3JeaVhR9Tcf5L+H5k7HTQIDAQABow8wDTALBgNVHQ8EBAMCBsAwDQYJKoZIhvcNAQEFBQADgYEAQNoV1G2zwceE1/4VppH3eJYi8u1CUWUoaQe1rH3owm9CH9/OfS+MicUIW/7yRi86rtATnhTcfN34E18AwbJsmESBnCkx+WaVZ/WC1jGJ/Dd5rgxvRfZpwd1RKivKzZsoYm19PVFRDg9K9qqA6dkuq29wTnwMV48rQPkfix9lWjg=-----END CERTIFICATE-----',
  820. keyType: 'Encryption',
  821. subject: {
  822. commonName: 'white leaf',
  823. organization: 'scytl',
  824. organizationUnit: 'se',
  825. country: 'ES'
  826. },
  827. time: '2014-12-25\'T\'00:00:00Z'
  828. },
  829. root:
  830. '-----BEGIN CERTIFICATE-----MIICSDCCAbGgAwIBAgIJAPJ2LYuwqa81MA0GCSqGSIb3DQEBBQUAMD0xETAPBgNVBAMMCHdoaXRlIGNhMQ4wDAYDVQQKDAVzY3l0bDELMAkGA1UECwwCc2UxCzAJBgNVBAYTAkVTMB4XDTE0MDkwNTA5MzQwNloXDTI0MDkwMjA5MzQwNlowPTERMA8GA1UEAwwId2hpdGUgY2ExDjAMBgNVBAoMBXNjeXRsMQswCQYDVQQLDAJzZTELMAkGA1UEBhMCRVMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALnpKp2eeY1hC4V8E1nUIZJpJVhAZk3oJeEbq0Xi2uSYrh6wmfuQIHFs5rYF4yHoGvf+PM66od8ccHa1GNGB/b6lFb4/+2vEvYWA51OWY9BBdgjhAsqoks9ANNDQ1oxX4dqLwjM/GDDg2v9xoT9tj0CaJnieQbhMkH8oQveBBR57AgMBAAGjUDBOMB0GA1UdDgQWBBRwKg/RntWH8EvCkEX3jtHuvSpbwTAfBgNVHSMEGDAWgBRwKg/RntWH8EvCkEX3jtHuvSpbwTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBADk/OOoc2tbfxja95RqH22EcAVJ/mDin2ev9cXhZ2A2xh4SrUad0fNsyFnY+m3EzfA0KPrI46sEPDeuWqwnGAYccmp7ylVIS6edYRvnI5mdLze2CnuDNJYQzZXjASQF2ih5wTNm3VMZkN0SqGQZiOCa9NQHPfmNj8mJe0Ooj2b3o-----END CERTIFICATE-----',
  831. certificates: {
  832. pems: [
  833. '-----BEGIN CERTIFICATE-----MIICGjCCAYOgAwIBAgIBATANBgkqhkiG9w0BAQUFADA9MREwDwYDVQQDDAh3aGl0ZSBjYTEOMAwGA1UECgwFc2N5dGwxCzAJBgNVBAsMAnNlMQswCQYDVQQGEwJFUzAeFw0xNDA5MDUwOTM1MThaFw0yNDA4MjMwOTM1MThaMEcxGzAZBgNVBAMMEndoaXRlIGludGVybWVkaWF0ZTEOMAwGA1UECgwFc2N5dGwxCzAJBgNVBAsMAnNlMQswCQYDVQQGEwJFUzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwUmpmT/rNcxIP8Xulj0RcbdvaNGJNoEPMzEGztguB+mKsTPgJIlrKvdskY5NIPd1+hzS+HjvW11uwyT2FnmyfKBqND4EH5BqU8Ph4bAyrT950DPcOGE4vG0fLO0jTD3h0n4d4yugWmrND2sScFZQsGLbgOYX4QM8vV+owoKNRxMCAwEAAaMgMB4wDwYDVR0TBAgwBgEB/wIBADALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEFBQADgYEAF0B5LQDo3uRs9dSkxp39ER64XIa6XYV0zdbq+fqHg8Qcoggpox7vwmc6YoCNQpfY2zLiIUMbb6VMP4pkp7jZMju9TBKPOjMFrQKom0cowT/gYdokgnsk8yUYOdo46GJR43PjFLTiQk5JDawWaECbhcgyLf59AalX9z9dbY0AwqI=-----END CERTIFICATE-----'
  834. ],
  835. subjects: [{
  836. commonName: 'white intermediate',
  837. organization: 'scytl',
  838. organizationUnit: 'se',
  839. country: 'ES'
  840. }]
  841. }
  842. };
  843. var validations =
  844. box.certificates.service.validateX509CertificateChain(chain);
  845. expect(box.certificates.service.flattenFailedValidations(
  846. validations))
  847. .toContain('key_type_0');
  848. });
  849. });
  850. it('if a certificate KeyType is CA en you test for Sign the validation must fail',
  851. function() {
  852. cryptolib('certificates', function(box) {
  853. var validationData = {keyType: 'Sign'};
  854. var validator =
  855. new box.certificates.CryptoX509CertificateValidator(
  856. validationData);
  857. var ca =
  858. '-----BEGIN CERTIFICATE-----MIICSDCCAbGgAwIBAgIJAPJ2LYuwqa81MA0GCSqGSIb3DQEBBQUAMD0xETAPBgNVBAMMCHdoaXRlIGNhMQ4wDAYDVQQKDAVzY3l0bDELMAkGA1UECwwCc2UxCzAJBgNVBAYTAkVTMB4XDTE0MDkwNTA5MzQwNloXDTI0MDkwMjA5MzQwNlowPTERMA8GA1UEAwwId2hpdGUgY2ExDjAMBgNVBAoMBXNjeXRsMQswCQYDVQQLDAJzZTELMAkGA1UEBhMCRVMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALnpKp2eeY1hC4V8E1nUIZJpJVhAZk3oJeEbq0Xi2uSYrh6wmfuQIHFs5rYF4yHoGvf+PM66od8ccHa1GNGB/b6lFb4/+2vEvYWA51OWY9BBdgjhAsqoks9ANNDQ1oxX4dqLwjM/GDDg2v9xoT9tj0CaJnieQbhMkH8oQveBBR57AgMBAAGjUDBOMB0GA1UdDgQWBBRwKg/RntWH8EvCkEX3jtHuvSpbwTAfBgNVHSMEGDAWgBRwKg/RntWH8EvCkEX3jtHuvSpbwTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBADk/OOoc2tbfxja95RqH22EcAVJ/mDin2ev9cXhZ2A2xh4SrUad0fNsyFnY+m3EzfA0KPrI46sEPDeuWqwnGAYccmp7ylVIS6edYRvnI5mdLze2CnuDNJYQzZXjASQF2ih5wTNm3VMZkN0SqGQZiOCa9NQHPfmNj8mJe0Ooj2b3o-----END CERTIFICATE-----';
  859. var validations = validator.validate(ca);
  860. expect(validations).toContain('KEY_TYPE');
  861. });
  862. });
  863. it('if a certificate KeyType is CA en you test for Encryption the validation must fail',
  864. function() {
  865. cryptolib('certificates', function(box) {
  866. var validationData = {keyType: 'Encryption'};
  867. var validator =
  868. new box.certificates.CryptoX509CertificateValidator(
  869. validationData);
  870. var ca =
  871. '-----BEGIN CERTIFICATE-----MIICSDCCAbGgAwIBAgIJAPJ2LYuwqa81MA0GCSqGSIb3DQEBBQUAMD0xETAPBgNVBAMMCHdoaXRlIGNhMQ4wDAYDVQQKDAVzY3l0bDELMAkGA1UECwwCc2UxCzAJBgNVBAYTAkVTMB4XDTE0MDkwNTA5MzQwNloXDTI0MDkwMjA5MzQwNlowPTERMA8GA1UEAwwId2hpdGUgY2ExDjAMBgNVBAoMBXNjeXRsMQswCQYDVQQLDAJzZTELMAkGA1UEBhMCRVMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALnpKp2eeY1hC4V8E1nUIZJpJVhAZk3oJeEbq0Xi2uSYrh6wmfuQIHFs5rYF4yHoGvf+PM66od8ccHa1GNGB/b6lFb4/+2vEvYWA51OWY9BBdgjhAsqoks9ANNDQ1oxX4dqLwjM/GDDg2v9xoT9tj0CaJnieQbhMkH8oQveBBR57AgMBAAGjUDBOMB0GA1UdDgQWBBRwKg/RntWH8EvCkEX3jtHuvSpbwTAfBgNVHSMEGDAWgBRwKg/RntWH8EvCkEX3jtHuvSpbwTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBADk/OOoc2tbfxja95RqH22EcAVJ/mDin2ev9cXhZ2A2xh4SrUad0fNsyFnY+m3EzfA0KPrI46sEPDeuWqwnGAYccmp7ylVIS6edYRvnI5mdLze2CnuDNJYQzZXjASQF2ih5wTNm3VMZkN0SqGQZiOCa9NQHPfmNj8mJe0Ooj2b3o-----END CERTIFICATE-----';
  872. var validations = validator.validate(ca);
  873. expect(validations).toContain('KEY_TYPE');
  874. });
  875. });
  876. });
  877. describe('Bug #102292', function() {
  878. it('keyType error message must not be dublicate', function() {
  879. cryptolib('certificates', function(box) {
  880. var validationData = {keyType: 'CA'};
  881. var pem =
  882. '-----BEGIN CERTIFICATE-----MIIDszCCApugAwIBAgIJAMGIeWNyGpIWMA0GCSqGSIb3DQEBCwUAME8xCzAJBgNVBAYTAkVTMRMwEQYDVQQIDApUZXN0LVN0YXRlMQ4wDAYDVQQKDAVTY3l0bDELMAkGA1UECwwCUUExDjAMBgNVBAMMBVNlY1FBMB4XDTE0MTAyMzE2MTQxMFoXDTI0MTAyMDE2MTQxMFowVjELMAkGA1UEBhMCRVMxEzARBgNVBAgMClRlc3QtU3RhdGUxDjAMBgNVBAoMBVNjeXRsMQswCQYDVQQLDAJRQTEVMBMGA1UEAwwMU2VjRW5kRW50aXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2/vvhZLckyuypcLLcMS1c7+lsWsvievgEBXV7IvmUXTF62Sbr/9tVmj3z1aMICd+i8PSV8i61bhY19XZgJP5Lt9CrdrXd7zPXb+Mh75isxkckSFeW3umHhiYdviQ+z85bf8BQ9IT0HVZBep4gD2Xh+cXucGt6Hp/toYyTHx84oS9tmtgFpfYrwSXH1+HrXtNpsXJDTzMzj45H6XjrGHFtR9lWq3ZietGjtqA2fA0uu+PGg2NwLWtYhS20RsJxa2whvxQKJ+1DCddhXR0d4ZC+Cz7TKk29YGlthCeoIpReUjwirLwLsL4j2oFovTHwa0+BkpCDncnGehz7nuZ6V+mHQIDAQABo4GKMIGHMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgbAMC0GCWCGSAGG+EIBDQQgFh5TY3l0bCBRQSBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFGySZYMtItrtgB5vJdvOX7DSg/MhMB8GA1UdIwQYMBaAFJ2ki7GE9c6+FxQs/6x2JplMoFmiMA0GCSqGSIb3DQEBCwUAA4IBAQAuUsrw61q07SzYUI6BSLXAsICX3kMWiSr6RrQ2c7z1h1dcUbfdm51Vxu9W8BBt/FB4CUa24H6MFb2WTfuSeBVF9OF9Cj5B6WVgsd+fSmmbS0/VF9TYrRKzF59BAkfYcFChwIc70nBpbablqEpNhNmO/45ffoEt5eTitWdB3tyyfa+fgZuMZLQEv+W+Lq355WPmXD6poVEvLv1LmDYZIc89FrZE9raxbyQWJJ/S5f+DkbTIwHad5bvxQsvJ8VRf5ADdfyeAL1qJNgEXAqLbAnWd7hT8dT2oDfE4Ug5kDyxRQZzf2qCR0BEvGDHx5ykXUFMk2IO3nJ5j9m1aBm0qZ9+-----END CERTIFICATE-----';
  883. var validator = new box.certificates.CryptoX509CertificateValidator(
  884. validationData);
  885. var validations = validator.validate(pem);
  886. expect(validations).toEqual(['KEY_TYPE']);
  887. });
  888. });
  889. });
  890. });