From dda529ecc2d085488eef60235ef553dc5fd6e6dc Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 7 Mar 2023 17:07:57 +0000 Subject: [PATCH] Add a Certificate Policies Test Test that a valid certificate policy is accepted and that an invalid certificate policy is rejected. Specifically we are checking that a leaf certificate with an invalid policy is detected. Related-to: CVE-2023-0465 Reviewed-by: Hugo Landau Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/20587) --- test/recipes/25-test_verify.t | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t index 2a4c36e86d..818c9ac50d 100644 --- a/test/recipes/25-test_verify.t +++ b/test/recipes/25-test_verify.t @@ -29,7 +29,7 @@ sub verify { run(app([@args])); } -plan tests => 164; +plan tests => 166; # Canonical success ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]), @@ -516,3 +516,14 @@ SKIP: { ok(run(app([ qw(openssl verify -trusted), $rsapluscert_file, $cert_file ])), 'Mixed key + cert file test'); } + +# Certificate Policies +ok(verify("ee-cert-policies", "", ["root-cert"], ["ca-pol-cert"], + "-policy_check", "-policy", "1.3.6.1.4.1.16604.998855.1", + "-explicit_policy"), + "Certificate policy"); + +ok(!verify("ee-cert-policies-bad", "", ["root-cert"], ["ca-pol-cert"], + "-policy_check", "-policy", "1.3.6.1.4.1.16604.998855.1", + "-explicit_policy"), + "Bad certificate policy"); -- 2.36.1