Add mock test cert generation #85

rajeev-0 · 2025-05-06T11:34:03Z

Motivation

Script to generate Mock certificates and keys for testing.
Added OpenSSL-3.5 test to CI test.
Added Mock test with PQ algorithm (MLDSA & SLH-DSA) using OpenSSL-3.5.

sonarqubecloud · 2025-05-08T12:32:31Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

DDvO

Nice.
Yet various small improvements.

DDvO · 2025-05-08T13:27:29Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+
+# This script generates the certificates needed for the CMP server and the signer
+
+if [[ ! -f $mkcert_sh ]]; then


Is there a concrete use case for setting mkcert_sh externally?
Otherwise I suggest dropping the guard.

DDvO · 2025-05-08T13:28:48Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+# sever certificate algorithms
+if [ -z "$server_rootca_keyalg" ]; then
+    server_rootca_keyalg="MLDSA65"
+fi
+if [ -z "$server_leaf_keyalg" ]; then
+    server_leaf_keyalg="SLH-DSA-SHAKE-192s"
+fi
+# rootCACert update test case
+if [ -z "$new_rootca_keyalg" ]; then
+    new_rootca_keyalg="SLH-DSA-SHAKE-192s"
+fi
+
+# End-entity certificate algorithms
+if [ -z "$signer_rootca_keyalg" ]; then
+    signer_rootca_keyalg="MLDSA65"
+fi
+if [ -z "$signer_interca_keyalg" ]; then
+    signer_interca_keyalg="MLDSA65"
+fi
+if [ -z "$signer_subinterca_keyalg" ]; then
+    signer_subinterca_keyalg="MLDSA65"
+fi
+if [ -z "$signer_leaf_keyalg" ]; then
+    signer_leaf_keyalg="SLH-DSA-SHAKE-192s"
+fi


Please introduce and use a couple of script parameters, such that the script can be called

for updating the hitherto test credentials with the same classical algorithms as before (RSA)

for the given PQ tests with MLDSA65 and SLH-DSA-SHAKE-192s

for further ones, like KEM

DDvO · 2025-05-08T13:58:04Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+
+remove_serverfiles() {
+    echo "Removing server files"
+    rm -f server.key server-crt trusted.crt server_root.crt


typo in a file name, and better use same order as above:

Suggested change

rm -f server.key server-crt trusted.crt server_root.crt

rm -f server_root.crt trusted.crt server.key server.crt

DDvO · 2025-05-08T14:26:02Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+
+gen_servercert() {
+    remove_serverfiles
+    sleep 5


why sleep? Please comment or remove.

DDvO · 2025-05-08T14:29:31Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+    fi
+
+    gen_demoCAfolder
+    openssl ca -gencrl -keyfile signer_subinterCA-key.pem -cert signer_subinterCA-cert.pem -out signer_subinterCA-crl.pem -crldays 36525 \


Please use $DAYS after adding early in the script:

if [ -z "$DAYS" ]; then DAYS=36524 # 100 years, with 24 leap years per 100 years until 2400 fi

BTW, the 36525 in mkcert.sh typically means 1 day more than 100 years
because a leap year occurs every 4 years, but not every 100 years, but still every 400 years (i.e., in 2000, in 2400, ...)

DDvO · 2025-05-08T15:40:34Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+		      "database = ./demoCA/index.txt" "crlnumber = ./demoCA/crlnumber" "default_md = default")
+    cat signer_leaf-cert.pem signer_subinterCA-cert.pem signer_interCA-cert.pem > signer_chain.pem
+    cat signer_subinterCA-cert.pem signer_interCA-cert.pem signer_root-cert.pem > signer_fullchain.pem
+    openssl pkcs12 -export -out signer.p12 -inkey signer_leaf-key.pem -in signer_leaf-cert.pem -certfile signer_fullchain.pem -password pass:12345


Suggested change

openssl pkcs12 -export -out signer.p12 -inkey signer_leaf-key.pem -in signer_leaf-cert.pem -certfile signer_fullchain.pem -password pass:12345

openssl pkcs12 -export -out signer.p12 -inkey signer_leaf-key.pem -in signer_leaf-cert.pem -certfile signer_fullchain.pem -password file:12345.txt

DDvO · 2025-05-08T15:41:02Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+    openssl pkey -in new.key -out new_pass_12345.key -aes256 -passout pass:12345
+    echo "12345" > 12345.txt


Suggested change

openssl pkey -in new.key -out new_pass_12345.key -aes256 -passout pass:12345

echo "12345" > 12345.txt

openssl pkey -in new.key -out new_pass_12345.key -aes256 -passout file:12345.txt

DDvO · 2025-05-08T15:45:09Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+    new_rootca_keyalg="SLH-DSA-SHAKE-192s"
+fi
+
+# End-entity certificate algorithms


Suggested change

# End-entity certificate algorithms

# algorithms for client certificate chain

DDvO · 2025-05-08T15:46:00Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+    gen_servercert
+    gen_signercert


Suggested change

gen_servercert

gen_signercert

gen_server_chain

gen_client_chain

DDvO · 2025-05-08T15:47:45Z

test/certs/mkcert.sh

@@ -0,0 +1,417 @@
+#! /bin/bash


Please mark in the file the part(s) adapted, or was an unchanged copy sufficient?

DDvO · 2025-05-09T05:59:31Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+    openssl pkey -in new.key -out new_pass_12345.key -aes256 -passout pass:12345
+    echo "12345" > 12345.txt
+    cp new.key signer.key
+    mv signer_leaf-cert.pem signer_only.crt


Please add a further signer cert with NULL-DN subject and without a subjectKeyIdentifier,
which will be needed in a new test case on senderKID.
If there is no simple way of using for this case mkcert_sh genee, you can also use:

openssl x509 -new -subj "/" -days $DAYS -extfile <(printf "subjectKeyIdentifier=none") -out signer_no_SKID.crt -key signer.key

DDvO · 2025-09-22T17:57:59Z

Please also add a run of make -f Makefile_v1 test_Mock when build with OpenSSL 3.5 (where all test cases are enabled since all new CMP features are present).

setup-Mock.sh: add files for rootCaCert test setup-mock.sh: option to set variables from cli

OpenSSL_versions.yaml: add test_Mock for OpenSSL-3.5 with PQ algorithms Update OpenSSL_versions.yml Update OpenSSL_versions.yml

sonarqubecloud · 2025-10-08T12:38:35Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

rajeev-0 force-pushed the add_MockTest_cert_generation branch 3 times, most recently from 359b5dc to 57c3c4b Compare May 8, 2025 12:31

rajeev-0 marked this pull request as ready for review May 8, 2025 12:36

rajeev-0 requested a review from DDvO May 8, 2025 12:37

DDvO requested changes May 8, 2025

View reviewed changes

DDvO reviewed May 9, 2025

View reviewed changes

rajeev-0 added 4 commits October 8, 2025 14:28

add mkcert.sh

4780dd7

add MLDSA*, MLKEM* and SLH-DSA-* algorithm for key generation

abe4026

add setup-mock.sh

89df73c

setup-Mock.sh: add files for rootCaCert test setup-mock.sh: option to set variables from cli

OpenSSL_versions.yaml: add test_Mock for OpenSSL-3.5 with PQ algorithms

ba840da

OpenSSL_versions.yaml: add test_Mock for OpenSSL-3.5 with PQ algorithms Update OpenSSL_versions.yml Update OpenSSL_versions.yml

rajeev-0 force-pushed the add_MockTest_cert_generation branch from 57c3c4b to ba840da Compare October 8, 2025 12:36


		# This script generates the certificates needed for the CMP server and the signer

		if [[ ! -f $mkcert_sh ]]; then

	rm -f server.key server-crt trusted.crt server_root.crt
	rm -f server_root.crt trusted.crt server.key server.crt

	openssl pkcs12 -export -out signer.p12 -inkey signer_leaf-key.pem -in signer_leaf-cert.pem -certfile signer_fullchain.pem -password pass:12345
	openssl pkcs12 -export -out signer.p12 -inkey signer_leaf-key.pem -in signer_leaf-cert.pem -certfile signer_fullchain.pem -password file:12345.txt

		openssl pkey -in new.key -out new_pass_12345.key -aes256 -passout pass:12345
		echo "12345" > 12345.txt

	# End-entity certificate algorithms
	# algorithms for client certificate chain

Add mock test cert generation #85

Are you sure you want to change the base?

Add mock test cert generation #85

Uh oh!

Conversation

rajeev-0 commented May 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Uh oh!

sonarqubecloud bot commented May 8, 2025

Quality Gate passed

Uh oh!

DDvO left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DDvO May 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DDvO May 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DDvO commented Sep 22, 2025

Uh oh!

sonarqubecloud bot commented Oct 8, 2025

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rajeev-0 commented May 6, 2025 •

edited

Loading

DDvO May 8, 2025 •

edited

Loading

DDvO May 9, 2025 •

edited

Loading