|
Packit Service |
8c15e4 |
#!/usr/bin/perl
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
print "1..26\n";
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
BEGIN { require 't/funcs.pl' }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
use Convert::ASN1;
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
my $t = 1;
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
my $asn = Convert::ASN1->new;
|
|
Packit |
ef9df4 |
btest $t++, $asn->prepare(<
|
|
Packit |
ef9df4 |
-- ASN.1 from RFC2459 and X.509(2001)
|
|
Packit |
ef9df4 |
-- Adapted for use with Convert::ASN1
|
|
Packit |
ef9df4 |
-- Id: x509decode,v 1.1 2002/02/10 16:41:28 gbarr Exp
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- attribute data types --
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
Attribute ::= SEQUENCE {
|
|
Packit |
ef9df4 |
type AttributeType,
|
|
Packit |
ef9df4 |
values SET OF AttributeValue
|
|
Packit |
ef9df4 |
-- at least one value is required --
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
AttributeType ::= OBJECT IDENTIFIER
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
AttributeValue ::= DirectoryString --ANY
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
AttributeTypeAndValue ::= SEQUENCE {
|
|
Packit |
ef9df4 |
type AttributeType,
|
|
Packit |
ef9df4 |
value AttributeValue
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- naming data types --
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
Name ::= CHOICE { -- only one possibility for now
|
|
Packit |
ef9df4 |
rdnSequence RDNSequence
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
DistinguishedName ::= RDNSequence
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
RelativeDistinguishedName ::=
|
|
Packit |
ef9df4 |
SET OF AttributeTypeAndValue --SET SIZE (1 .. MAX) OF
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- Directory string type --
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
DirectoryString ::= CHOICE {
|
|
Packit |
ef9df4 |
teletexString TeletexString, --(SIZE (1..MAX)),
|
|
Packit |
ef9df4 |
printableString PrintableString, --(SIZE (1..MAX)),
|
|
Packit |
ef9df4 |
bmpString BMPString, --(SIZE (1..MAX)),
|
|
Packit |
ef9df4 |
universalString UniversalString, --(SIZE (1..MAX)),
|
|
Packit |
ef9df4 |
utf8String UTF8String, --(SIZE (1..MAX)),
|
|
Packit |
ef9df4 |
ia5String IA5String, --added for EmailAddress,
|
|
Packit |
ef9df4 |
integer INTEGER
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- certificate and CRL specific structures begin here
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
Certificate ::= SEQUENCE {
|
|
Packit |
ef9df4 |
tbsCertificate TBSCertificate,
|
|
Packit |
ef9df4 |
signatureAlgorithm AlgorithmIdentifier,
|
|
Packit |
ef9df4 |
signature BIT STRING
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
TBSCertificate ::= SEQUENCE {
|
|
Packit |
ef9df4 |
version [0] EXPLICIT Version OPTIONAL, --DEFAULT v1
|
|
Packit |
ef9df4 |
serialNumber CertificateSerialNumber,
|
|
Packit |
ef9df4 |
signature AlgorithmIdentifier,
|
|
Packit |
ef9df4 |
issuer Name,
|
|
Packit |
ef9df4 |
validity Validity,
|
|
Packit |
ef9df4 |
subject Name,
|
|
Packit |
ef9df4 |
subjectPublicKeyInfo SubjectPublicKeyInfo,
|
|
Packit |
ef9df4 |
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
|
|
Packit |
ef9df4 |
-- If present, version shall be v2 or v3
|
|
Packit |
ef9df4 |
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
|
|
Packit |
ef9df4 |
-- If present, version shall be v2 or v3
|
|
Packit |
ef9df4 |
extensions [3] EXPLICIT Extensions OPTIONAL
|
|
Packit |
ef9df4 |
-- If present, version shall be v3
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
Version ::= INTEGER --{ v1(0), v2(1), v3(2) }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
CertificateSerialNumber ::= INTEGER
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
Validity ::= SEQUENCE {
|
|
Packit |
ef9df4 |
notBefore Time,
|
|
Packit |
ef9df4 |
notAfter Time
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
Time ::= CHOICE {
|
|
Packit |
ef9df4 |
utcTime UTCTime,
|
|
Packit |
ef9df4 |
generalTime GeneralizedTime
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
UniqueIdentifier ::= BIT STRING
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
SubjectPublicKeyInfo ::= SEQUENCE {
|
|
Packit |
ef9df4 |
algorithm AlgorithmIdentifier,
|
|
Packit |
ef9df4 |
subjectPublicKey BIT STRING
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
RSAPubKeyInfo ::= SEQUENCE {
|
|
Packit |
ef9df4 |
modulus INTEGER,
|
|
Packit |
ef9df4 |
exponent INTEGER
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
Extensions ::= SEQUENCE OF Extension --SIZE (1..MAX) OF Extension
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
Extension ::= SEQUENCE {
|
|
Packit |
ef9df4 |
extnID OBJECT IDENTIFIER,
|
|
Packit |
ef9df4 |
critical BOOLEAN OPTIONAL, --DEFAULT FALSE,
|
|
Packit |
ef9df4 |
extnValue OCTET STRING
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
AlgorithmIdentifier ::= SEQUENCE {
|
|
Packit |
ef9df4 |
algorithm OBJECT IDENTIFIER,
|
|
Packit |
ef9df4 |
parameters ANY OPTIONAL
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
--extensions
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
AuthorityKeyIdentifier ::= SEQUENCE {
|
|
Packit |
ef9df4 |
keyIdentifier [0] KeyIdentifier OPTIONAL,
|
|
Packit |
ef9df4 |
authorityCertIssuer [1] GeneralNames OPTIONAL,
|
|
Packit |
ef9df4 |
authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
|
|
Packit |
ef9df4 |
-- authorityCertIssuer and authorityCertSerialNumber shall both
|
|
Packit |
ef9df4 |
-- be present or both be absent
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
KeyIdentifier ::= OCTET STRING
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
SubjectKeyIdentifier ::= KeyIdentifier
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- key usage extension OID and syntax
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
KeyUsage ::= BIT STRING --{
|
|
Packit |
ef9df4 |
-- digitalSignature (0),
|
|
Packit |
ef9df4 |
-- nonRepudiation (1),
|
|
Packit |
ef9df4 |
-- keyEncipherment (2),
|
|
Packit |
ef9df4 |
-- dataEncipherment (3),
|
|
Packit |
ef9df4 |
-- keyAgreement (4),
|
|
Packit |
ef9df4 |
-- keyCertSign (5),
|
|
Packit |
ef9df4 |
-- cRLSign (6),
|
|
Packit |
ef9df4 |
-- encipherOnly (7),
|
|
Packit |
ef9df4 |
-- decipherOnly (8) }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- private key usage period extension OID and syntax
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::= { id-ce 16 }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
PrivateKeyUsagePeriod ::= SEQUENCE {
|
|
Packit |
ef9df4 |
notBefore [0] GeneralizedTime OPTIONAL,
|
|
Packit |
ef9df4 |
notAfter [1] GeneralizedTime OPTIONAL }
|
|
Packit |
ef9df4 |
-- either notBefore or notAfter shall be present
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- certificate policies extension OID and syntax
|
|
Packit |
ef9df4 |
-- id-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-ce 32 }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
CertificatePolicies ::= SEQUENCE OF PolicyInformation
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
PolicyInformation ::= SEQUENCE {
|
|
Packit |
ef9df4 |
policyIdentifier CertPolicyId,
|
|
Packit |
ef9df4 |
policyQualifiers SEQUENCE OF
|
|
Packit |
ef9df4 |
PolicyQualifierInfo OPTIONAL }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
CertPolicyId ::= OBJECT IDENTIFIER
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
PolicyQualifierInfo ::= SEQUENCE {
|
|
Packit |
ef9df4 |
policyQualifierId PolicyQualifierId,
|
|
Packit |
ef9df4 |
qualifier ANY } --DEFINED BY policyQualifierId }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- Implementations that recognize additional policy qualifiers shall
|
|
Packit |
ef9df4 |
-- augment the following definition for PolicyQualifierId
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
PolicyQualifierId ::=
|
|
Packit |
ef9df4 |
OBJECT IDENTIFIER --( id-qt-cps | id-qt-unotice )
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- CPS pointer qualifier
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
CPSuri ::= IA5String
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- user notice qualifier
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
UserNotice ::= SEQUENCE {
|
|
Packit |
ef9df4 |
noticeRef NoticeReference OPTIONAL,
|
|
Packit |
ef9df4 |
explicitText DisplayText OPTIONAL}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
NoticeReference ::= SEQUENCE {
|
|
Packit |
ef9df4 |
organization DisplayText,
|
|
Packit |
ef9df4 |
noticeNumbers SEQUENCE OF INTEGER }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
DisplayText ::= CHOICE {
|
|
Packit |
ef9df4 |
visibleString VisibleString ,
|
|
Packit |
ef9df4 |
bmpString BMPString ,
|
|
Packit |
ef9df4 |
utf8String UTF8String }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- policy mapping extension OID and syntax
|
|
Packit |
ef9df4 |
-- id-ce-policyMappings OBJECT IDENTIFIER ::= { id-ce 33 }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
PolicyMappings ::= SEQUENCE OF SEQUENCE {
|
|
Packit |
ef9df4 |
issuerDomainPolicy CertPolicyId,
|
|
Packit |
ef9df4 |
subjectDomainPolicy CertPolicyId }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- subject alternative name extension OID and syntax
|
|
Packit |
ef9df4 |
-- id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 17 }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
SubjectAltName ::= GeneralNames
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
GeneralNames ::= SEQUENCE OF GeneralName
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
GeneralName ::= CHOICE {
|
|
Packit |
ef9df4 |
otherName [0] AnotherName,
|
|
Packit |
ef9df4 |
rfc822Name [1] IA5String,
|
|
Packit |
ef9df4 |
dNSName [2] IA5String,
|
|
Packit |
ef9df4 |
x400Address [3] ANY, --ORAddress,
|
|
Packit |
ef9df4 |
directoryName [4] Name,
|
|
Packit |
ef9df4 |
ediPartyName [5] EDIPartyName,
|
|
Packit |
ef9df4 |
uniformResourceIdentifier [6] IA5String,
|
|
Packit |
ef9df4 |
iPAddress [7] OCTET STRING,
|
|
Packit |
ef9df4 |
registeredID [8] OBJECT IDENTIFIER }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
EntrustVersionInfo ::= SEQUENCE {
|
|
Packit |
ef9df4 |
entrustVers GeneralString,
|
|
Packit |
ef9df4 |
entrustInfoFlags EntrustInfoFlags }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
EntrustInfoFlags::= BIT STRING --{
|
|
Packit |
ef9df4 |
-- keyUpdateAllowed
|
|
Packit |
ef9df4 |
-- newExtensions (1), -- not used
|
|
Packit |
ef9df4 |
-- pKIXCertificate (2) } -- certificate created by pkix
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- AnotherName replaces OTHER-NAME ::= TYPE-IDENTIFIER, as
|
|
Packit |
ef9df4 |
-- TYPE-IDENTIFIER is not supported in the 88 ASN.1 syntax
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
AnotherName ::= SEQUENCE {
|
|
Packit |
ef9df4 |
type OBJECT IDENTIFIER,
|
|
Packit |
ef9df4 |
value [0] EXPLICIT ANY } --DEFINED BY type-id }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
EDIPartyName ::= SEQUENCE {
|
|
Packit |
ef9df4 |
nameAssigner [0] DirectoryString OPTIONAL,
|
|
Packit |
ef9df4 |
partyName [1] DirectoryString }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- issuer alternative name extension OID and syntax
|
|
Packit |
ef9df4 |
-- id-ce-issuerAltName OBJECT IDENTIFIER ::= { id-ce 18 }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
IssuerAltName ::= GeneralNames
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= { id-ce 9 }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
SubjectDirectoryAttributes ::= SEQUENCE OF Attribute
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- basic constraints extension OID and syntax
|
|
Packit |
ef9df4 |
-- id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
BasicConstraints ::= SEQUENCE {
|
|
Packit |
ef9df4 |
cA BOOLEAN OPTIONAL, --DEFAULT FALSE,
|
|
Packit |
ef9df4 |
pathLenConstraint INTEGER OPTIONAL }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- name constraints extension OID and syntax
|
|
Packit |
ef9df4 |
-- id-ce-nameConstraints OBJECT IDENTIFIER ::= { id-ce 30 }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
NameConstraints ::= SEQUENCE {
|
|
Packit |
ef9df4 |
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
|
|
Packit |
ef9df4 |
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
GeneralSubtrees ::= SEQUENCE OF GeneralSubtree
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
GeneralSubtree ::= SEQUENCE {
|
|
Packit |
ef9df4 |
base GeneralName,
|
|
Packit |
ef9df4 |
minimum [0] BaseDistance OPTIONAL, --DEFAULT 0,
|
|
Packit |
ef9df4 |
maximum [1] BaseDistance OPTIONAL }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
BaseDistance ::= INTEGER
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- policy constraints extension OID and syntax
|
|
Packit |
ef9df4 |
-- id-ce-policyConstraints OBJECT IDENTIFIER ::= { id-ce 36 }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
PolicyConstraints ::= SEQUENCE {
|
|
Packit |
ef9df4 |
requireExplicitPolicy [0] SkipCerts OPTIONAL,
|
|
Packit |
ef9df4 |
inhibitPolicyMapping [1] SkipCerts OPTIONAL }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
SkipCerts ::= INTEGER
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- CRL distribution points extension OID and syntax
|
|
Packit |
ef9df4 |
-- id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= {id-ce 31}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
cRLDistributionPoints ::= SEQUENCE OF DistributionPoint
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
DistributionPoint ::= SEQUENCE {
|
|
Packit |
ef9df4 |
distributionPoint [0] DistributionPointName OPTIONAL,
|
|
Packit |
ef9df4 |
reasons [1] ReasonFlags OPTIONAL,
|
|
Packit |
ef9df4 |
cRLIssuer [2] GeneralNames OPTIONAL }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
DistributionPointName ::= CHOICE {
|
|
Packit |
ef9df4 |
fullName [0] GeneralNames,
|
|
Packit |
ef9df4 |
nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
ReasonFlags ::= BIT STRING --{
|
|
Packit |
ef9df4 |
-- unused (0),
|
|
Packit |
ef9df4 |
-- keyCompromise (1),
|
|
Packit |
ef9df4 |
-- cACompromise (2),
|
|
Packit |
ef9df4 |
-- affiliationChanged (3),
|
|
Packit |
ef9df4 |
-- superseded (4),
|
|
Packit |
ef9df4 |
-- cessationOfOperation (5),
|
|
Packit |
ef9df4 |
-- certificateHold (6),
|
|
Packit |
ef9df4 |
-- privilegeWithdrawn (7),
|
|
Packit |
ef9df4 |
-- aACompromise (8) }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- extended key usage extension OID and syntax
|
|
Packit |
ef9df4 |
-- id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
ExtKeyUsageSyntax ::= SEQUENCE OF KeyPurposeId
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
KeyPurposeId ::= OBJECT IDENTIFIER
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- extended key purpose OIDs
|
|
Packit |
ef9df4 |
-- id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 }
|
|
Packit |
ef9df4 |
-- id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 }
|
|
Packit |
ef9df4 |
-- id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 }
|
|
Packit |
ef9df4 |
-- id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 }
|
|
Packit |
ef9df4 |
-- id-kp-ipsecEndSystem OBJECT IDENTIFIER ::= { id-kp 5 }
|
|
Packit |
ef9df4 |
-- id-kp-ipsecTunnel OBJECT IDENTIFIER ::= { id-kp 6 }
|
|
Packit |
ef9df4 |
-- id-kp-ipsecUser OBJECT IDENTIFIER ::= { id-kp 7 }
|
|
Packit |
ef9df4 |
-- id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- authority info access
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
AuthorityInfoAccessSyntax ::=
|
|
Packit |
ef9df4 |
SEQUENCE OF AccessDescription --SIZE (1..MAX) OF AccessDescription
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
AccessDescription ::= SEQUENCE {
|
|
Packit |
ef9df4 |
accessMethod OBJECT IDENTIFIER,
|
|
Packit |
ef9df4 |
accessLocation GeneralName }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- subject info access
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- id-pe-subjectInfoAccess OBJECT IDENTIFIER ::= { id-pe 11 }
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
SubjectInfoAccessSyntax ::=
|
|
Packit |
ef9df4 |
SEQUENCE OF AccessDescription --SIZE (1..MAX) OF AccessDescription
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
-- pgp creation time
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
PGPExtension ::= SEQUENCE {
|
|
Packit |
ef9df4 |
version Version, -- DEFAULT v1(0)
|
|
Packit |
ef9df4 |
keyCreation Time
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
ASN1
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
btest $t++, my $parser = $asn->find('Certificate');
|
|
Packit |
ef9df4 |
btest $t++, my $crlp = $asn->find('cRLDistributionPoints');
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
my %certs = (
|
|
Packit |
ef9df4 |
't/aj.cer' => ["http://rootca.allianz.com/ad-ca/ad-ca.crl"],
|
|
Packit |
ef9df4 |
't/aj2.cer' => ["http://rootca.allianz.com/sc-ad-ca/sc-ad-ca.crl"],
|
|
Packit |
ef9df4 |
't/allianz_root.cer' => ["http://rootca.allianz.com/rootca.crl"],
|
|
Packit |
ef9df4 |
't/pgpextension.der' => ["http://ca.mayfirst.org/mfpl.crl"],
|
|
Packit |
ef9df4 |
't/subca_2.cer' => [
|
|
Packit |
ef9df4 |
"ldap://ldap.treas.gov/cn=CRL1,ou=US%20Treasury%20Root%20CA,ou=Certification%20Authorities,ou=Department%20of%20the%20Treasury,o=U.S.%20Government,c=US?authorityRevocationList"
|
|
Packit |
ef9df4 |
],
|
|
Packit |
ef9df4 |
't/dsacert.der' => undef,
|
|
Packit |
ef9df4 |
't/new_root_ca.cer' => undef,
|
|
Packit |
ef9df4 |
't/telesec_799972029.crt' => undef,
|
|
Packit |
ef9df4 |
't/verisign.der' => undef,
|
|
Packit |
ef9df4 |
);
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
for my $file (sort keys %certs) {
|
|
Packit |
ef9df4 |
print "# $file\n";
|
|
Packit |
ef9df4 |
my $cert = loadcert($file);
|
|
Packit |
ef9df4 |
btest $t++, my $data = $parser->decode($cert);
|
|
Packit |
ef9df4 |
$data ||= {};
|
|
Packit |
ef9df4 |
my $extns = $data->{tbsCertificate}{extensions} || [];
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
my ($ext) = grep { $_->{'extnID'} eq '2.5.29.31' } @$extns;
|
|
Packit |
ef9df4 |
if ($ext) {
|
|
Packit |
ef9df4 |
my $points = $crlp->decode($ext->{'extnValue'}); # decode the value
|
|
Packit |
ef9df4 |
$points = $points && $points->[0]->{'distributionPoint'}->{'fullName'};
|
|
Packit |
ef9df4 |
btest $t++, !$crlp->error or warn($crlp->error);
|
|
Packit |
ef9df4 |
my @points = grep $_, map { $_->{'uniformResourceIdentifier'} } @{$points || []};
|
|
Packit |
ef9df4 |
rtest $t++, $certs{$file}, \@points;
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
else {
|
|
Packit |
ef9df4 |
btest $t++, !$certs{$file};
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
}
|
|
Packit |
ef9df4 |
|
|
Packit |
ef9df4 |
sub loadcert {
|
|
Packit |
ef9df4 |
my $file = shift;
|
|
Packit |
ef9df4 |
open FILE, $file || die "cannot load test certificate" . $file . "\n";
|
|
Packit |
ef9df4 |
binmode FILE; # HELLO Windows, dont fuss with this
|
|
Packit |
ef9df4 |
my $holdTerminator = $/;
|
|
Packit |
ef9df4 |
undef $/; # using slurp mode to read the DER-encoded binary certificate
|
|
Packit |
ef9df4 |
my $cert = <FILE>;
|
|
Packit |
ef9df4 |
$/ = $holdTerminator;
|
|
Packit |
ef9df4 |
close FILE;
|
|
Packit |
ef9df4 |
return $cert;
|
|
Packit |
ef9df4 |
}
|