1 package org.cacert.gigi;
3 import java.io.IOException;
4 import java.net.HttpURLConnection;
5 import java.net.MalformedURLException;
6 import java.net.Socket;
8 import java.security.GeneralSecurityException;
9 import java.security.KeyManagementException;
10 import java.security.NoSuchAlgorithmException;
11 import java.security.Principal;
12 import java.security.PrivateKey;
13 import java.security.cert.X509Certificate;
14 import java.sql.SQLException;
16 import javax.net.ssl.HttpsURLConnection;
17 import javax.net.ssl.KeyManager;
18 import javax.net.ssl.SSLContext;
19 import javax.net.ssl.X509KeyManager;
21 import org.cacert.gigi.Certificate.CertificateStatus;
22 import org.cacert.gigi.testUtils.ManagedTest;
23 import org.cacert.gigi.testUtils.PemKey;
24 import org.junit.Test;
26 import static org.junit.Assert.*;
28 public class TestCertificate extends ManagedTest {
30 public void testClientCertLoginStates() throws IOException, GeneralSecurityException, SQLException,
31 InterruptedException {
32 String[] key1 = generateCSR("/CN=testmail@example.com");
33 Certificate c = new Certificate(1, "/CN=testmail@example.com", "sha256", key1[1]);
34 final PrivateKey pk = PemKey.parsePEMPrivateKey(key1[0]);
37 final X509Certificate ce = c.cert();
38 testLogin(pk, ce, true);
41 private void testLogin(final PrivateKey pk, final X509Certificate ce, boolean success)
42 throws NoSuchAlgorithmException, KeyManagementException, IOException, MalformedURLException {
43 KeyManager km = new X509KeyManager() {
46 public String chooseClientAlias(String[] arg0, Principal[] arg1, Socket arg2) {
51 public String chooseServerAlias(String arg0, Principal[] arg1, Socket arg2) {
56 public X509Certificate[] getCertificateChain(String arg0) {
57 return new X509Certificate[] { ce };
61 public String[] getClientAliases(String arg0, Principal[] arg1) {
62 return new String[] { "client" };
66 public PrivateKey getPrivateKey(String arg0) {
67 if (arg0.equals("client")) {
74 public String[] getServerAliases(String arg0, Principal[] arg1) {
75 return new String[] { "client" };
78 SSLContext sc = SSLContext.getInstance("TLS");
79 sc.init(new KeyManager[] { km }, null, null);
81 HttpURLConnection connection = (HttpURLConnection) new URL("https://"
82 + getServerName().replaceFirst("^www.", "secure.") + "/login").openConnection();
83 if (connection instanceof HttpsURLConnection) {
84 ((HttpsURLConnection) connection).setSSLSocketFactory(sc.getSocketFactory());
87 assertEquals(302, connection.getResponseCode());
88 assertEquals("https://" + getServerName().replaceFirst("^www.", "secure.") + "/",
89 connection.getHeaderField("Location"));
91 assertNotEquals(302, connection.getResponseCode());
92 assertNotEquals("https://" + getServerName().replaceFirst("^www.", "secure.") + "/",
93 connection.getHeaderField("Location"));
98 public void testCertLifeCycle() throws IOException, GeneralSecurityException, SQLException, InterruptedException {
99 String[] key1 = generateCSR("/CN=testmail@example.com");
100 Certificate c = new Certificate(1, "/CN=testmail@example.com", "sha256", key1[1]);
101 final PrivateKey pk = PemKey.parsePEMPrivateKey(key1[0]);
103 testFails(CertificateStatus.DRAFT, c);
106 testFails(CertificateStatus.SIGNING, c);
109 testFails(CertificateStatus.ISSUED, c);
110 X509Certificate cert = c.cert();
111 testLogin(pk, cert, true);
114 testFails(CertificateStatus.BEING_REVOKED, c);
117 testFails(CertificateStatus.REVOKED, c);
118 testLogin(pk, cert, false);
122 private void testFails(CertificateStatus status, Certificate c) throws IOException, GeneralSecurityException,
124 if (status != CertificateStatus.ISSUED) {
127 fail("is in invalid state");
128 } catch (IllegalStateException ise) {
132 if (status != CertificateStatus.DRAFT) {
135 fail("is in invalid state");
136 } catch (IllegalStateException ise) {
140 if (status != CertificateStatus.ISSUED) {
143 fail("is in invalid state");
144 } catch (IllegalStateException ise) {