tests/org/cacert/gigi/TestCertificate.java

   1 package org.cacert.gigi;
   2
   3 import java.io.IOException;
   4 import java.net.HttpURLConnection;
   5 import java.net.Socket;
   6 import java.net.URL;
   7 import java.security.GeneralSecurityException;
   8 import java.security.Principal;
   9 import java.security.PrivateKey;
  10 import java.security.cert.X509Certificate;
  11 import java.sql.SQLException;
  12
  13 import javax.net.ssl.HttpsURLConnection;
  14 import javax.net.ssl.KeyManager;
  15 import javax.net.ssl.SSLContext;
  16 import javax.net.ssl.X509KeyManager;
  17
  18 import org.cacert.gigi.Certificate.CertificateStatus;
  19 import org.cacert.gigi.testUtils.ManagedTest;
  20 import org.cacert.gigi.testUtils.PemKey;
  21 import org.junit.Test;
  22
  23 import static org.junit.Assert.*;
  24
  25 public class TestCertificate extends ManagedTest {
  26         @Test
  27         public void testClientCertLoginStates() throws IOException, GeneralSecurityException, SQLException,
  28                 InterruptedException {
  29                 String[] key1 = generateCSR("/CN=testmail@example.com");
  30                 Certificate c = new Certificate(1, "/CN=testmail@example.com", "sha256", key1[1]);
  31                 final PrivateKey pk = PemKey.parsePEMPrivateKey(key1[0]);
  32                 c.issue();
  33                 c.waitFor(60000);
  34                 final X509Certificate ce = c.cert();
  35                 KeyManager km = new X509KeyManager() {
  36
  37                         @Override
  38                         public String chooseClientAlias(String[] arg0, Principal[] arg1, Socket arg2) {
  39                                 return "client";
  40                         }
  41
  42                         @Override
  43                         public String chooseServerAlias(String arg0, Principal[] arg1, Socket arg2) {
  44                                 return null;
  45                         }
  46
  47                         @Override
  48                         public X509Certificate[] getCertificateChain(String arg0) {
  49                                 return new X509Certificate[] { ce };
  50                         }
  51
  52                         @Override
  53                         public String[] getClientAliases(String arg0, Principal[] arg1) {
  54                                 return new String[] { "client" };
  55                         }
  56
  57                         @Override
  58                         public PrivateKey getPrivateKey(String arg0) {
  59                                 if (arg0.equals("client")) {
  60                                         return pk;
  61                                 }
  62                                 return null;
  63                         }
  64
  65                         @Override
  66                         public String[] getServerAliases(String arg0, Principal[] arg1) {
  67                                 return new String[] { "client" };
  68                         }
  69                 };
  70                 SSLContext sc = SSLContext.getInstance("TLS");
  71                 sc.init(new KeyManager[] { km }, null, null);
  72
  73                 HttpURLConnection connection = (HttpURLConnection) new URL("https://"
  74                         + getServerName().replaceFirst("^www.", "secure.") + "/login").openConnection();
  75                 if (connection instanceof HttpsURLConnection) {
  76                         ((HttpsURLConnection) connection).setSSLSocketFactory(sc.getSocketFactory());
  77                 }
  78                 assertEquals(302, connection.getResponseCode());
  79                 assertEquals("https://" + getServerName().replaceFirst("^www.", "secure.") + "/",
  80                         connection.getHeaderField("Location"));
  81         }
  82
  83         @Test
  84         public void testCertLifeCycle() throws IOException, GeneralSecurityException, SQLException, InterruptedException {
  85                 String[] key1 = generateCSR("/CN=testmail@example.com");
  86                 Certificate c = new Certificate(1, "/CN=testmail@example.com", "sha256", key1[1]);
  87                 testFails(CertificateStatus.DRAFT, c);
  88                 c.issue();
  89
  90                 testFails(CertificateStatus.SIGNING, c);
  91                 c.waitFor(60000);
  92
  93                 testFails(CertificateStatus.ISSUED, c);
  94                 c.revoke();
  95
  96                 testFails(CertificateStatus.BEING_REVOKED, c);
  97                 c.waitFor(60000);
  98
  99                 testFails(CertificateStatus.REVOKED, c);
 100
 101         }
 102
 103         private void testFails(CertificateStatus status, Certificate c) throws IOException, GeneralSecurityException,
 104                 SQLException {
 105                 if (status != CertificateStatus.ISSUED) {
 106                         try {
 107                                 c.revoke();
 108                                 fail("is in invalid state");
 109                         } catch (IllegalStateException ise) {
 110
 111                         }
 112                 }
 113                 if (status != CertificateStatus.DRAFT) {
 114                         try {
 115                                 c.issue();
 116                                 fail("is in invalid state");
 117                         } catch (IllegalStateException ise) {
 118
 119                         }
 120                 }
 121                 if (status != CertificateStatus.ISSUED) {
 122                         try {
 123                                 c.cert();
 124                                 fail("is in invalid state");
 125                         } catch (IllegalStateException ise) {
 126
 127                         }
 128                 }
 129         }
 130 }