Revert 69356 - Regenerate the root certificate and end-entity certifi…

…cates used for various tests in net_unittests, now that Windows can temporarily trust certificates for the duration of tests. In addition, add unittests for net::TestRootCerts, which depend on the certs being tested not being trusted by the system beforehand. BUG=8470, 5552 TEST=TestRootCertsTest.* Review URL: http://codereview.chromium.org/5535006 [email protected] git-svn-id: svn://svn.chromium.org/chrome/trunk/src@69363 0039d316-1c4b-4281-b951-d872f2087c98
AryanGitHub · Dec 16, 2010 · ec2f688 · ec2f688
1 parent c0b0a69
commit ec2f688
Show file tree

Hide file tree

Showing 16 changed files with 216 additions and 623 deletions.
diff --git a/net/base/cert_database_nss_unittest.cc b/net/base/cert_database_nss_unittest.cc
@@ -169,7 +169,7 @@ TEST_F(CertDatabaseNSSTest, ImportFromPKCS12AndExportAgain) {
 }
 
 TEST_F(CertDatabaseNSSTest, ImportCACert_SSLTrust) {
-  std::string cert_data = ReadTestFile("root_ca_cert.pem");
+  std::string cert_data = ReadTestFile("root_ca_cert.crt");
 
   CertificateList certs =
       X509Certificate::CreateCertificateListFromBytes(
@@ -187,7 +187,7 @@ TEST_F(CertDatabaseNSSTest, ImportCACert_SSLTrust) {
   CertificateList cert_list = ListCertsInSlot(slot_.get());
   ASSERT_EQ(1U, cert_list.size());
   scoped_refptr<X509Certificate> cert(cert_list[0]);
-  EXPECT_EQ("Test Root CA", cert->subject().common_name);
+  EXPECT_EQ("Test CA", cert->subject().common_name);
 
   EXPECT_EQ(CertDatabase::TRUSTED_SSL,
             cert_db_.GetCertTrust(cert.get(), CA_CERT));
@@ -201,7 +201,7 @@ TEST_F(CertDatabaseNSSTest, ImportCACert_SSLTrust) {
 }
 
 TEST_F(CertDatabaseNSSTest, ImportCACert_EmailTrust) {
-  std::string cert_data = ReadTestFile("root_ca_cert.pem");
+  std::string cert_data = ReadTestFile("root_ca_cert.crt");
 
   CertificateList certs =
       X509Certificate::CreateCertificateListFromBytes(
@@ -219,7 +219,7 @@ TEST_F(CertDatabaseNSSTest, ImportCACert_EmailTrust) {
   CertificateList cert_list = ListCertsInSlot(slot_.get());
   ASSERT_EQ(1U, cert_list.size());
   scoped_refptr<X509Certificate> cert(cert_list[0]);
-  EXPECT_EQ("Test Root CA", cert->subject().common_name);
+  EXPECT_EQ("Test CA", cert->subject().common_name);
 
   EXPECT_EQ(CertDatabase::TRUSTED_EMAIL,
             cert_db_.GetCertTrust(cert.get(), CA_CERT));
@@ -232,7 +232,7 @@ TEST_F(CertDatabaseNSSTest, ImportCACert_EmailTrust) {
 }
 
 TEST_F(CertDatabaseNSSTest, ImportCACert_ObjSignTrust) {
-  std::string cert_data = ReadTestFile("root_ca_cert.pem");
+  std::string cert_data = ReadTestFile("root_ca_cert.crt");
 
   CertificateList certs =
       X509Certificate::CreateCertificateListFromBytes(
@@ -250,7 +250,7 @@ TEST_F(CertDatabaseNSSTest, ImportCACert_ObjSignTrust) {
   CertificateList cert_list = ListCertsInSlot(slot_.get());
   ASSERT_EQ(1U, cert_list.size());
   scoped_refptr<X509Certificate> cert(cert_list[0]);
-  EXPECT_EQ("Test Root CA", cert->subject().common_name);
+  EXPECT_EQ("Test CA", cert->subject().common_name);
 
   EXPECT_EQ(CertDatabase::TRUSTED_OBJ_SIGN,
             cert_db_.GetCertTrust(cert.get(), CA_CERT));
@@ -391,7 +391,7 @@ TEST_F(CertDatabaseNSSTest, ImportCACertHierarchyTree) {
 }
 
 TEST_F(CertDatabaseNSSTest, ImportCACertNotHierarchy) {
-  std::string cert_data = ReadTestFile("root_ca_cert.pem");
+  std::string cert_data = ReadTestFile("root_ca_cert.crt");
   CertificateList certs =
       X509Certificate::CreateCertificateListFromBytes(
           cert_data.data(), cert_data.size(), X509Certificate::FORMAT_AUTO);
@@ -415,7 +415,7 @@ TEST_F(CertDatabaseNSSTest, ImportCACertNotHierarchy) {
 
   CertificateList cert_list = ListCertsInSlot(slot_.get());
   ASSERT_EQ(1U, cert_list.size());
-  EXPECT_EQ("Test Root CA", cert_list[0]->subject().common_name);
+  EXPECT_EQ("Test CA", cert_list[0]->subject().common_name);
 }
 
 TEST_F(CertDatabaseNSSTest, ImportServerCert) {

diff --git a/net/base/test_root_certs_unittest.cc b/net/base/test_root_certs_unittest.cc
diff --git a/net/data/ssl/certificates/README b/net/data/ssl/certificates/README
@@ -20,51 +20,17 @@ unit tests.
 - dod_root_ca_2_cert.der : A certificate chain for regression tests of
      http://crbug.com/31497.
 
+- expired_cert.pem : An expired certificate, used by test_server.cc.
+
+- ok_cert.pem : A valid certificate, used by test_server.cc
+
+- root_ca_cert.crt : The testing root CA used to sign the test_server.cc's
+     certificates.
+
 - unosoft_hu_cert : Certificate used by X509CertificateTest.UnoSoftCertParsing.
 
 - client.p12 : A PKCS #12 file containing a client certificate and a private
      key created for testing.  The password is "12345".
 
 - punycodetest.der : A test self-signed server certificate with punycode name.
      The common name is "xn--wgv71a119e.com" (日本語.com)
-
-=====
-Generated Test Certificates:
-=====
-The following certificates were generated locally, and are primarily used
-by test_server.cc and test_server.py. Each file contains the certificate
-and associated private key.
-  - expired_cert.pem : An expired certificate, used by test_server.cc.
-  - ok_cert.pem : A valid certificate, used by test_server.cc and others
-  - root_ca_cert.pem : The test root CA certificate, used to sign the test
-    certificates.
-
-In addition, two support files are provided to make it easy to make
-modifications or regenerate these certificates.
-  - openssl_ca.cnf : The configuration file used to generate the test CA
-    certificate and sign certificate requests.
-  - openssl_cert.cnf : The configuration file used to generate the certificate
-    requests for the ok and expired certificates.
-
-The following commands were used to generated the test root certificates
-Note: Be sure to adjust path slashes as appropriate for your platform.
-
-mkdir root_ca
-mkdir root_ca\private
-mkdir root_ca\newcerts
-echo 01 > root_ca\serial
-[On Windows]
-  copy nul: root_ca\index.txt
-  copy nul: root_ca\index.txt.attr
-[On POSIX]
-  touch root_ca\index.txt
-  touch root_ca\index.txt.attr
-
-openssl req -new -x509 -days 18250 -keyout root_ca\private\cacert.key -out root_ca\cacert.pem -config openssl_ca.cnf
-openssl req -new -keyout expired_cert.key -out expired_cert.req -config openssl_cert.cnf
-openssl req -new -keyout ok_cert.key -out ok_cert.req -config openssl_cert.cnf
-openssl ca -name CA_root -extensions user_cert -startdate 060101000000Z -enddate 070101000000Z -in expired_cert.req -out expired_cert.pem -config openssl_ca.cnf
-openssl ca -name CA_root -extensions user_cert -days 18250 -in ok_cert.req -out ok_cert.pem -config openssl_ca.cnf 
-
-  Each generated certificate (.pem) and private key (.key) were then combined
-  into a single file matching the naming scheme described above.
diff --git a/net/data/ssl/certificates/expired_cert.pem b/net/data/ssl/certificates/expired_cert.pem
@@ -1,77 +1,41 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 1 (0x1)
-        Signature Algorithm: sha1WithRSAEncryption
-        Issuer: C=US, ST=California, L=Mountain View, O=Test CA, CN=Test Root CA
-        Validity
-            Not Before: Jan  1 00:00:00 2006 GMT
-            Not After : Jan  1 00:00:00 2007 GMT
-        Subject: C=US, ST=California, L=Mountain View, O=Test CA, CN=127.0.0.1
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-            RSA Public Key: (1024 bit)
-                Modulus (1024 bit):
-                    00:d3:b1:98:19:4f:40:2b:f0:73:a0:e1:9d:af:32:
-                    36:cb:62:aa:d9:9e:81:a1:60:1a:a8:2f:1a:6f:f3:
-                    0e:5e:31:50:a6:a3:f3:15:b1:71:8e:e7:e6:9b:ed:
-                    7f:b5:ff:2f:3e:b3:50:83:5b:70:a6:70:80:32:d5:
-                    26:6c:67:bb:40:41:0d:b7:63:f0:60:b8:63:d0:ad:
-                    10:be:4b:ad:b2:57:9f:c1:fc:42:2e:56:46:71:b8:
-                    78:00:28:9e:ec:80:2d:8d:a5:4e:c6:3c:e0:53:9a:
-                    a3:c8:4b:3c:58:0f:89:4c:64:93:c0:db:49:a4:85:
-                    1e:50:31:b6:4e:66:c7:a1:fb
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:FALSE
-            X509v3 Subject Key Identifier: 
-                32:7B:D6:18:4F:26:9C:71:90:B5:37:FF:E4:33:5E:C8:C5:02:34:90
-            X509v3 Authority Key Identifier: 
-                keyid:CB:0C:83:29:5E:38:A2:D6:9F:F7:76:FB:B3:B6:48:84:4E:F8:4D:F3
-
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication, TLS Web Client Authentication
-            X509v3 Subject Alternative Name: 
-                IP Address:127.0.0.1
-    Signature Algorithm: sha1WithRSAEncryption
-        66:6b:d6:b8:e5:77:c8:e5:af:6d:5f:f9:97:cd:ae:72:f0:68:
-        23:28:b2:58:d2:6d:b0:37:5f:ec:36:d5:77:af:a2:80:02:27:
-        02:43:84:e7:de:54:7a:40:43:06:fd:93:78:59:16:d4:6f:e5:
-        a0:a5:6d:98:26:1b:6d:bf:67:92:67:e6:d1:d2:e7:e0:b2:5d:
-        ee:83:00:ab:1a:15:bd:25:a7:be:36:26:06:34:3b:1c:5d:be:
-        21:31:45:51:4c:0e:83:c2:04:e6:fd:2e:a9:94:f8:8a:4e:ff:
-        af:89:ac:47:4c:85:79:19:f0:68:32:4c:aa:c0:6a:6c:9f:dc:
-        4d:50
 -----BEGIN CERTIFICATE-----
-MIICujCCAiOgAwIBAgIBATANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzET
-MBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzEQMA4G
-A1UECgwHVGVzdCBDQTEVMBMGA1UEAwwMVGVzdCBSb290IENBMB4XDTA2MDEwMTAw
-MDAwMFoXDTA3MDEwMTAwMDAwMFowYDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNh
-bGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEDAOBgNVBAoMB1Rlc3Qg
-Q0ExEjAQBgNVBAMMCTEyNy4wLjAuMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
-gYEA07GYGU9AK/BzoOGdrzI2y2Kq2Z6BoWAaqC8ab/MOXjFQpqPzFbFxjufmm+1/
-tf8vPrNQg1twpnCAMtUmbGe7QEENt2PwYLhj0K0QvkutslefwfxCLlZGcbh4ACie
-7IAtjaVOxjzgU5qjyEs8WA+JTGSTwNtJpIUeUDG2TmbHofsCAwEAAaOBgDB+MAwG
-A1UdEwEB/wQCMAAwHQYDVR0OBBYEFDJ71hhPJpxxkLU3/+QzXsjFAjSQMB8GA1Ud
-IwQYMBaAFMsMgyleOKLWn/d2+7O2SIRO+E3zMB0GA1UdJQQWMBQGCCsGAQUFBwMB
-BggrBgEFBQcDAjAPBgNVHREECDAGhwR/AAABMA0GCSqGSIb3DQEBBQUAA4GBAGZr
-1rjld8jlr21f+ZfNrnLwaCMosljSbbA3X+w21XevooACJwJDhOfeVHpAQwb9k3hZ
-FtRv5aClbZgmG22/Z5Jn5tHS5+CyXe6DAKsaFb0lp742JgY0OxxdviExRVFMDoPC
-BOb9LqmU+IpO/6+JrEdMhXkZ8GgyTKrAamyf3E1Q
+MIIEZDCCAkygAwIBAgIBAzANBgkqhkiG9w0BAQUFADBgMRAwDgYDVQQDEwdUZXN0
+IENBMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMN
+TW91bnRhaW4gVmlldzESMBAGA1UEChMJQ2VydCBUZXN0MB4XDTA2MDEwMTAwMDAw
+MFoXDTA3MDEwMTAwMDAwMFowSjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlm
+b3JuaWExEjAQBgNVBAoTCUNlcnQgVGVzdDESMBAGA1UEAxMJMTI3LjAuMC4xMIGf
+MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDuUjUPzXBw61Xsh1RGSyJowrqC+TYv
+pf44P2c5sF/Y/KX0LoJEA72in+2d7N8sf3IsJvy6X1uPnVdX7wKzgtHI6FFjOcbR
+zs9MiyEJkeFKADI+ZMV0httNOy93ajESsjZMwgoHMKOv5ikNCdwE/nefSfu6Zuap
+CsadArkHe3d5dwIDAQABo4HCMIG/MAkGA1UdEwQCMAAwHQYDVR0OBBYEFNr8t46H
+i0oOuzYzmjE24g25B9fKMIGSBgNVHSMEgYowgYeAFF3Of5nj1BlBMU/Gz7El9Vqv
+45cxoWSkYjBgMRAwDgYDVQQDEwdUZXN0IENBMQswCQYDVQQGEwJVUzETMBEGA1UE
+CBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzESMBAGA1UEChMJ
+Q2VydCBUZXN0ggkA1FGT1D/e2U4wDQYJKoZIhvcNAQEFBQADggIBABdhpWwsDDAn
+eQKSk70sigbUk1eeGzE0AR2nNfs1N/Lx+EYBmWdOEZTi5ngwJoDavb6okaOWRYV5
+nIyIWGuJQfJ6OPZycNn9HMC2vL9er2gu6y8/6Sob4POThAdf519oHXFWR7S5fnPK
+rvbspRHm/gycMA3Lvkzm2tHEQI4d+3pKAPtGtDUEnHEuo13tbaA3N8RJXStJXp4y
+foqYEPJpG5SD3hDBTlVbg6J3li6B4r2LfCMgRXjrsNJSBamPrXX8n+K2SzCPLDli
+9s387TMKLxGI7v5y5BcLcxuvBrAGS5rUw1q6+wNAvAkOSai6SfBmhUSn4OwQl0yX
+y/1IOj2iCEwUJDMHQRp0K03xvN+nAaqFbnbBxVcL42lgMkLt2cL+X4tkBPzx2/Ys
+4tuEk2/BftaHX0rby7OWCCh8q9QM+CmXzOipbwsjViTBpdR99RP7lrhojO3Tkx58
+bxHBj9EpOjxCQyv1x3xZ5GpyAIgSduVusHwk7FJBNetg5Csa0GBEr2d6Lh+zPSm/
+ZPgWqaVH6YoY+2HP2Mi2YxNYWJOR3ycNOxTuTp3M/glDBFYJaB5/PXTzFKrzo/vE
+za7vs4El0Ei7YZYC0vxqpUbiS6l7Ul+TPfk6q/OAkYjaJ76uYlcKVmN060wK83z5
+Vtoy6YuY/8hrMRl3jrMaiVsMSMg+nOsM
 -----END CERTIFICATE-----
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQDTsZgZT0Ar8HOg4Z2vMjbLYqrZnoGhYBqoLxpv8w5eMVCmo/MV
-sXGO5+ab7X+1/y8+s1CDW3CmcIAy1SZsZ7tAQQ23Y/BguGPQrRC+S62yV5/B/EIu
-VkZxuHgAKJ7sgC2NpU7GPOBTmqPISzxYD4lMZJPA20mkhR5QMbZOZseh+wIDAQAB
-AoGAQlI9SJCfliR61UhZ0m105TtAM3WJPzmQoGhBbBlFwxTII6zxlzZEUXUttmQt
-wqLz9jzPWJfpLvvH7iUBKK1G6ESXTzquNUYq6Yhn48EeLUygjple/T2EYwHxrVKg
-lxt7TpFrkH/lJyRSRTSJjCnBBMfFwM8NA7rJkONsUocyKqECQQDsR6DAAmiw5PDe
-PRiPww+Dup9Tps1DpcVcbzXw66bGRnM8WlTu++IQPzn09mGCBjFVEX0TjdGl9OLx
-GFvfGPjNAkEA5Vyoi4YIiF22Ul/9Mwo5wmqOaTK2WZO/4XynpstW7n0ySk5XIKL4
-x17NMTuhbXqLtvO4LLRboIE1O3cFlm+l5wJAKQvUcCa6+yf6dBEXCDpxooe0D/sl
-I4BTxdgH/d9iLIWmlTB4GsAlKH9jWRvIGqdqwIV2PgRgDD17gzihFSOobQJAHR/w
-/xacCsTrm/Y4brzDrN5fCxi3cxSB7x4nI9T6Svp24lykT66iLJ7rK29JBl/jUe4M
-2xBj+jOuEMkCWqH+zQJAfY8tFgk+lTz4uXklpyeU1ZR9VZup4g3eJf21bp5nBRfk
-yROePkvzYNRyOIceRKFMXMUWQ2+CPauBCiwZcOpISQ==
+MIICWwIBAAKBgQDuUjUPzXBw61Xsh1RGSyJowrqC+TYvpf44P2c5sF/Y/KX0LoJE
+A72in+2d7N8sf3IsJvy6X1uPnVdX7wKzgtHI6FFjOcbRzs9MiyEJkeFKADI+ZMV0
+httNOy93ajESsjZMwgoHMKOv5ikNCdwE/nefSfu6ZuapCsadArkHe3d5dwIDAQAB
+AoGARF1wu0fDqaDY1TE9C60iActalZfH44NKmfgWNIZT+HsBYDq3Q6uPCse18kew
+/aLRrbjBZvVT3q7UD3WQ4M32P44rEAAhdYGhMndF53xrtX5SQ7LPb381mlPoJ2AE
+Wv9R+0X45aRtiSC/Y7E9ebN5p4RY9NjRUjcaI67d1NgNAwECQQD6k83u6R73tsJt
+k2OCTnUxvQi9Oo5GwDfiubHOQx3tG3ZDIjsyg1GCJa/PVRiP6PXkgIoAWmiyGFIR
++gIO86kPAkEA83qA4L4HxLQLapDvBDNgiz9eHA/FJvsk5yH0jupR+CDLRqM6Dfzj
+iLeztyJV3n96lMDIc4lEzplysDw/TD6ZGQJABzYFsSBoUbyir8CUFoXnfXzxKXDr
+80FI2m95nHP2AoLNznTHu1ZoHBS1kIPkZw/PM7o3Pndbl/R3OCk3sfJ1JQJABSB7
+PkBCIZ4471GF9uyuB8CZ1rVuTVfUexl38Np2R2dJYH9nZYwBrotPuXd7n2fHyQIW
+NniZflA03gkmvBBFYQJADftQ5+jabFxXkqwZsrsvtG+Ji53BZrLrczFxgPyGVfUF
+A1pyQE3M6SykYjp+S3Zg6eS+yKE06guecEVhTQtwBA==
 -----END RSA PRIVATE KEY-----