Testsuite for X.509 PKIX (RFC5280) implementations
remove CLA request
change xf to ok for soon-generalized-time
change xf to ok for subject-t61


browse  log 



You can also use your local clone with git send-email.

#X.509 Test

This project helps with the testing of X.509 PKIX (RFC5280) implementations, by providing test certificates and automation.

The original idea for this project was to work through the text of RFC5280 and create an invalid test certificate corresponding to each MUST or SHOULD clause in the RFC. These invalid certificates are then signed by a fake CA, and can be fed to various TLS implementations to see whether they are accepted.

This is a fork of https://github.com/google/x509test


This project relies on the following tools being present in the PATH:

  • the ascii2der and der2ascii tools from the der-ascii open source project
  • the openssl binary.


The project is built from the top-level Makefile, where the master check target will:

  • Create a private key (ca/fake-ca.private.pem) for the fake CA, and build a corresponding CA certificate (in ca/fake-ca.cert).
  • Build a complete certificate for each test case (in tbs/*.tbs), signed by the fake CA (in certs/ or certs2/).
  • Run each certificate through various different TLS implementations, saving the output (in results/$TOOL/*.out).
  • Emit a summary of verification failures.

#Project Layout

The project is organized as follows.

  • The tbs/ directory holds the test certificates, in the form of ASCII files suitable for feeding to the ascii2der tool. These certificates are in the form of the TBSCertificate ASN.1 type, and they pull in shared common fragments (from the tbs/fragment/ subdirectory) using a #include extension to the ASCII format.
  • The tbs2/ directory holds pairs of certificates where the leaf certificate (*.leaf.tbs) is signed by an intermediate CA certificate (*.ca.tbs).
  • The scripts/ directory holds scripts that allow the certificates to be fed to the different TLS implementations and their results checked.
  • The cfg/ directory holds additional configuration files, e.g. for controlling OpenSSL's certificate generation process.
  • The third_party/ietf/ holds local copies of the relevant specifications and RFCs.


This is not an official Google product.