remove CLA request
change xf to ok for soon-generalized-time
change xf to ok for subject-t61
This project helps with the testing of X.509 PKIX (RFC5280) implementations, by providing test certificates and automation.
The original idea for this project was to work through the text of RFC5280 and create an invalid test certificate corresponding to each MUST or SHOULD clause in the RFC. These invalid certificates are then signed by a fake CA, and can be fed to various TLS implementations to see whether they are accepted.
This is a fork of https://github.com/google/x509test
This project relies on the following tools being present in the PATH
:
ascii2der
and der2ascii
tools from the der-ascii open source projectopenssl
binary.The project is built from the top-level Makefile
, where the
master check
target will:
ca/fake-ca.private.pem
) for the fake CA, and build
a corresponding CA certificate (in ca/fake-ca.cert
).tbs/*.tbs
), signed by
the fake CA (in certs/
or certs2/
).results/$TOOL/*.out
).The project is organized as follows.
tbs/
directory holds the test certificates, in the form of ASCII
files suitable for feeding to the
ascii2der
tool. These
certificates are in the form of the TBSCertificate
ASN.1 type, and they
pull in shared common fragments (from the tbs/fragment/
subdirectory)
using a #include
extension to the ASCII format.tbs2/
directory holds pairs of certificates where the leaf
certificate (*.leaf.tbs
) is signed by an intermediate CA certificate
(*.ca.tbs
).scripts/
directory holds scripts that allow the certificates to be
fed to the different TLS implementations and their results checked.cfg/
directory holds additional configuration files, e.g. for
controlling OpenSSL's certificate generation process.third_party/ietf/
holds local copies of the relevant specifications
and RFCs.This is not an official Google product.