Skip to content

Commit 754b388

Browse files
UlisesGasconaduh95
UlisesGascon
authored and
aduh95
committed
tls: test the SPKI blocklist with a fixture key
Replace the test-only hooks on the crypto binding, and the process-wide list and mutex they required on every handshake, with a fixture CA whose public key is a permanent entry on the compiled-in blocklist. The test now exercises the real list through full handshakes, without --expose-internals, and the production path is a comparison against a constant array. The new fixtures provide two chains that contain the blocked key: a server certificate issued by blocked-ca, and one issued by ca1 that reuses the blocked key itself. The private key is checked in like every other fixture key, so blocking it costs nothing. It is pinned in the fixtures Makefile, since its digest is compiled in. Refs: #66871 (comment) Assisted-by: Claude, Codex Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com> PR-URL: #66949 Reviewed-By: Tim Perry <pimterry@gmail.com>
1 parent 9c57966 commit 754b388

17 files changed

Lines changed: 406 additions & 154 deletions

‎src/crypto/crypto_context.cc‎

Lines changed: 10 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
#include "ncrypto.h"
1111
#include "node.h"
1212
#include "node_buffer.h"
13-
#include "node_mutex.h"
1413
#include "node_options.h"
1514
#include "util.h"
1615
#include "v8.h"
@@ -32,7 +31,6 @@
3231
#endif
3332

3433
#include <array>
35-
#include <cstring>
3634
#include <set>
3735

3836
namespace node {
@@ -1428,29 +1426,18 @@ constexpr SpkiHash kBlockedSPKIs[] = {
14281426
{0xe0, 0x25, 0x4c, 0x7f, 0xcd, 0xc2, 0x65, 0xe2, 0xf0, 0xf8, 0xa4,
14291427
0x28, 0xda, 0xbb, 0x75, 0xab, 0x4a, 0xe0, 0x39, 0xb4, 0x87, 0x2d,
14301428
0x62, 0xf5, 0xee, 0x57, 0xf0, 0x87, 0x7d, 0x5a, 0x8a, 0x41},
1429+
// Test fixture, not a real CA: test/fixtures/keys/blocked-ca-key.pem.
1430+
// Its private key is public, so blocking it costs nothing and lets
1431+
// test/parallel/test-tls-spki-blocklist.js exercise the real list. The
1432+
// key is pinned in the fixtures Makefile; rotating it means updating
1433+
// this entry too.
1434+
// a6cbb923961eada55c02f104681aeabe52ea1508ece2078aec11d00a5778ce71
1435+
// C=US, ST=CA, L=SF, O=Joyent, OU=Node.js, CN=blocked-ca
1436+
{0x41, 0xc2, 0xd1, 0xc4, 0x24, 0x68, 0x46, 0x6a, 0x54, 0x24, 0x83,
1437+
0x69, 0xf6, 0x65, 0x9a, 0x95, 0x52, 0xc5, 0xa4, 0x16, 0xf8, 0xd5,
1438+
0xfc, 0xd8, 0xdd, 0x55, 0xa8, 0x75, 0xd7, 0x20, 0xaa, 0xc2},
14311439
};
14321440

1433-
// Extra entries registered by the test-only hooks on the crypto binding.
1434-
// The list is process-wide and TLS handshakes may run on worker threads, so
1435-
// every access goes through the mutex.
1436-
Mutex& BlockedSPKIsForTestingMutex() {
1437-
static Mutex mutex;
1438-
return mutex;
1439-
}
1440-
1441-
std::vector<SpkiHash>& BlockedSPKIsForTesting() {
1442-
static std::vector<SpkiHash> list;
1443-
return list;
1444-
}
1445-
1446-
bool IsBlockedSPKIForTesting(const SpkiHash& digest) {
1447-
Mutex::ScopedLock lock(BlockedSPKIsForTestingMutex());
1448-
for (const auto& blocked : BlockedSPKIsForTesting()) {
1449-
if (digest == blocked) return true;
1450-
}
1451-
return false;
1452-
}
1453-
14541441
enum class SpkiCheck { kAllowed, kBlocked, kError };
14551442

14561443
// Hashes the DER-encoded SubjectPublicKeyInfo of `cert` and looks it up in
@@ -1474,7 +1461,6 @@ SpkiCheck CheckSPKI(X509* cert) {
14741461
for (const auto& blocked : kBlockedSPKIs) {
14751462
if (digest == blocked) return SpkiCheck::kBlocked;
14761463
}
1477-
if (IsBlockedSPKIForTesting(digest)) return SpkiCheck::kBlocked;
14781464
return SpkiCheck::kAllowed;
14791465
}
14801466

@@ -1594,26 +1580,6 @@ void InstallCertVerifyCallback(SSL_CTX* ctx) {
15941580
SSL_CTX_set_cert_verify_callback(ctx, CertVerifyCallback, nullptr);
15951581
}
15961582

1597-
void SecureContext::AddBlockedSPKIForTesting(
1598-
const FunctionCallbackInfo<Value>& args) {
1599-
Environment* env = Environment::GetCurrent(args);
1600-
THROW_AND_RETURN_IF_NOT_BUFFER(env, args[0], "SPKI hash");
1601-
ArrayBufferOrViewContents<uint8_t> hash(args[0]);
1602-
if (hash.size() != kSpkiHashLength) {
1603-
return THROW_ERR_OUT_OF_RANGE(env, "SPKI hash must be 32 bytes");
1604-
}
1605-
SpkiHash entry;
1606-
memcpy(entry.data(), hash.data(), entry.size());
1607-
Mutex::ScopedLock lock(BlockedSPKIsForTestingMutex());
1608-
BlockedSPKIsForTesting().push_back(entry);
1609-
}
1610-
1611-
void SecureContext::ClearBlockedSPKIsForTesting(
1612-
const FunctionCallbackInfo<Value>& args) {
1613-
Mutex::ScopedLock lock(BlockedSPKIsForTestingMutex());
1614-
BlockedSPKIsForTesting().clear();
1615-
}
1616-
16171583
void SecureContext::Initialize(Environment* env, Local<Object> target) {
16181584
Local<Context> context = env->context();
16191585
SetConstructorFunction(context,
@@ -1641,12 +1607,6 @@ void SecureContext::Initialize(Environment* env, Local<Object> target) {
16411607
target,
16421608
"getCertificateCompressionAlgorithms",
16431609
GetCertificateCompressionAlgorithms);
1644-
SetMethod(
1645-
context, target, "addBlockedSPKIForTesting", AddBlockedSPKIForTesting);
1646-
SetMethod(context,
1647-
target,
1648-
"clearBlockedSPKIsForTesting",
1649-
ClearBlockedSPKIsForTesting);
16501610
}
16511611

16521612
void SecureContext::RegisterExternalReferences(
@@ -1689,8 +1649,6 @@ void SecureContext::RegisterExternalReferences(
16891649
registry->Register(GetUserRootCertificates);
16901650
registry->Register(StartLoadingCertificatesOffThread);
16911651
registry->Register(GetCertificateCompressionAlgorithms);
1692-
registry->Register(AddBlockedSPKIForTesting);
1693-
registry->Register(ClearBlockedSPKIsForTesting);
16941652
}
16951653

16961654
SecureContext* SecureContext::Create(Environment* env) {

‎src/crypto/crypto_context.h‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -153,15 +153,6 @@ class SecureContext final : public BaseObject {
153153
template <bool primary>
154154
static void GetCertificate(const v8::FunctionCallbackInfo<v8::Value>& args);
155155

156-
// Test-only hooks for the SPKI blocklist that every SSL_CTX applies
157-
// during certificate verification. Reachable through
158-
// internalBinding('crypto') with --expose-internals. The argument is the
159-
// SHA-256 of a DER-encoded SubjectPublicKeyInfo.
160-
static void AddBlockedSPKIForTesting(
161-
const v8::FunctionCallbackInfo<v8::Value>& args);
162-
static void ClearBlockedSPKIsForTesting(
163-
const v8::FunctionCallbackInfo<v8::Value>& args);
164-
165156
static int TicketKeyCallback(SSL* ssl,
166157
unsigned char* name,
167158
unsigned char* iv,

‎test/fixtures/keys/Makefile‎

Lines changed: 77 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ all: \
1212
ca4-cert.pem \
1313
ca5-cert.pem \
1414
ca6-cert.pem \
15+
blocked-ca-cert.pem \
16+
blocked-ca-leaf-cert.pem \
17+
blocked-key-leaf-cert.pem \
1518
cert-without-key-fips.pfx \
1619
agent1-cert.pem \
1720
agent1-fips.pfx \
@@ -225,6 +228,79 @@ ca3-cert.pem: ca3-csr.pem ca3-key.pem ca3.cnf ca1-cert.pem ca1-key.pem
225228
-CAcreateserial \
226229
-out ca3-cert.pem
227230

231+
#
232+
# blocked-ca is a subordinate CA issued by ca1 whose public key is on the
233+
# compiled-in SPKI blocklist (src/crypto/crypto_context.cc). Any chain that
234+
# contains this key must be rejected, so it is used to test the blocklist.
235+
# The certificates can be regenerated freely; the key cannot (see below).
236+
# blocked-ca-leaf is a server cert issued by blocked-ca; blocked-key-leaf is
237+
# a server cert issued by ca1 that reuses the blocked key itself.
238+
# ('password' is used for the CA password.)
239+
#
240+
# The SHA-256 of this key's SubjectPublicKeyInfo is compiled into
241+
# src/crypto/crypto_context.cc, so the key is pinned: it is kept across
242+
# `make clean` and never regenerated here. Rotating it means updating the
243+
# digest and fingerprint in that file as well.
244+
blocked-ca-key.pem:
245+
@echo "$@ is pinned (see src/crypto/crypto_context.cc); restore it with: git checkout -- $@" >&2
246+
@exit 1
247+
248+
blocked-ca-csr.pem: blocked-ca.cnf blocked-ca-key.pem
249+
openssl req -new \
250+
-extensions v3_ca \
251+
-config blocked-ca.cnf \
252+
-key blocked-ca-key.pem \
253+
-out blocked-ca-csr.pem
254+
255+
blocked-ca-cert.pem: blocked-ca-csr.pem blocked-ca-key.pem blocked-ca.cnf ca1-cert.pem ca1-key.pem
256+
openssl x509 -req \
257+
-extfile blocked-ca.cnf \
258+
-extensions v3_ca \
259+
-days 99999 \
260+
-passin "pass:password" \
261+
-in blocked-ca-csr.pem \
262+
-CA ca1-cert.pem \
263+
-CAkey ca1-key.pem \
264+
-CAcreateserial \
265+
-out blocked-ca-cert.pem
266+
267+
blocked-ca-leaf-key.pem:
268+
openssl genrsa -out blocked-ca-leaf-key.pem 2048
269+
270+
blocked-ca-leaf-csr.pem: blocked-ca-leaf.cnf blocked-ca-leaf-key.pem
271+
openssl req -new \
272+
-config blocked-ca-leaf.cnf \
273+
-key blocked-ca-leaf-key.pem \
274+
-out blocked-ca-leaf-csr.pem
275+
276+
blocked-ca-leaf-cert.pem: blocked-ca-leaf-csr.pem blocked-ca-cert.pem blocked-ca-key.pem
277+
openssl x509 -req \
278+
-days 99999 \
279+
-in blocked-ca-leaf-csr.pem \
280+
-CA blocked-ca-cert.pem \
281+
-CAkey blocked-ca-key.pem \
282+
-CAcreateserial \
283+
-extfile blocked-ca-leaf.cnf \
284+
-out blocked-ca-leaf-cert.pem
285+
cat blocked-ca-cert.pem >> blocked-ca-leaf-cert.pem
286+
287+
blocked-key-leaf-csr.pem: blocked-key-leaf.cnf blocked-ca-key.pem
288+
openssl req -new \
289+
-config blocked-key-leaf.cnf \
290+
-key blocked-ca-key.pem \
291+
-out blocked-key-leaf-csr.pem
292+
293+
blocked-key-leaf-cert.pem: blocked-key-leaf-csr.pem ca1-cert.pem ca1-key.pem
294+
openssl x509 -req \
295+
-days 99999 \
296+
-passin "pass:password" \
297+
-in blocked-key-leaf-csr.pem \
298+
-CA ca1-cert.pem \
299+
-CAkey ca1-key.pem \
300+
-CAcreateserial \
301+
-extfile blocked-key-leaf.cnf \
302+
-out blocked-key-leaf-cert.pem
303+
228304
#
229305
# Create Subordinate Certificate Authority: ca4 issued by ca2
230306
# ('password' is used for the CA password.)
@@ -1312,7 +1388,7 @@ non-canonical-ip-dns-key.pem:
13121388
openssl ecparam -name prime256v1 -genkey -noout -out non-canonical-ip-dns-key.pem
13131389

13141390
clean:
1315-
rm -f *.pfx *.pem *.srl ca2-database.txt ca2-crl-agent3-database.txt* ca2-crl-agent3.cnf ca2-serial fake-startcom-root-serial *.print *.old fake-startcom-root-issued-certs/*.pem
1391+
rm -f *.pfx $(filter-out blocked-ca-key.pem,$(wildcard *.pem)) *.srl ca2-database.txt ca2-crl-agent3-database.txt* ca2-crl-agent3.cnf ca2-serial fake-startcom-root-serial *.print *.old fake-startcom-root-issued-certs/*.pem
13161392
@> fake-startcom-root-database.txt
13171393

13181394
test: agent1-verify agent2-verify agent3-verify agent4-verify agent5-verify agent6-verify agent7-verify agent8-verify agent10-verify ec10-verify

‎test/fixtures/keys/blocked-ca-cert.pem‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIEZjCCA06gAwIBAgIUFH02wcL3Qgben6tfIibXitsApCswDQYJKoZIhvcNAQEL
3+
BQAwejELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMQswCQYDVQQHDAJTRjEPMA0G
4+
A1UECgwGSm95ZW50MRAwDgYDVQQLDAdOb2RlLmpzMQwwCgYDVQQDDANjYTExIDAe
5+
BgkqhkiG9w0BCQEWEXJ5QHRpbnljbG91ZHMub3JnMCAXDTI2MTAyMzA5MzE1M1oY
6+
DzIzMDAwODA3MDkzMTUzWjCBhjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMQsw
7+
CQYDVQQHDAJTRjEPMA0GA1UECgwGSm95ZW50MRAwDgYDVQQLDAdOb2RlLmpzMRMw
8+
EQYDVQQDDApibG9ja2VkLWNhMSUwIwYJKoZIhvcNAQkBFhZibG9ja2VkLWNhQGV4
9+
YW1wbGUub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3JSHZeuE
10+
OSZ77MDkjTgJRhQJtvLruDJdA2hVfT47aST8cXqfHAR+tQsotBcIc4b69l1QxIts
11+
SYkmiQbbnObIj1pAbmZ3blFy+13wNxfnLJR2Jh51vZyUTQMX+KIlrrzg9qpfOGi1
12+
D1zJvCSs5pyxpsGZ1GZxiFVTIGqZ4PZApyTjobqsivLV5FYiRgGESHXziRPJBeKY
13+
D9MGKslA8p1qY79iqyaoY580xkiFNXeXsmguy96+KdEuGlfdpT+mPsCRWEU7Rt9E
14+
wXsqUAPcZ0/22u62IJvBapMf3lvbTo3M6vraQmFEwsqlxeaWDhx6621VjHzsTHp9
15+
8Ko2VExaIYoSNQIDAQABo4HUMIHRMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFBO3
16+
GH448bBtSUSGJcz0UV8t0M2AMIGhBgNVHSMEgZkwgZahfqR8MHoxCzAJBgNVBAYT
17+
AlVTMQswCQYDVQQIDAJDQTELMAkGA1UEBwwCU0YxDzANBgNVBAoMBkpveWVudDEQ
18+
MA4GA1UECwwHTm9kZS5qczEMMAoGA1UEAwwDY2ExMSAwHgYJKoZIhvcNAQkBFhFy
19+
eUB0aW55Y2xvdWRzLm9yZ4IUSrFsjf1qfQ0t/KvfnEsOksatAikwDQYJKoZIhvcN
20+
AQELBQADggEBAKl9HrTXud8wHFRGTrrJBMOP5jZO50Sgf6/QSg3gVxLbTnraZDUq
21+
PD3MKON95r/4ksa139/SIcTPSU6Nr4uJw4iVtfMgXr5/cUOeJN+l6z9Ju0bN1Fiu
22+
xLXNgm7fHcNS2SkNxFKDCK7D11nhgkwUgs/JPQWD2DLmfoVScScQNXuFmgOYxUdI
23+
Lfis9fdnAlTwFvu87FxFhKNjTD+gbo16KUz+uhevOHz+b2MZNgqhNklePP/mlQhx
24+
kWzDz9B6ofhn3SD/q/idtQuEntVM7qV60ZXj27ELS58q7DnbwCJ/Kivl+cjKLmSJ
25+
3EbbetSB6+9PA5MJjAMgInyfSAHw+S1IFqk=
26+
-----END CERTIFICATE-----

‎test/fixtures/keys/blocked-ca-cert.srl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
5A1AB9CDD00373643B19FADBFB08C51AE1EEFBC6

‎test/fixtures/keys/blocked-ca-csr.pem‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
-----BEGIN CERTIFICATE REQUEST-----
2+
MIIC8TCCAdkCAQAwgYYxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTELMAkGA1UE
3+
BwwCU0YxDzANBgNVBAoMBkpveWVudDEQMA4GA1UECwwHTm9kZS5qczETMBEGA1UE
4+
AwwKYmxvY2tlZC1jYTElMCMGCSqGSIb3DQEJARYWYmxvY2tlZC1jYUBleGFtcGxl
5+
Lm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANyUh2XrhDkme+zA
6+
5I04CUYUCbby67gyXQNoVX0+O2kk/HF6nxwEfrULKLQXCHOG+vZdUMSLbEmJJokG
7+
25zmyI9aQG5md25Rcvtd8DcX5yyUdiYedb2clE0DF/iiJa684PaqXzhotQ9cybwk
8+
rOacsabBmdRmcYhVUyBqmeD2QKck46G6rIry1eRWIkYBhEh184kTyQXimA/TBirJ
9+
QPKdamO/YqsmqGOfNMZIhTV3l7JoLsvevinRLhpX3aU/pj7AkVhFO0bfRMF7KlAD
10+
3GdP9trutiCbwWqTH95b206NzOr62kJhRMLKpcXmlg4ceuttVYx87Ex6ffCqNlRM
11+
WiGKEjUCAwEAAaAlMCMGCSqGSIb3DQEJBzEWDBRBIGNoYWxsZW5nZSBwYXNzd29y
12+
ZDANBgkqhkiG9w0BAQsFAAOCAQEAq+O48whfKxxS8PmRRoyrnNMpFAjwLW6QXNc0
13+
5VPTFU66mPxrG4zNTA0Jr0Z8P1SRAmMADFcWWIRW/qWg81nSRJAn1YbUyMj8Pq0O
14+
WUIItJsHMobCLEe/dDyIw30mPCjTqaYc7ZQ1joTnejQmhlza02FTzePKs1HApQlt
15+
NLkOheK4dx3C92YJFL5pd9pw1tsBBXeKt7X7hJ69ykvNPqmzN7gam4D+g+SA4dSL
16+
BR5fbW8cBTKzgydDRp9kV8SPyjE8Rt1LZFeRelRe5ow/iNlf0zZvO1/PfFv0gJZa
17+
Lp1gx0E5QaDhmlnGFToNxIgDtVAAqwWpFvBOwLWiOZBIBpm2Fw==
18+
-----END CERTIFICATE REQUEST-----

‎test/fixtures/keys/blocked-ca-key.pem‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDclIdl64Q5Jnvs
3+
wOSNOAlGFAm28uu4Ml0DaFV9PjtpJPxxep8cBH61Cyi0Fwhzhvr2XVDEi2xJiSaJ
4+
Btuc5siPWkBuZnduUXL7XfA3F+cslHYmHnW9nJRNAxf4oiWuvOD2ql84aLUPXMm8
5+
JKzmnLGmwZnUZnGIVVMgapng9kCnJOOhuqyK8tXkViJGAYRIdfOJE8kF4pgP0wYq
6+
yUDynWpjv2KrJqhjnzTGSIU1d5eyaC7L3r4p0S4aV92lP6Y+wJFYRTtG30TBeypQ
7+
A9xnT/ba7rYgm8Fqkx/eW9tOjczq+tpCYUTCyqXF5pYOHHrrbVWMfOxMen3wqjZU
8+
TFohihI1AgMBAAECggEAEafi4ZXVLtTlgPkcojAcz+rtLyNpGkSPvOTWSPDZBQzE
9+
lxm7UB0M/lVPFAEu+D5S6rLj8uN9DrLHbprpq7iuT4koFJ4ni6FB3JxzjJlhc+hL
10+
P7ha8MsudK6dddWWwhKUyDGxbvy0l270J9bgrxHWR3SCKWXsyv6XaYYW3JKhcK9l
11+
bVli1AVRk8JapNkkHfUxp0AxUJRbixlts760lXgArp74XLohleL0tw9lOoE+PWVY
12+
1dvO9X+sOu3a1t/EK3cz9gXYoU1GgR3sy59Y6lweMBnarbdHDqMhWojV/MQGyD7e
13+
WA+XS4Z/4kc4fGoCdFFLM9wznPevDfOEv4oOnS7vWQKBgQDt7vmYhVEUQ2QXtYaX
14+
MwN+UBoNinrcxXvzqbzTMD7A1ahxZm3e3aNjD7kILYI43EIfdUBYnkY3GhIMuz5B
15+
+66BhsesGFAL9n9mDSbou/Ykr5sQ9VsqGeEjTGbXSujGVrQDGnSzIfKDRx71SlYA
16+
CnknFHn+DWqJQonrWNm46S29/QKBgQDtVDworobAkD8dmWi8sT4c60qLVp/7Pyp9
17+
W8fun4JXS1JlRZ/+N0C1qephD3/q/MVP4WDnUUR8BDvStWRxtSmJ8e2sTyB23IGx
18+
tt6JOS2nQxppcd6+PQ5FQHYxI20GE/IwpiPRr8mbyi9hDEUgRm+7xyjpYeE9U6Hv
19+
skRxpsV+mQKBgG6HENNVOvDazWhmHvul6v2GYFPh/GkKJCZwtxKz2rLhjboABxH8
20+
i6W87AtseI3JY74RTa7c92kpZzEa2jT0oX/yCFddg/HKtCvH+Ecs6Y7pNHOQRqUs
21+
GHW5TBy+45sfM8gtRgDgyDNLmon/2itysg0BahomSVMx4be+MoW/bExRAoGBAJZf
22+
2iJYuw8GFse1bVSp5VZDi58QCxwR4OU/I0ZCET8ofZOncwGLltfESrqnLIEDGi5L
23+
+q92obMGp7URtAwMIr7B6LtWA5bsjszAtu4xqYiijvii6uSVIRamCn2GGc1RFBLZ
24+
Ijb5b//jMvQF50LU/nT3cye1GhdWh3Ot+4obhmV5AoGAG29zxE7brtbHx05P8iZ5
25+
tsQyPWx69uYZ6MU84eb5hdLJyo1jddTTolhedO0oIpyIPCna0HWkNmNXJzzof1He
26+
WfnKQZxbFQuiigP/u8/UlV8GF+rL9Vu5Wac156CsAqWdK0YokV5xOL/Dg0xzXigS
27+
/HOGgpgUjvkKU40z37qs0MI=
28+
-----END PRIVATE KEY-----

‎test/fixtures/keys/blocked-ca-leaf-cert.pem‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDljCCAn4CFFoauc3QA3NkOxn62/sIxRrh7vvGMA0GCSqGSIb3DQEBCwUAMIGG
3+
MQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExCzAJBgNVBAcMAlNGMQ8wDQYDVQQK
4+
DAZKb3llbnQxEDAOBgNVBAsMB05vZGUuanMxEzARBgNVBAMMCmJsb2NrZWQtY2Ex
5+
JTAjBgkqhkiG9w0BCQEWFmJsb2NrZWQtY2FAZXhhbXBsZS5vcmcwIBcNMjYxMDIz
6+
MDkzMTU0WhgPMjMwMDA4MDcwOTMxNTRaMIGFMQswCQYDVQQGEwJVUzELMAkGA1UE
7+
CAwCQ0ExCzAJBgNVBAcMAlNGMQ8wDQYDVQQKDAZKb3llbnQxEDAOBgNVBAsMB05v
8+
ZGUuanMxEjAQBgNVBAMMCWxvY2FsaG9zdDElMCMGCSqGSIb3DQEJARYWYmxvY2tl
9+
ZC1jYUBleGFtcGxlLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
10+
ANi/4BRZJCWbt6/0u6N1JAEHZtjQHJIkLsla2hIIqRzidIwZIvatkQYF2E2IAxjM
11+
E5fxVrZPCS29lyMnt+cgm/29OuLdHEf5wbZuXtXR01VrAY0Sd5YumFvpUDPxnB15
12+
NKKwClnx/op64ePglSbwgLqQpH94iiOsrp721n4aAGuxOwA1P4u64dT3ry4fclPw
13+
UIlq51EyQqNJ/1CtHXqGgdbXuEAUNy1iBb0EM9IVSAieDaPwlwuVG6k1e8cqGkXC
14+
gdtL29XLoX47rd58s9C9hI5u9e+BNLWtLIrJYtbGqQgF05BZbk+yH9pyeracQEXy
15+
ZyV1cJ0iVLpWByu7PNvjuisCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEA1xqSl5FF
16+
23kKf+7gbPydD3/gIuZlsFAGPa9CaTrIs/hDZAX086KEadroSzWmNvlsGhNxCUug
17+
A5u5zDXir6SWHomnLggkA9S+TDBcF5IQp0DrGEZ3MpOAsbi6a+Qwofnc+jwwjBui
18+
FMYCJaVh5tQeY1MVxRbYL7hDiWe74k01WOczVCe726bvkUcryTa+jCR8h8jX1DRr
19+
xvgnU1KV7futG/afwM8if/XdyNKbPgtkP8HFgHEQLHXPMwju5ft73vW33TuGzIIW
20+
HNACy9z8Swqik8V2k7Mo0d0l5sEWtoablbAo53qDE1dW5wSVOxpTlDhOlxxrS0/T
21+
8nb7gMePTFNW+Q==
22+
-----END CERTIFICATE-----
23+
-----BEGIN CERTIFICATE-----
24+
MIIEZjCCA06gAwIBAgIUFH02wcL3Qgben6tfIibXitsApCswDQYJKoZIhvcNAQEL
25+
BQAwejELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMQswCQYDVQQHDAJTRjEPMA0G
26+
A1UECgwGSm95ZW50MRAwDgYDVQQLDAdOb2RlLmpzMQwwCgYDVQQDDANjYTExIDAe
27+
BgkqhkiG9w0BCQEWEXJ5QHRpbnljbG91ZHMub3JnMCAXDTI2MTAyMzA5MzE1M1oY
28+
DzIzMDAwODA3MDkzMTUzWjCBhjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMQsw
29+
CQYDVQQHDAJTRjEPMA0GA1UECgwGSm95ZW50MRAwDgYDVQQLDAdOb2RlLmpzMRMw
30+
EQYDVQQDDApibG9ja2VkLWNhMSUwIwYJKoZIhvcNAQkBFhZibG9ja2VkLWNhQGV4
31+
YW1wbGUub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3JSHZeuE
32+
OSZ77MDkjTgJRhQJtvLruDJdA2hVfT47aST8cXqfHAR+tQsotBcIc4b69l1QxIts
33+
SYkmiQbbnObIj1pAbmZ3blFy+13wNxfnLJR2Jh51vZyUTQMX+KIlrrzg9qpfOGi1
34+
D1zJvCSs5pyxpsGZ1GZxiFVTIGqZ4PZApyTjobqsivLV5FYiRgGESHXziRPJBeKY
35+
D9MGKslA8p1qY79iqyaoY580xkiFNXeXsmguy96+KdEuGlfdpT+mPsCRWEU7Rt9E
36+
wXsqUAPcZ0/22u62IJvBapMf3lvbTo3M6vraQmFEwsqlxeaWDhx6621VjHzsTHp9
37+
8Ko2VExaIYoSNQIDAQABo4HUMIHRMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFBO3
38+
GH448bBtSUSGJcz0UV8t0M2AMIGhBgNVHSMEgZkwgZahfqR8MHoxCzAJBgNVBAYT
39+
AlVTMQswCQYDVQQIDAJDQTELMAkGA1UEBwwCU0YxDzANBgNVBAoMBkpveWVudDEQ
40+
MA4GA1UECwwHTm9kZS5qczEMMAoGA1UEAwwDY2ExMSAwHgYJKoZIhvcNAQkBFhFy
41+
eUB0aW55Y2xvdWRzLm9yZ4IUSrFsjf1qfQ0t/KvfnEsOksatAikwDQYJKoZIhvcN
42+
AQELBQADggEBAKl9HrTXud8wHFRGTrrJBMOP5jZO50Sgf6/QSg3gVxLbTnraZDUq
43+
PD3MKON95r/4ksa139/SIcTPSU6Nr4uJw4iVtfMgXr5/cUOeJN+l6z9Ju0bN1Fiu
44+
xLXNgm7fHcNS2SkNxFKDCK7D11nhgkwUgs/JPQWD2DLmfoVScScQNXuFmgOYxUdI
45+
Lfis9fdnAlTwFvu87FxFhKNjTD+gbo16KUz+uhevOHz+b2MZNgqhNklePP/mlQhx
46+
kWzDz9B6ofhn3SD/q/idtQuEntVM7qV60ZXj27ELS58q7DnbwCJ/Kivl+cjKLmSJ
47+
3EbbetSB6+9PA5MJjAMgInyfSAHw+S1IFqk=
48+
-----END CERTIFICATE-----

‎test/fixtures/keys/blocked-ca-leaf-csr.pem‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
-----BEGIN CERTIFICATE REQUEST-----
2+
MIIC8DCCAdgCAQAwgYUxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTELMAkGA1UE
3+
BwwCU0YxDzANBgNVBAoMBkpveWVudDEQMA4GA1UECwwHTm9kZS5qczESMBAGA1UE
4+
AwwJbG9jYWxob3N0MSUwIwYJKoZIhvcNAQkBFhZibG9ja2VkLWNhQGV4YW1wbGUu
5+
b3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2L/gFFkkJZu3r/S7
6+
o3UkAQdm2NAckiQuyVraEgipHOJ0jBki9q2RBgXYTYgDGMwTl/FWtk8JLb2XIye3
7+
5yCb/b064t0cR/nBtm5e1dHTVWsBjRJ3li6YW+lQM/GcHXk0orAKWfH+inrh4+CV
8+
JvCAupCkf3iKI6yunvbWfhoAa7E7ADU/i7rh1PevLh9yU/BQiWrnUTJCo0n/UK0d
9+
eoaB1te4QBQ3LWIFvQQz0hVICJ4No/CXC5UbqTV7xyoaRcKB20vb1cuhfjut3nyz
10+
0L2Ejm7174E0ta0sisli1sapCAXTkFluT7If2nJ6tpxARfJnJXVwnSJUulYHK7s8
11+
2+O6KwIDAQABoCUwIwYJKoZIhvcNAQkHMRYMFEEgY2hhbGxlbmdlIHBhc3N3b3Jk
12+
MA0GCSqGSIb3DQEBCwUAA4IBAQBEdD8hTSajIPZBRkE6me4vxHiGHsRZGGohdE5k
13+
UEzTU+TVH0V6c1E48Lh0nhLhzghvxdU9aBghoySDYfYWQTR4fN+l245yGWZCuRSp
14+
0fSlehzN+batpgtRqNuI/OUzV0iyLmHpTmjKBcYCCAPb33LsYEIUYOtECU7OMVVS
15+
Tz/AOsy+35TFqCV8OB8573en448Wcfiwh2f3IyG4zWAXaWyvGqxyCpbnGxDa8cNR
16+
/QPFLtqQMNUBDTxBSp2A6To8LM9YAJP0HEOaQnCgZOPH0h7bMY9NnLz9GT208Veh
17+
erTeSPFs2vazs34u78KwsFO9qVQQj9io3H1x4np14PhfYKQs
18+
-----END CERTIFICATE REQUEST-----

0 commit comments

Comments
 (0)