The Tor Browser: security/nss/tests/chains/scenarios/trustanchors.cfg@b8a032363ba2

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

     1 # This Source Code Form is subject to the terms of the Mozilla Public

     2 # License, v. 2.0. If a copy of the MPL was not distributed with this

     3 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

     5 scenario TrustAnchors

     7 entity RootCA

     8   type Root

    10 entity CA1

    11   type Intermediate

    12   issuer RootCA

    14 entity CA2

    15   type Intermediate

    16   issuer CA1

    18 entity EE1

    19   type EE

    20   issuer CA2

    22 entity OtherRoot

    23   type Root

    25 entity OtherIntermediate

    26   type Intermediate

    27   issuer OtherRoot

    29 entity EE2

    30   type EE

    31   issuer OtherIntermediate

    33 # Scenarios where trust only comes from the DB

    34 db DBOnly

    36 import RootCA::CT,C,C

    37 import CA1:RootCA:

    39 # Simple chaining - no trust anchors

    40 verify EE1:CA2

    41   cert CA2:CA1

    42   result pass

    44 # Simple trust anchors - ignore the Cert DB

    45 verify EE1:CA2

    46   trust CA2:CA1

    47   result pass

    49 # Redundant trust - trust anchor and DB

    50 verify EE1:CA2

    51   cert CA2:CA1

    52   trust RootCA

    53   result pass

    56 # Scenarios where trust only comes from trust anchors

    57 db TrustOnly

    59 # Simple checking - direct trust anchor

    60 verify EE1:CA2

    61   cert CA2:CA1

    62   cert CA1:RootCA:

    63   trust RootCA:

    64   result pass

    66 # Partial chain (not self-signed), with a trust anchor

    67 verify EE1:CA2

    68   trust CA2:CA1

    69   result pass

    72 # Scenarios where trust comes from both trust anchors and the DB

    73 db TrustAndDB

    75 import RootCA::CT,C,C

    76 import CA1:RootCA:

    78 # Check that trust in the DB works

    79 verify EE1:CA2

    80   cert CA2:CA1

    81   result pass

    83 # Check that trust anchors work

    84 verify EE2:OtherIntermediate

    85   cert OtherIntermediate:OtherRoot

    86   trust OtherRoot:

    87   result pass

    89 # Check that specifying a trust anchor still allows searching the cert DB

    90 verify EE1:CA2

    91   trust_and_db

    92   cert CA2:CA1

    93   trust OtherIntermediate:OtherRoot

    94   trust OtherRoot:

    95   result pass

    97 # Scenarios where the trust DB has explicitly distrusted one or more certs,

    98 # even when the trust anchors indicate trust

    99 db ExplicitDistrust

   101 import RootCA::CT,C,C

   102 import CA1:RootCA:p,p,p

   103 import OtherRoot::p,p,p

   105 # Verify that a distrusted intermediate, but trusted root, is rejected.

   106 verify EE1:CA2

   107   cert CA2:CA1

   108   trust CA1:RootCA

   109   result fail

   111 # Verify that a trusted intermediate, but distrusted root, is accepted.

   112 verify EE2:OtherIntermediate

   113   trust OtherIntermediate:OtherRoot

   114   result pass

The Tor Browser / file revision