diff options
| -rw-r--r-- | net/base/ev_root_ca_metadata.cc | 8 | ||||
| -rw-r--r-- | net/base/x509_certificate_unittest.cc | 37 | ||||
| -rw-r--r-- | net/data/ssl/certificates/2029_globalsign_com_cert.pem | 31 | ||||
| -rw-r--r-- | net/data/ssl/certificates/globalsign_ev_sha256_ca_cert.pem | 25 |
4 files changed, 100 insertions, 1 deletions
diff --git a/net/base/ev_root_ca_metadata.cc b/net/base/ev_root_ca_metadata.cc index 113babd..64e66ac 100644 --- a/net/base/ev_root_ca_metadata.cc +++ b/net/base/ev_root_ca_metadata.cc @@ -122,7 +122,7 @@ static const EVMetadata ev_root_ca_metadata[] = { 0xe2, 0xe2, 0x10, 0x0d, 0xd6, 0x02, 0x90, 0x37, 0xf0, 0x96 } }, "1.3.6.1.4.1.14370.1.6" }, - // GlobalSign + // GlobalSign Root CA - R2 // https://www.globalsign.com/ { { { 0x75, 0xe0, 0xab, 0xb6, 0x13, 0x85, 0x12, 0x27, 0x1c, 0x04, 0xf8, 0x5f, 0xdd, 0xde, 0x38, 0xe4, 0xb7, 0x24, 0x2e, 0xfe } }, @@ -133,6 +133,12 @@ static const EVMetadata ev_root_ca_metadata[] = { 0x9a, 0x81, 0xf2, 0x15, 0x01, 0x52, 0xa4, 0x1d, 0x82, 0x9c } }, "1.3.6.1.4.1.4146.1.1" }, + // GlobalSign Root CA - R3 + // https://2029.globalsign.com/ + { { { 0xd6, 0x9b, 0x56, 0x11, 0x48, 0xf0, 0x1c, 0x77, 0xc5, 0x45, + 0x78, 0xc1, 0x09, 0x26, 0xdf, 0x5b, 0x85, 0x69, 0x76, 0xad } }, + "1.3.6.1.4.1.4146.1.1" + }, // Go Daddy Class 2 Certification Authority // https://www.godaddy.com/ { { { 0x27, 0x96, 0xba, 0xe6, 0x3f, 0x18, 0x01, 0xe2, 0x77, 0x26, diff --git a/net/base/x509_certificate_unittest.cc b/net/base/x509_certificate_unittest.cc index 89ea5825..d2fe3e3 100644 --- a/net/base/x509_certificate_unittest.cc +++ b/net/base/x509_certificate_unittest.cc @@ -486,6 +486,43 @@ TEST(X509CertificateTest, IntermediateCARequireExplicitPolicy) { root_certs->Clear(); } +// Test for bug 58437. +// This certificate will expire on 2011-12-21. The test will still +// pass if error == ERR_CERT_DATE_INVALID. +// This test is DISABLED because it appears that we cannot do +// certificate revocation checking when running all of the net unit tests. +// This test passes when run individually, but when run with all of the net +// unit tests, the call to PKIXVerifyCert returns the NSS error -8180, which is +// SEC_ERROR_REVOKED_CERTIFICATE. This indicates a lack of revocation +// status, i.e. that the revocation check is failing for some reason. +TEST(X509CertificateTest, DISABLED_GlobalSignR3EVTest) { + FilePath certs_dir = GetTestCertsDirectory(); + + scoped_refptr<X509Certificate> server_cert = + ImportCertFromFile(certs_dir, "2029_globalsign_com_cert.pem"); + ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert); + + scoped_refptr<X509Certificate> intermediate_cert = + ImportCertFromFile(certs_dir, "globalsign_ev_sha256_ca_cert.pem"); + ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate_cert); + + X509Certificate::OSCertHandles intermediates; + intermediates.push_back(intermediate_cert->os_cert_handle()); + scoped_refptr<X509Certificate> cert_chain = + X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), + X509Certificate::SOURCE_FROM_NETWORK, + intermediates); + + CertVerifyResult verify_result; + int flags = X509Certificate::VERIFY_REV_CHECKING_ENABLED | + X509Certificate::VERIFY_EV_CERT; + int error = cert_chain->Verify("2029.globalsign.com", flags, &verify_result); + if (error == OK) + EXPECT_NE(0, verify_result.cert_status & CERT_STATUS_IS_EV); + else + EXPECT_EQ(ERR_CERT_DATE_INVALID, error); +} + TEST(X509CertificateTest, TestKnownRoot) { FilePath certs_dir = GetTestCertsDirectory(); scoped_refptr<X509Certificate> cert = diff --git a/net/data/ssl/certificates/2029_globalsign_com_cert.pem b/net/data/ssl/certificates/2029_globalsign_com_cert.pem new file mode 100644 index 0000000..cd0d988 --- /dev/null +++ b/net/data/ssl/certificates/2029_globalsign_com_cert.pem @@ -0,0 +1,31 @@ +-----BEGIN CERTIFICATE----- +MIIFTjCCBDagAwIBAgILAQAAAAABJbCbWRgwDQYJKoZIhvcNAQELBQAwcDEmMCQG +A1UECxMdRXh0ZW5kZWQgVmFsaWRhdGlvbiBTSEEyNTYgQ0ExEzARBgNVBAoTCkds +b2JhbFNpZ24xMTAvBgNVBAMTKEdsb2JhbFNpZ24gRXh0ZW5kZWQgVmFsaWRhdGlv +biBTSEEyNTYgQ0EwHhcNMDkxMjIxMDkwNTA4WhcNMTExMjIxMDkwNTA4WjCB4TEb +MBkGA1UEDxMSVjEuMCwgQ2xhdXNlIDUuKGIpMRcwFQYDVQQFEw4wMTEwLTAxLTA0 +MDE4MTETMBEGCysGAQQBgjc8AgEDEwJKUDELMAkGA1UEBhMCSlAxDjAMBgNVBAgT +BVRPS1lPMRAwDgYDVQQHEwdTaGlidXlhMRkwFwYDVQQJExAyMC0xIHNha3VyYWdh +b2thMRIwEAYDVQQLEwlUZWNobmljYWwxGDAWBgNVBAoTD0dsb2JhbFNpZ24gSy5L +LjEcMBoGA1UEAxMTMjAyOS5nbG9iYWxzaWduLmNvbTCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBAK1O+qRY8VTYBzAU+RkWEli4/0uTMtYJmR138O7iOrog +3rRPfAZouTz9zZf8aKCp2S1VAHufuxzn1GhQRdlI6fnyDEjJoUpDo4mJbJFUghLt +bwnFIsScSHdqaTKx0N99xRR9SJbEshfeIszBWTdLsUdBDzj64YiBg9qJMfPynPGC +dbbf4crM/28jXaiaB/AJ8lv1AAstW8bps+y6ZHrZqG9i3llfetpe+4Dg9XqUQAD4 +0OBNIn8fD2CXk916wiN2JfnZjSOStTKSsy5zXlx5mgMFkSMtOkqbJDgbjcYmajA2 +YDnzlSbz9oYL4jv/NZ+A2aJzoqbP7tef88P/cN+/XXECAwEAAaOCAXUwggFxMB0G +A1UdDgQWBBRZvNlp97Blu8g0xdLC7xd4pkceizAfBgNVHSMEGDAWgBSK/BQbPaNZ +Z6U74XOSpmKRf+R4MDBUBggrBgEFBQcBAQRIMEYwRAYIKwYBBQUHMAKGOGh0dHA6 +Ly9zZWN1cmUuZ2xvYmFsc2lnbi5uZXQvY2FjZXJ0L1NIQTI1NmV4dGVuZHZhbDEu +Y3J0MD8GA1UdHwQ4MDYwNKAyoDCGLmh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5uZXQv +U0hBMjU2RXh0ZW5kVmFsMS5jcmwwCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBPAw +HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEsGA1UdIAREMEIwQAYJKwYB +BAGgMgEBMDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2xvYmFsc2lnbi5uZXQv +cmVwb3NpdG9yeS8wEQYJYIZIAYb4QgEBBAQDAgbAMA0GCSqGSIb3DQEBCwUAA4IB +AQBCfnYnxZkYxp3amwmrrCAwac5SYVK4bDwxKtAHa9NbOGV6jAXFNIknttAuwy9I +w7h4E5HHnZeDVZpWQ1ncmMqkMPfYruThLGx8GOMThigkMHOZLPx+WmB4alDKj9Ra +SOISmiIHMfw7RKPZuL3dttzr477DVukILeUjfKeQ9dlQwAyeMNH840jrOmyVl54R +nfFnOL7O46NqJBrC0cNp5bdyzVJ77qZ29r7e3+uJ61OeCzovImyPrgGDy96rhxaB +ZjdXGKH2nlFQ3SpsH5QMVr8kn8a1etoIGexJ8L7FdSu3ywvyjaIPOANI/Y0gTlax +vIkF1Dc5EejvaEMyVwrVTbzJ +-----END CERTIFICATE----- diff --git a/net/data/ssl/certificates/globalsign_ev_sha256_ca_cert.pem b/net/data/ssl/certificates/globalsign_ev_sha256_ca_cert.pem new file mode 100644 index 0000000..bfad0aa --- /dev/null +++ b/net/data/ssl/certificates/globalsign_ev_sha256_ca_cert.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEPDCCAySgAwIBAgILBAAAAAABJQcQRNUwDQYJKoZIhvcNAQELBQAwTDEgMB4G +A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNp +Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkxMTE4MTAwMDAwWhcNMTkwMzE4 +MTAwMDAwWjBwMSYwJAYDVQQLEx1FeHRlbmRlZCBWYWxpZGF0aW9uIFNIQTI1NiBD +QTETMBEGA1UEChMKR2xvYmFsU2lnbjExMC8GA1UEAxMoR2xvYmFsU2lnbiBFeHRl +bmRlZCBWYWxpZGF0aW9uIFNIQTI1NiBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP +ADCCAQoCggEBALBif8TfrtmndK/ILyYLrRoXAmHWc7OhUAhQOi9KnUuv0F7PPbG3 +IoqTWVHc/5BXLTrU8v7FdKBKEyevSd8QqPltoW/wzqhwFShy8PPpWT5UrcxVGHNP +BE99xpAPWq6JOAKSQxp59F0rhXCKUsFO+Gl+K/zR1tpYR9Oy9GKyowpIDvbxevkS +n8b/ZAbtdi4YL3M6qy680hD7XFEgMiOcjgHvIHBj21Ga01L6yYv0klQHDRVFhhca +wcSsQ/ckrODI508EwvESGrk18bmkypnNxDoZJJoqtQUeS8UBwUDsZ9ES63LitzBF +uTG/nz5A/WWOzN18Adq6piOm8QGcKfwatMcCAwEAAaOB+jCB9zAOBgNVHQ8BAf8E +BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUivwUGz2jWWelO+Fz +kqZikX/keDAwRgYDVR0gBD8wPTA7BgRVHSAAMDMwMQYIKwYBBQUHAgEWJWh0dHA6 +Ly93d3cuZ2xvYmFsc2lnbi5uZXQvcmVwb3NpdG9yeS8wNgYDVR0fBC8wLTAroCmg +J4YlaHR0cDovL2NybC5nbG9iYWxzaWduLm5ldC9yb290LXIzLmNybDARBglghkgB +hvhCAQEEBAMCAgQwHwYDVR0jBBgwFoAUj/BLf6guRSSuTVD6Y5qL3uLdG7wwDQYJ +KoZIhvcNAQELBQADggEBAF2HVz/fP/IUd8jFBven7nszfYdjJJbzdpehLJqoLccQ +EEHtGTy9xnqChzCkSgIoe705slJDt4wdXibIm5uV1CE0YidAEqLPeg4w1sU6y9eV +L0E+IGJR7UF3FH0tBDbnyiTGEjviDxqi1VlSSbXvIoyhQHlsNvSeKdvTudDNmaSF +lleJLy8SEXyJwieoACCibX27ZUk1vU4Hhvm2nY7AbP5ry6lzNuHozc+mMvuiwM/3 +Mc61UR+LBN8YxgpSHB1m1THyVG/Nz3b82rMe1XvSm1sYsULysrRLzSVc+89Up74A +CIFMY+ZrQU0Yq+VrBBMPRtJ1Jc1BxkjaXf0O0c9CLFo= +-----END CERTIFICATE----- |