From 0289980a471fa48c89505b10a4086a2b9e5e7b0a Mon Sep 17 00:00:00 2001 From: Prarthona Paul Date: Thu, 9 May 2024 13:17:23 -0400 Subject: [PATCH] ELY-2756 Add tests to the elytron test suite to test to test OCSP with revoked and unknown certificates --- .../security/ssl/SSLAuthenticationTest.java | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/tests/base/src/test/java/org/wildfly/security/ssl/SSLAuthenticationTest.java b/tests/base/src/test/java/org/wildfly/security/ssl/SSLAuthenticationTest.java index 8666bf529f..95a4358f38 100644 --- a/tests/base/src/test/java/org/wildfly/security/ssl/SSLAuthenticationTest.java +++ b/tests/base/src/test/java/org/wildfly/security/ssl/SSLAuthenticationTest.java @@ -729,6 +729,40 @@ public void testOcspGood() throws Throwable { "OU=Elytron,O=Elytron,C=UK,ST=Elytron,CN=ocspCheckedGood", false); } + @Test + public void testOcspRevoked() throws Throwable { + SSLContext serverContext = new SSLContextBuilder() + .setSecurityDomain(getKeyStoreBackedSecurityDomain("/jks/beetles.keystore")) + .setKeyManager(getKeyManager("/jks/scarab.keystore")) + .setTrustManager(X509RevocationTrustManager.builder() + .setTrustManagerFactory(getTrustManagerFactory()) + .setTrustStore(createKeyStore("/jks/ca.truststore")) + .setOcspResponderCert(ocspResponderCertificate) + .build()) + .setNeedClientAuth(true) + .build().create(); + + performConnectionTest(serverContext, "protocol://test-two-way-ocsp-revoked.org", false, "OU=Elytron,O=Elytron,C=UK,ST=Elytron,CN=Scarab", + "OU=Elytron,O=Elytron,C=UK,ST=Elytron,CN=ocspCheckedRevoked", false); + } + + @Test + public void testOcspUnknown() throws Throwable { + SSLContext serverContext = new SSLContextBuilder() + .setSecurityDomain(getKeyStoreBackedSecurityDomain("/jks/beetles.keystore")) + .setKeyManager(getKeyManager("/jks/scarab.keystore")) + .setTrustManager(X509RevocationTrustManager.builder() + .setTrustManagerFactory(getTrustManagerFactory()) + .setTrustStore(createKeyStore("/jks/ca.truststore")) + .setOcspResponderCert(ocspResponderCertificate) + .build()) + .setNeedClientAuth(true) + .build().create(); + + performConnectionTest(serverContext, "protocol://test-two-way-ocsp-unknown.org", false, "OU=Elytron,O=Elytron,C=UK,ST=Elytron,CN=Scarab", + "OU=Elytron,O=Elytron,C=UK,ST=Elytron,CN=ocspCheckedUnknown", false); + } + @Test public void testOcspMaxCertPathNeg1() throws Throwable { ocspMaxCertPathCommon(-1, false);