Skip to content

Commit 80371ab

Browse files
AbdulboisAbdulbois
committed
#535 Make the revocation of child certificates optional
- Cover with extra tests - Add shortcut for `revoke-child` flag3 Signed-off-by: Abdulbois <abdulbois.tursunov@dsr-corporation.com> Signed-off-by: Abdulbois <abdulbois123@gmail.com>
1 parent f8e458d commit 80371ab

File tree

6 files changed

+305
-4
lines changed

6 files changed

+305
-4
lines changed

‎integration_tests/cli/pki-revocation-with-revoking-child.sh

+246
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,246 @@
1+
set -euo pipefail
2+
source integration_tests/cli/common.sh
3+
4+
root_cert_1_path="integration_tests/constants/root_with_same_subject_and_skid_1"
5+
root_cert_1_serial_number="1"
6+
root_cert_2_path="integration_tests/constants/root_with_same_subject_and_skid_2"
7+
root_cert_2_serial_number="2"
8+
root_cert_vid=65521
9+
intermediate_cert_1_path="integration_tests/constants/intermediate_with_same_subject_and_skid_1"
10+
intermediate_cert_1_serial_number="3"
11+
intermediate_cert_2_path="integration_tests/constants/intermediate_with_same_subject_and_skid_2"
12+
intermediate_cert_2_serial_number="4"
13+
root_cert_subject="MIGCMQswCQYDVQQGEwJVUzERMA8GA1UECAwITmV3IFlvcmsxETAPBgNVBAcMCE5ldyBZb3JrMRgwFgYDVQQKDA9FeGFtcGxlIENvbXBhbnkxGTAXBgNVBAsMEFRlc3RpbmcgRGl2aXNpb24xGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbQ=="
14+
root_cert_subject_key_id="33:5E:0C:07:44:F8:B5:9C:CD:55:01:9B:6D:71:23:83:6F:D0:D4:BE"
15+
intermediate_cert_subject="MEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQ="
16+
intermediate_cert_subject_key_id="2E:13:3B:44:52:2C:30:E9:EC:FB:45:FA:5D:E5:04:0A:C1:C6:E6:B9"
17+
leaf_cert_subject="MEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQ="
18+
leaf_cert_subject_key_id="12:16:55:8E:5E:2A:DF:04:D7:E6:FE:D1:53:69:61:98:EF:17:2F:03"
19+
leaf_cert_path="integration_tests/constants/leaf_with_same_subject_and_skid"
20+
leaf_cert_serial_number="5"
21+
22+
trustee_account="jack"
23+
second_trustee_account="alice"
24+
25+
test_divider
26+
27+
echo "REVOKE CERTIFICATES BY SPECIFYING SERIAL NUMBER"
28+
29+
echo "Propose and approve root certificate 1"
30+
result=$(echo "$passphrase" | dcld tx pki propose-add-x509-root-cert --certificate="$root_cert_1_path" --vid "$root_cert_vid" --from $trustee_account --yes)
31+
check_response "$result" "\"code\": 0"
32+
result=$(echo "$passphrase" | dcld tx pki approve-add-x509-root-cert --subject="$root_cert_subject" --subject-key-id="$root_cert_subject_key_id" --from $second_trustee_account --yes)
33+
check_response "$result" "\"code\": 0"
34+
35+
echo "Propose and approve root certificate 2"
36+
result=$(echo "$passphrase" | dcld tx pki propose-add-x509-root-cert --certificate="$root_cert_2_path" --vid "$root_cert_vid" --from $trustee_account --yes)
37+
check_response "$result" "\"code\": 0"
38+
result=$(echo "$passphrase" | dcld tx pki approve-add-x509-root-cert --subject="$root_cert_subject" --subject-key-id="$root_cert_subject_key_id" --from $second_trustee_account --yes)
39+
check_response "$result" "\"code\": 0"
40+
41+
echo "Add an intermediate certificate with serialNumber 3"
42+
result=$(echo "$passphrase" | dcld tx pki add-x509-cert --certificate="$intermediate_cert_1_path" --from $trustee_account --yes)
43+
check_response "$result" "\"code\": 0"
44+
45+
echo "Add an intermediate certificate with serialNumber 4"
46+
result=$(echo "$passphrase" | dcld tx pki add-x509-cert --certificate="$intermediate_cert_2_path" --from $trustee_account --yes)
47+
check_response "$result" "\"code\": 0"
48+
49+
echo "Add a leaf certificate with serialNumber 5"
50+
result=$(echo "$passphrase" | dcld tx pki add-x509-cert --certificate="$leaf_cert_path" --from $trustee_account --yes)
51+
check_response "$result" "\"code\": 0"
52+
53+
echo "Request all approved root certificates."
54+
result=$(dcld query pki all-x509-certs)
55+
echo $result | jq
56+
check_response "$result" "\"subject\": \"$root_cert_subject\""
57+
check_response "$result" "\"subject\": \"$intermediate_cert_subject\""
58+
check_response "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
59+
check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
60+
check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
61+
62+
echo "Revoke intermediate certificates only(leaf certificates should not be removed)"
63+
result=$(echo "$passphrase" | dcld tx pki revoke-x509-cert --subject="$intermediate_cert_subject" --subject-key-id="$intermediate_cert_subject_key_id" --from=$trustee_account --yes)
64+
check_response "$result" "\"code\": 0"
65+
66+
echo "Request all revoked certificates should contain two intermediate certificates"
67+
result=$(dcld query pki all-revoked-x509-certs)
68+
echo $result | jq
69+
check_response "$result" "\"subject\": \"$intermediate_cert_subject\""
70+
check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
71+
check_response "$result" "\"serialNumber\": \"$intermediate_cert_1_serial_number\""
72+
check_response "$result" "\"serialNumber\": \"$intermediate_cert_2_serial_number\""
73+
74+
echo "Request all approved intermediate certificates should be emtpy"
75+
result=$(dcld query pki x509-cert --subject="$intermediate_cert_subject" --subject-key-id="$intermediate_cert_subject_key_id")
76+
echo $result | jq
77+
response_does_not_contain "$result" "\"subject\": \"$intermediate_cert_subject\""
78+
response_does_not_contain "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
79+
response_does_not_contain "$result" "\"serialNumber\": \"$intermediate_cert_2_serial_number\""
80+
response_does_not_contain "$result" "\"serialNumber\": \"$intermediate_cert_1_serial_number\""
81+
82+
echo "Request all approved leaf certificates should contain only one certificate with serialNumber 5"
83+
result=$(dcld query pki x509-cert --subject="$leaf_cert_subject" --subject-key-id="$leaf_cert_subject_key_id")
84+
echo $result | jq
85+
check_response "$result" "\"subject\": \"$leaf_cert_subject\""
86+
check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
87+
check_response "$result" "\"serialNumber\": \"$leaf_cert_serial_number\""
88+
89+
echo "Remove revoked intermediate certificates to re-add them again"
90+
result=$(echo "$passphrase" | dcld tx pki remove-x509-cert --subject="$intermediate_cert_subject" --subject-key-id="$intermediate_cert_subject_key_id" --from=$trustee_account --yes)
91+
check_response "$result" "\"code\": 0"
92+
93+
echo "Add an intermediate certificate with serialNumber 3"
94+
result=$(echo "$passphrase" | dcld tx pki add-x509-cert --certificate="$intermediate_cert_1_path" --from $trustee_account --yes)
95+
check_response "$result" "\"code\": 0"
96+
97+
echo "Add an intermediate certificate with serialNumber 4"
98+
result=$(echo "$passphrase" | dcld tx pki add-x509-cert --certificate="$intermediate_cert_2_path" --from $trustee_account --yes)
99+
check_response "$result" "\"code\": 0"
100+
101+
echo "Request all approved root certificates."
102+
result=$(dcld query pki all-x509-certs)
103+
echo $result | jq
104+
check_response "$result" "\"subject\": \"$root_cert_subject\""
105+
check_response "$result" "\"subject\": \"$intermediate_cert_subject\""
106+
check_response "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
107+
check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
108+
check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
109+
110+
echo "Revoke intermediate certificates and its child certificates too"
111+
result=$(echo "$passphrase" | dcld tx pki revoke-x509-cert --subject="$intermediate_cert_subject" --subject-key-id="$intermediate_cert_subject_key_id" --revoke-child=true --from=$trustee_account --yes)
112+
check_response "$result" "\"code\": 0"
113+
114+
echo "Request all revoked certificates should contain two intermediate and one leaf certificates"
115+
result=$(dcld query pki all-revoked-x509-certs)
116+
echo $result | jq
117+
check_response "$result" "\"subject\": \"$intermediate_cert_subject\""
118+
check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
119+
check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id"
120+
check_response "$result" "\"serialNumber\": \"$intermediate_cert_1_serial_number\""
121+
check_response "$result" "\"serialNumber\": \"$intermediate_cert_2_serial_number\""
122+
check_response "$result" "\"serialNumber\": \"$leaf_cert_serial_number\""
123+
124+
echo "Request all approved certificates should contain only two root certificates"
125+
result=$(dcld query pki all-x509-certs)
126+
echo $result | jq
127+
check_response "$result" "\"subject\": \"$root_cert_subject\""
128+
check_response "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
129+
check_response "$result" "\"serialNumber\": \"$root_cert_1_serial_number\""
130+
check_response "$result" "\"serialNumber\": \"$root_cert_2_serial_number\""
131+
response_does_not_contain "$result" "\"subject\": \"$intermediate_cert_subject\""
132+
response_does_not_contain "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id"
133+
response_does_not_contain "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id"
134+
response_does_not_contain "$result" "\"serialNumber\": \"$intermediate_cert_1_serial_number\""
135+
response_does_not_contain "$result" "\"serialNumber\": \"$intermediate_cert_2_serial_number\""
136+
response_does_not_contain "$result" "\"serialNumber\": \"$leaf_cert_serial_number"
137+
138+
echo "Remove intermediate and leaf certificates to re-add them again"
139+
result=$(echo "$passphrase" | dcld tx pki remove-x509-cert --subject="$intermediate_cert_subject" --subject-key-id="$intermediate_cert_subject_key_id" --from=$trustee_account --yes)
140+
check_response "$result" "\"code\": 0"
141+
result=$(echo "$passphrase" | dcld tx pki remove-x509-cert --subject="$leaf_cert_subject" --subject-key-id="$leaf_cert_subject_key_id" --from=$trustee_account --yes)
142+
check_response "$result" "\"code\": 0"
143+
144+
echo "Add an intermediate certificate with serialNumber 3"
145+
result=$(echo "$passphrase" | dcld tx pki add-x509-cert --certificate="$intermediate_cert_1_path" --from $trustee_account --yes)
146+
check_response "$result" "\"code\": 0"
147+
148+
echo "Add an intermediate certificate with serialNumber 4"
149+
result=$(echo "$passphrase" | dcld tx pki add-x509-cert --certificate="$intermediate_cert_2_path" --from $trustee_account --yes)
150+
check_response "$result" "\"code\": 0"
151+
152+
echo "Add a leaf certificate with serialNumber 5"
153+
result=$(echo "$passphrase" | dcld tx pki add-x509-cert --certificate="$leaf_cert_path" --from $trustee_account --yes)
154+
check_response "$result" "\"code\": 0"
155+
156+
echo "$trustee_account (Trustee) proposes to revoke Root certificates only(child certificates should not be removed)"
157+
result=$(echo "$passphrase" | dcld tx pki propose-revoke-x509-root-cert --subject="$root_cert_subject" --subject-key-id="$root_cert_subject_key_id" --from $trustee_account --yes)
158+
check_response "$result" "\"code\": 0"
159+
160+
echo "$second_trustee_account (Second Trustee) approves to revoke Root certificates only(child certificates should not be removed)"
161+
result=$(echo "$passphrase" | dcld tx pki approve-revoke-x509-root-cert --subject="$root_cert_subject" --subject-key-id="$root_cert_subject_key_id" --from $second_trustee_account --yes)
162+
check_response "$result" "\"code\": 0"
163+
164+
echo "Request all revoked certificates should contain two root certificates"
165+
result=$(dcld query pki all-revoked-x509-certs)
166+
echo $result | jq
167+
check_response "$result" "\"subject\": \"$root_cert_subject\""
168+
check_response "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
169+
check_response "$result" "\"serialNumber\": \"$root_cert_1_serial_number\""
170+
check_response "$result" "\"serialNumber\": \"$root_cert_2_serial_number\""
171+
response_does_not_contain "$result" "\"serialNumber\": \"$intermediate_cert_1_serial_number"
172+
response_does_not_contain "$result" "\"serialNumber\": \"$intermediate_cert_2_serial_number"
173+
response_does_not_contain "$result" "\"serialNumber\": \"$leaf_cert_serial_number"
174+
175+
echo "Request all approved certificates should contain two intermediate and one leaf certificates"
176+
result=$(dcld query pki all-x509-certs)
177+
echo $result | jq
178+
check_response "$result" "\"subject\": \"$intermediate_cert_subject\""
179+
check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id"
180+
check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id"
181+
check_response "$result" "\"serialNumber\": \"$intermediate_cert_1_serial_number\""
182+
check_response "$result" "\"serialNumber\": \"$intermediate_cert_2_serial_number\""
183+
check_response "$result" "\"serialNumber\": \"$leaf_cert_serial_number"
184+
response_does_not_contain "$result" "\"serialNumber\": \"$root_cert_1_serial_number\""
185+
response_does_not_contain "$result" "\"serialNumber\": \"$root_cert_2_serial_number\""
186+
187+
echo "Remove revoked root certificates to re-add them again"
188+
result=$(echo "$passphrase" | dcld tx pki remove-x509-cert --subject="$root_cert_subject" --subject-key-id="$root_cert_subject_key_id" --from=$trustee_account --yes)
189+
check_response "$result" "\"code\": 0"
190+
191+
echo "Propose and approve root certificate 1"
192+
result=$(echo "$passphrase" | dcld tx pki propose-add-x509-root-cert --certificate="$root_cert_1_path" --vid "$root_cert_vid" --from $trustee_account --yes)
193+
check_response "$result" "\"code\": 0"
194+
result=$(echo "$passphrase" | dcld tx pki approve-add-x509-root-cert --subject="$root_cert_subject" --subject-key-id="$root_cert_subject_key_id" --from $second_trustee_account --yes)
195+
check_response "$result" "\"code\": 0"
196+
197+
echo "Propose and approve root certificate 2"
198+
result=$(echo "$passphrase" | dcld tx pki propose-add-x509-root-cert --certificate="$root_cert_2_path" --vid "$root_cert_vid" --from $trustee_account --yes)
199+
check_response "$result" "\"code\": 0"
200+
result=$(echo "$passphrase" | dcld tx pki approve-add-x509-root-cert --subject="$root_cert_subject" --subject-key-id="$root_cert_subject_key_id" --from $second_trustee_account --yes)
201+
check_response "$result" "\"code\": 0"
202+
203+
echo "Request all approved root certificates."
204+
result=$(dcld query pki all-x509-certs)
205+
echo $result | jq
206+
check_response "$result" "\"subject\": \"$root_cert_subject\""
207+
check_response "$result" "\"subject\": \"$intermediate_cert_subject\""
208+
check_response "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
209+
check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
210+
check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
211+
212+
echo "$trustee_account (Trustee) proposes to revoke Root certificates and its child certificates too"
213+
result=$(echo "$passphrase" | dcld tx pki propose-revoke-x509-root-cert --subject="$root_cert_subject" --subject-key-id="$root_cert_subject_key_id" --revoke-child=true --from $trustee_account --yes)
214+
check_response "$result" "\"code\": 0"
215+
216+
echo "$second_trustee_account (Second Trustee) approves to revoke Root certificate"
217+
result=$(echo "$passphrase" | dcld tx pki approve-revoke-x509-root-cert --subject="$root_cert_subject" --subject-key-id="$root_cert_subject_key_id" --from $second_trustee_account --yes)
218+
check_response "$result" "\"code\": 0"
219+
220+
echo "Request all revoked certificates should contain two root, one intermediate and one leaf certificates"
221+
result=$(dcld query pki all-revoked-x509-certs)
222+
echo $result | jq
223+
check_response "$result" "\"subject\": \"$root_cert_subject\""
224+
check_response "$result" "\"subject\": \"$intermediate_cert_subject\""
225+
check_response "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
226+
check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
227+
check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id"
228+
check_response "$result" "\"serialNumber\": \"$root_cert_1_serial_number\""
229+
check_response "$result" "\"serialNumber\": \"$intermediate_cert_1_serial_number\""
230+
check_response "$result" "\"serialNumber\": \"$root_cert_2_serial_number\""
231+
check_response "$result" "\"serialNumber\": \"$intermediate_cert_2_serial_number\""
232+
check_response "$result" "\"serialNumber\": \"$leaf_cert_serial_number"
233+
234+
echo "Request all approved root certificates should be empty"
235+
result=$(dcld query pki all-x509-root-certs)
236+
echo $result | jq
237+
response_does_not_contain "$result" "\"subject\": \"$root_cert_subject\""
238+
response_does_not_contain "$result" "\"subject\": \"$intermediate_cert_subject\""
239+
response_does_not_contain "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
240+
response_does_not_contain "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
241+
response_does_not_contain "$result" "\"serialNumber\": \"$root_cert_1_serial_number\""
242+
response_does_not_contain "$result" "\"serialNumber\": \"$intermediate_cert_1_serial_number\""
243+
response_does_not_contain "$result" "\"serialNumber\": \"$root_cert_2_serial_number\""
244+
response_does_not_contain "$result" "\"serialNumber\": \"$intermediate_cert_2_serial_number\""
245+
246+
test_divider

0 commit comments

Comments
 (0)