|
48256
|
1 |
/*
|
|
|
2 |
* Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
|
|
|
3 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
|
4 |
*
|
|
|
5 |
* This code is free software; you can redistribute it and/or modify it
|
|
|
6 |
* under the terms of the GNU General Public License version 2 only, as
|
|
|
7 |
* published by the Free Software Foundation.
|
|
|
8 |
*
|
|
|
9 |
* This code is distributed in the hope that it will be useful, but WITHOUT
|
|
|
10 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
|
11 |
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
|
12 |
* version 2 for more details (a copy is included in the LICENSE file that
|
|
|
13 |
* accompanied this code).
|
|
|
14 |
*
|
|
|
15 |
* You should have received a copy of the GNU General Public License version
|
|
|
16 |
* 2 along with this work; if not, write to the Free Software Foundation,
|
|
|
17 |
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
|
18 |
*
|
|
|
19 |
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
|
|
20 |
* or visit www.oracle.com if you need additional information or have any
|
|
|
21 |
* questions.
|
|
|
22 |
*/
|
|
|
23 |
|
|
|
24 |
/*
|
|
|
25 |
* @test
|
|
|
26 |
* @bug 8189131
|
|
|
27 |
* @summary Interoperability tests with Let's Encrypt CA
|
|
|
28 |
* @build ValidatePathWithParams
|
|
|
29 |
* @run main/othervm -Djava.security.debug=certpath LetsEncryptCA OCSP
|
|
|
30 |
* @run main/othervm -Djava.security.debug=certpath LetsEncryptCA CRL
|
|
|
31 |
*/
|
|
|
32 |
|
|
|
33 |
/*
|
|
|
34 |
* "Lets Encrypt Authority X1" intermediate CA is retired.
|
|
|
35 |
* Test certs should be chained through "Lets Encrypt Authority X3" CA.
|
|
|
36 |
*
|
|
|
37 |
* Obtain TLS test artifacts for Let's Encrypt CA from:
|
|
|
38 |
*
|
|
|
39 |
* Valid TLS Certificates:
|
|
|
40 |
* https://valid-isrgrootx1.letsencrypt.org/
|
|
|
41 |
*
|
|
|
42 |
* Revoked TLS Certificates:
|
|
|
43 |
* https://revoked-isrgrootx1.letsencrypt.org/
|
|
|
44 |
*
|
|
|
45 |
* Test artifacts don't have CRLs listed.
|
|
|
46 |
*/
|
|
|
47 |
public class LetsEncryptCA {
|
|
|
48 |
|
|
|
49 |
// Owner: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US
|
|
|
50 |
// Issuer: CN=ISRG Root X1, O=Internet Security Research Group, C=US
|
|
|
51 |
private static final String INT = "-----BEGIN CERTIFICATE-----\n"
|
|
|
52 |
+ "MIIFjTCCA3WgAwIBAgIRANOxciY0IzLc9AUoUSrsnGowDQYJKoZIhvcNAQELBQAw\n"
|
|
|
53 |
+ "TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh\n"
|
|
|
54 |
+ "cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTYxMDA2MTU0MzU1\n"
|
|
|
55 |
+ "WhcNMjExMDA2MTU0MzU1WjBKMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg\n"
|
|
|
56 |
+ "RW5jcnlwdDEjMCEGA1UEAxMaTGV0J3MgRW5jcnlwdCBBdXRob3JpdHkgWDMwggEi\n"
|
|
|
57 |
+ "MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCc0wzwWuUuR7dyXTeDs2hjMOrX\n"
|
|
|
58 |
+ "NSYZJeG9vjXxcJIvt7hLQQWrqZ41CFjssSrEaIcLo+N15Obzp2JxunmBYB/XkZqf\n"
|
|
|
59 |
+ "89B4Z3HIaQ6Vkc/+5pnpYDxIzH7KTXcSJJ1HG1rrueweNwAcnKx7pwXqzkrrvUHl\n"
|
|
|
60 |
+ "Npi5y/1tPJZo3yMqQpAMhnRnyH+lmrhSYRQTP2XpgofL2/oOVvaGifOFP5eGr7Dc\n"
|
|
|
61 |
+ "Gu9rDZUWfcQroGWymQQ2dYBrrErzG5BJeC+ilk8qICUpBMZ0wNAxzY8xOJUWuqgz\n"
|
|
|
62 |
+ "uEPxsR/DMH+ieTETPS02+OP88jNquTkxxa/EjQ0dZBYzqvqEKbbUC8DYfcOTAgMB\n"
|
|
|
63 |
+ "AAGjggFnMIIBYzAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADBU\n"
|
|
|
64 |
+ "BgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEBATAwMC4GCCsGAQUFBwIB\n"
|
|
|
65 |
+ "FiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMB0GA1UdDgQWBBSo\n"
|
|
|
66 |
+ "SmpjBH3duubRObemRWXv86jsoTAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3Js\n"
|
|
|
67 |
+ "LnJvb3QteDEubGV0c2VuY3J5cHQub3JnMHIGCCsGAQUFBwEBBGYwZDAwBggrBgEF\n"
|
|
|
68 |
+ "BQcwAYYkaHR0cDovL29jc3Aucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcvMDAGCCsG\n"
|
|
|
69 |
+ "AQUFBzAChiRodHRwOi8vY2VydC5yb290LXgxLmxldHNlbmNyeXB0Lm9yZy8wHwYD\n"
|
|
|
70 |
+ "VR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wDQYJKoZIhvcNAQELBQADggIB\n"
|
|
|
71 |
+ "ABnPdSA0LTqmRf/Q1eaM2jLonG4bQdEnqOJQ8nCqxOeTRrToEKtwT++36gTSlBGx\n"
|
|
|
72 |
+ "A/5dut82jJQ2jxN8RI8L9QFXrWi4xXnA2EqA10yjHiR6H9cj6MFiOnb5In1eWsRM\n"
|
|
|
73 |
+ "UM2v3e9tNsCAgBukPHAg1lQh07rvFKm/Bz9BCjaxorALINUfZ9DD64j2igLIxle2\n"
|
|
|
74 |
+ "DPxW8dI/F2loHMjXZjqG8RkqZUdoxtID5+90FgsGIfkMpqgRS05f4zPbCEHqCXl1\n"
|
|
|
75 |
+ "eO5HyELTgcVlLXXQDgAWnRzut1hFJeczY1tjQQno6f6s+nMydLN26WuU4s3UYvOu\n"
|
|
|
76 |
+ "OsUxRlJu7TSRHqDC3lSE5XggVkzdaPkuKGQbGpny+01/47hfXXNB7HntWNZ6N2Vw\n"
|
|
|
77 |
+ "p7G6OfY+YQrZwIaQmhrIqJZuigsrbe3W+gdn5ykE9+Ky0VgVUsfxo52mwFYs1JKY\n"
|
|
|
78 |
+ "2PGDuWx8M6DlS6qQkvHaRUo0FMd8TsSlbF0/v965qGFKhSDeQoMpYnwcmQilRh/0\n"
|
|
|
79 |
+ "ayLThlHLN81gSkJjVrPI0Y8xCVPB4twb1PFUd2fPM3sA1tJ83sZ5v8vgFv2yofKR\n"
|
|
|
80 |
+ "PB0t6JzUA81mSqM3kxl5e+IZwhYAyO0OTg3/fs8HqGTNKd9BqoUwSRBzp06JMg5b\n"
|
|
|
81 |
+ "rUCGwbCUDI0mxadJ3Bz4WxR6fyNpBK2yAinWEsikxqEt\n"
|
|
|
82 |
+ "-----END CERTIFICATE-----";
|
|
|
83 |
|
|
|
84 |
// Owner: CN=valid-isrgrootx1.letsencrypt.org
|
|
|
85 |
// Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US
|
|
|
86 |
// Serial number: 36916d6db9151ad4428d458a32eae518671
|
|
|
87 |
// Valid from: Wed Nov 08 07:00:24 PST 2017 until: Tue Feb 06 07:00:24 PST 2018
|
|
|
88 |
private static final String VALID = "-----BEGIN CERTIFICATE-----\n"
|
|
|
89 |
+ "MIIFIzCCBAugAwIBAgISA2kW1tuRUa1EKNRYoy6uUYZxMA0GCSqGSIb3DQEBCwUA\n"
|
|
|
90 |
+ "MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD\n"
|
|
|
91 |
+ "ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xNzExMDgxNTAwMjRaFw0x\n"
|
|
|
92 |
+ "ODAyMDYxNTAwMjRaMCsxKTAnBgNVBAMTIHZhbGlkLWlzcmdyb290eDEubGV0c2Vu\n"
|
|
|
93 |
+ "Y3J5cHQub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyugIOCxl\n"
|
|
|
94 |
+ "4p0Rrs4aggnzKGYezhMyyvqlBgVBkf3DJV5uHbz/B/CxcoFo2rZzIetJEsb7Qnt1\n"
|
|
|
95 |
+ "U8L2O5BKnBeOsI5eFv6WUAQs96VayQ09+xCV3jSNjVpbmKKp1TNWboF/V+EDFq6f\n"
|
|
|
96 |
+ "fxK9h+b88RhBn4gfe+BorPnVTmZZQHgcZCjMGyzlXt68r45dXmZOuh0855Y7z6Et\n"
|
|
|
97 |
+ "wCHTT8k/7VC0DTIs0+veKv+yblUqwGD0htdOh7POkQGfBeJ432FsCCcLCDjg2Jj2\n"
|
|
|
98 |
+ "oYQNpLao55ZnVJGXfP8dJpHqJvuEQVuNT1TbHTs4x7IMftqGcPuhXKhA5FCVf0Hb\n"
|
|
|
99 |
+ "osbVmZ/b2b/WswIDAQABo4ICIDCCAhwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQW\n"
|
|
|
100 |
+ "MBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQZ\n"
|
|
|
101 |
+ "Mod3QzNPUL56tDMtELpCiwkQOTAfBgNVHSMEGDAWgBSoSmpjBH3duubRObemRWXv\n"
|
|
|
102 |
+ "86jsoTBvBggrBgEFBQcBAQRjMGEwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwLmlu\n"
|
|
|
103 |
+ "dC14My5sZXRzZW5jcnlwdC5vcmcwLwYIKwYBBQUHMAKGI2h0dHA6Ly9jZXJ0Lmlu\n"
|
|
|
104 |
+ "dC14My5sZXRzZW5jcnlwdC5vcmcvMCsGA1UdEQQkMCKCIHZhbGlkLWlzcmdyb290\n"
|
|
|
105 |
+ "eDEubGV0c2VuY3J5cHQub3JnMIH+BgNVHSAEgfYwgfMwCAYGZ4EMAQIBMIHmBgsr\n"
|
|
|
106 |
+ "BgEEAYLfEwEBATCB1jAmBggrBgEFBQcCARYaaHR0cDovL2Nwcy5sZXRzZW5jcnlw\n"
|
|
|
107 |
+ "dC5vcmcwgasGCCsGAQUFBwICMIGeDIGbVGhpcyBDZXJ0aWZpY2F0ZSBtYXkgb25s\n"
|
|
|
108 |
+ "eSBiZSByZWxpZWQgdXBvbiBieSBSZWx5aW5nIFBhcnRpZXMgYW5kIG9ubHkgaW4g\n"
|
|
|
109 |
+ "YWNjb3JkYW5jZSB3aXRoIHRoZSBDZXJ0aWZpY2F0ZSBQb2xpY3kgZm91bmQgYXQg\n"
|
|
|
110 |
+ "aHR0cHM6Ly9sZXRzZW5jcnlwdC5vcmcvcmVwb3NpdG9yeS8wDQYJKoZIhvcNAQEL\n"
|
|
|
111 |
+ "BQADggEBAFBiwKeCZfIh8a7x0Y5QEqGwejil/BY6MOVuIU9FRIJKmhJGdh6lI6ln\n"
|
|
|
112 |
+ "zlBbMZBAjZ+TqDxU0pvM1AsRDyCqt8GbCAC2xQsGyATLdCjedLQ7U7ORm7pBZdbe\n"
|
|
|
113 |
+ "cT7h9Sblj53o5MKa1yFeS89WGjI4UueUemGxp7EQjat0NeAvbnpU+YmuevNYKX2M\n"
|
|
|
114 |
+ "kK33reMC+rgD+wKet1CXcB/ZYl3fDzVH3SwkT/bKW5bsuwxBuD2noScnKCitRgiv\n"
|
|
|
115 |
+ "Ew7YjwqNOm2naki/xr2sfJirR+lJtZ9KC3H8xWeEHrD8Cf7pnmMYqV59uR+hJwMP\n"
|
|
|
116 |
+ "YsjjDbDFCmNN9FBqDwvXs7g86ttkdC8=\n"
|
|
|
117 |
+ "-----END CERTIFICATE-----";
|
|
|
118 |
|
|
|
119 |
// Owner: CN=revoked-isrgrootx1.letsencrypt.org
|
|
|
120 |
// Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US
|
|
|
121 |
// Serial number: 3ddd39c0755648d6687a5d8ded37775657e
|
|
|
122 |
// Valid from: Wed Nov 08 07:00:32 PST 2017 until: Tue Feb 06 07:00:32 PST 2018
|
|
|
123 |
private static final String REVOKED = "-----BEGIN CERTIFICATE-----\n"
|
|
|
124 |
+ "MIIFJzCCBA+gAwIBAgISA93TnAdVZI1mh6XY3tN3dWV+MA0GCSqGSIb3DQEBCwUA\n"
|
|
|
125 |
+ "MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD\n"
|
|
|
126 |
+ "ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xNzExMDgxNTAwMzJaFw0x\n"
|
|
|
127 |
+ "ODAyMDYxNTAwMzJaMC0xKzApBgNVBAMTInJldm9rZWQtaXNyZ3Jvb3R4MS5sZXRz\n"
|
|
|
128 |
+ "ZW5jcnlwdC5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5qlZ0\n"
|
|
|
129 |
+ "jslNLn/1uICdZPwflcvsoA2S2Nk+O7cPNew+KQmSIf+LK9AbaWHCkABKx1GdMtfN\n"
|
|
|
130 |
+ "4Q/nKBtzqZ5jX1V1XbPqPd1eeyJo0rNaDFk/gEUHw/zIYi1AtsxVHztMqOXRcsw+\n"
|
|
|
131 |
+ "6QHRKU2XFVsfSctMv+MKnMTEJZARyhr5ur9bQ4/LmxPMhrlHAst97hiSsXKXeyMK\n"
|
|
|
132 |
+ "DWPHmUDn1vz/1mwLMaeYYmuhuRP5HNwYq+LdYvjMV580i6LHY72TwQCfVgOHfqI0\n"
|
|
|
133 |
+ "larISk2p4q6DmTEEiAzJB3yEYaxDn0kEXbKhL9efDC+eirVFa0ta2OnH87s9L8z9\n"
|
|
|
134 |
+ "fm9JIiSFM9ATQ16/AgMBAAGjggIiMIICHjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l\n"
|
|
|
135 |
+ "BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYE\n"
|
|
|
136 |
+ "FP64lxiV8KwkkzoNaM7iuwX8UBG/MB8GA1UdIwQYMBaAFKhKamMEfd265tE5t6ZF\n"
|
|
|
137 |
+ "Ze/zqOyhMG8GCCsGAQUFBwEBBGMwYTAuBggrBgEFBQcwAYYiaHR0cDovL29jc3Au\n"
|
|
|
138 |
+ "aW50LXgzLmxldHNlbmNyeXB0Lm9yZzAvBggrBgEFBQcwAoYjaHR0cDovL2NlcnQu\n"
|
|
|
139 |
+ "aW50LXgzLmxldHNlbmNyeXB0Lm9yZy8wLQYDVR0RBCYwJIIicmV2b2tlZC1pc3Jn\n"
|
|
|
140 |
+ "cm9vdHgxLmxldHNlbmNyeXB0Lm9yZzCB/gYDVR0gBIH2MIHzMAgGBmeBDAECATCB\n"
|
|
|
141 |
+ "5gYLKwYBBAGC3xMBAQEwgdYwJgYIKwYBBQUHAgEWGmh0dHA6Ly9jcHMubGV0c2Vu\n"
|
|
|
142 |
+ "Y3J5cHQub3JnMIGrBggrBgEFBQcCAjCBngyBm1RoaXMgQ2VydGlmaWNhdGUgbWF5\n"
|
|
|
143 |
+ "IG9ubHkgYmUgcmVsaWVkIHVwb24gYnkgUmVseWluZyBQYXJ0aWVzIGFuZCBvbmx5\n"
|
|
|
144 |
+ "IGluIGFjY29yZGFuY2Ugd2l0aCB0aGUgQ2VydGlmaWNhdGUgUG9saWN5IGZvdW5k\n"
|
|
|
145 |
+ "IGF0IGh0dHBzOi8vbGV0c2VuY3J5cHQub3JnL3JlcG9zaXRvcnkvMA0GCSqGSIb3\n"
|
|
|
146 |
+ "DQEBCwUAA4IBAQCBiokogdgIZxwuPSr43S4GZ9FwrpZNMHADMEZB8ykuotJBGyr1\n"
|
|
|
147 |
+ "QLWDVeoAJ8OIi1AzjcdwKFQks/MKUJwxJ9hYmm9aM14d5lMKGTyoLSI/Z/Vrpx8w\n"
|
|
|
148 |
+ "0GpktSK0WfPeLBHuSpMdrIMWyziSu/bdZtiOIIvMasFwyRhDgII++CIdsnboWXF+\n"
|
|
|
149 |
+ "DZcwy0Yd6XzirXuwENwaWrkrbZPr/JB0xLFmydqXAnA1VFTudwL87q4CTlEo8EiD\n"
|
|
|
150 |
+ "ucKZ/vAhD+ip3/kQFXg90om+9TdHo8D8GxTC1CLZteJt+nqWFRj0e/7eCXIZuUBE\n"
|
|
|
151 |
+ "aSsFCd5RNTHs6tioN9vYJqLojObgF75MgIAC\n"
|
|
|
152 |
+ "-----END CERTIFICATE-----";
|
|
|
153 |
|
|
|
154 |
public static void main(String[] args) throws Exception {
|
|
|
155 |
|
|
|
156 |
ValidatePathWithParams pathValidator = new ValidatePathWithParams(null);
|
|
|
157 |
|
|
|
158 |
if (args.length >= 1 && "CRL".equalsIgnoreCase(args[0])) {
|
|
|
159 |
pathValidator.enableCRLCheck();
|
|
|
160 |
|
|
|
161 |
// Validate int, EE certs don't have CRLs
|
|
|
162 |
pathValidator.validate(new String[]{INT},
|
|
|
163 |
ValidatePathWithParams.Status.GOOD, null, System.out);
|
|
|
164 |
|
|
|
165 |
return;
|
|
|
166 |
} else {
|
|
|
167 |
// OCSP check by default
|
|
|
168 |
pathValidator.enableOCSPCheck();
|
|
|
169 |
}
|
|
|
170 |
|
|
|
171 |
// Validate valid
|
|
|
172 |
pathValidator.validate(new String[]{VALID, INT},
|
|
|
173 |
ValidatePathWithParams.Status.GOOD, null, System.out);
|
|
|
174 |
|
|
|
175 |
// Validate Revoked
|
|
|
176 |
pathValidator.validate(new String[]{REVOKED, INT},
|
|
|
177 |
ValidatePathWithParams.Status.REVOKED,
|
|
|
178 |
"Wed Nov 08 08:00:35 PST 2017", System.out);
|
|
|
179 |
|
|
|
180 |
}
|
|
|
181 |
}
|