KeyUsageMatters.java revision 2362
2362N/A * Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved. 1391N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 1391N/A * This code is free software; you can redistribute it and/or modify it 1391N/A * under the terms of the GNU General Public License version 2 only, as 1391N/A * published by the Free Software Foundation. 1391N/A * This code is distributed in the hope that it will be useful, but WITHOUT 1391N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 1391N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 1391N/A * version 2 for more details (a copy is included in the LICENSE file that 1391N/A * You should have received a copy of the GNU General Public License version 1391N/A * 2 along with this work; if not, write to the Free Software Foundation, 1391N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 2362N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 2362N/A * or visit www.oracle.com if you need additional information or have any 1391N/A * @summary PIT b61: PKI test suite fails because self signed certificates 1391N/A * KeyUsage extension plays a important rule during looking for the issuer 1391N/A * of a certificate or CRL. A certificate issuer should have the keyCertSign 1391N/A * bit set, and a CRL issuer should have the cRLSign bit set. 1391N/A * Sometime, a delegated CRL issuer would also have the keyCertSign bit set, 1391N/A * as would be troublesome to find the proper CRL issuer during certificate 1391N/A * path build if the delegated CRL issuer is a self-issued certificate, for 1391N/A * it is hard to identify it from its issuer by the "issuer" field only. 1391N/A * The fix of 6852744 should addresses above issue, and allow a delegated CRL 1391N/A * issuer to have keyCertSign bit set. 1391N/A * In the test case, the delegated CRL issuers have cRLSign bit set only, and 1391N/A * the CAs have the keyCertSign bit set only, it is expected to work before 1391N/A * and after the bug fix of 6852744. 1391N/A "-----BEGIN CERTIFICATE-----\n" +
1391N/A "MIICPjCCAaegAwIBAgIBADANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
1391N/A "MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzJaFw0zMDA0MDcwMjI0MzJa\n" +
1391N/A "MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
1391N/A "AQUAA4GNADCBiQKBgQC4OTag24sTxL2tXTNuvpmUEtdxrYAZoFsslFQ60T+WD9wQ\n" +
1391N/A "Jeiw87FSPsR2vxRuv0j8DNm2a4h7LNNIFcLurfNldbz5pvgZ7VqdbbUMPE9qP85n\n" +
1391N/A "jgDl4woyRTSUeRI4A7O0CO6NpES21dtbdhroWQrEkHxpnrDPxsxrz5gf2m3gqwID\n" +
1391N/A "AQABo4GJMIGGMB0GA1UdDgQWBBSCJd0hpl5PdAD9IZS+Hzng4lXLGzBHBgNVHSME\n" +
1391N/A "QDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEwHzELMAkGA1UEBhMCVVMxEDAO\n" +
1391N/A "DQYJKoZIhvcNAQEEBQADgYEAluy6HIjWcq009lTLmhp+Np6dxU78pInBK8RZkza0\n" +
1391N/A "484qGaxFGD3UGyZkI5uWmsH2XuMbuox5khfIq6781gmkPBHXBIEtJN8eLusOHEye\n" +
1391N/A "-----END CERTIFICATE-----";
1391N/A "-----BEGIN CERTIFICATE-----\n" +
1391N/A "MIICUDCCAbmgAwIBAgIBAzANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
1391N/A "MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzRaFw0yOTAxMTIwMjI0MzRa\n" +
1391N/A "MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
1391N/A "cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCiAJnAQW2ad3ZMKUhSJVZj\n" +
1391N/A "Eg2CDptekC5BSPS+fIAIKlncB3HwOiFFhH6b3wTydDCdEd2fvsi4QMOSVrIYMeA8\n" +
1391N/A "IBp4tN8y08jw2jBHBgNVHSMEQDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEw\n" +
1391N/A "7cXP6VDeZMG6oRQ4hbOcixoFPXo=\n" +
1391N/A "-----END CERTIFICATE-----";
1391N/A // a delegated CRL issuer, it's a self-issued certificate of trust anchor 1391N/A "-----BEGIN CERTIFICATE-----\n" +
1391N/A "MIICKzCCAZSgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
1391N/A "MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzNaFw0yOTAxMTIwMjI0MzNa\n" +
1391N/A "MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
1391N/A "atKy8zf8O9XzztelLJ26Gqb7QPV133WY3haAqHtCXOhEKkCN16NOYNC37DTaJwID\n" +
1391N/A "AQABo3cwdTAdBgNVHQ4EFgQULXSWzXzUOIpOJpzbSCpW42IJUugwRwYDVR0jBEAw\n" +
1391N/A "VQQKEwdFeGFtcGxlggEAMAsGA1UdDwQEAwIBAjANBgkqhkiG9w0BAQQFAAOBgQAY\n" +
1391N/A "-----END CERTIFICATE-----";
1391N/A // a delegated CRL issuer, it's a self-issued certificate of sub-ca 1391N/A "-----BEGIN CERTIFICATE-----\n" +
1391N/A "MIICPTCCAaagAwIBAgIBBDANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
1391N/A "MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzRaFw0yOTAxMTIwMjI0MzRa\n" +
1391N/A "MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
1391N/A "cy0xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDWUtDQx2MB/7arDiquMJyd\n" +
1391N/A "LWwSg6p8sg5z6wKrC1v47MT4DBhFX+0RUgTMUdQgYpgxGpczn+6y4zfV76064S0N\n" +
1391N/A "4L/IQ+SunTW1w4yRGjB+xkyyJmWAqijG1nr+Dgkv5nxPI+9Er5lHcoVWVMEcvvRm\n" +
1391N/A "6jIBQdldVlSgv+VgUnFm5wIDAQABo3cwdTAdBgNVHQ4EFgQUkV3Qqtk7gIot9n60\n" +
1391N/A "CzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlggEAMAsGA1UdDwQEAwIBAjAN\n" +
1391N/A "BgkqhkiG9w0BAQQFAAOBgQADu4GM8EdmIKhC7FRvk5jF90zfvZ38wbXBzCjKI4jX\n" +
1391N/A "QJrhne1bfyeNNm5c1w+VKidT+XzBzBGH7ZqYzoZmzRIfcbLKX2brEBKiukeeAyL3\n" +
1391N/A "bctQtbp19tX+uu2dQberD188AAysKTkHcJUV+rRsTwVJ9vcYKxoRxKk8DhH7ZS3M\n" +
1391N/A "-----END CERTIFICATE-----";
1391N/A // the target EE certificate 1391N/A "-----BEGIN CERTIFICATE-----\n" +
1391N/A "MIICNzCCAaCgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQ\n" +
1391N/A "MA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMTAeFw0wOTA0MjcwMjI0\n" +
1391N/A "MzZaFw0yOTAxMTIwMjI0MzZaMEExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFt\n" +
1391N/A "cGxlMRAwDgYDVQQLEwdDbGFzcy0xMQ4wDAYDVQQDEwVBbGljZTCBnzANBgkqhkiG\n" +
1391N/A "ZyR+Wtj63IuvaigAC4uC+zBypF93ThjwCzVR2qKDQaQzV8CLleO96gStt7Y+i3G2\n" +
1391N/A "-----END CERTIFICATE-----";
1391N/A // CRL issued by the delegated CRL issuer, topCrlIssuerCertStr 1391N/A "-----BEGIN X509 CRL-----\n" +
1391N/A "MIIBGzCBhQIBATANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQMA4GA1UE\n" +
1391N/A "ChMHRXhhbXBsZRcNMDkwNDI3MDIzODA0WhcNMjgwNjI2MDIzODA0WjAiMCACAQUX\n" +
1391N/A "DTA5MDQyNzAyMzgwMFowDDAKBgNVHRUEAwoBBKAOMAwwCgYDVR0UBAMCAQIwDQYJ\n" +
1391N/A "oKLrE9+yCOkYUOpiRlz43/3vkEL5hjIKMcDSZnPKBZi1h16Yj2hPe9GMibNip54=\n" +
1391N/A // CRL issued by the delegated CRL issuer, subCrlIssuerCertStr 1391N/A "-----BEGIN X509 CRL-----\n" +
1391N/A "MIIBLTCBlwIBATANBgkqhkiG9w0BAQQFADAxMQswCQYDVQQGEwJVUzEQMA4GA1UE\n" +
1391N/A "ChMHRXhhbXBsZTEQMA4GA1UECxMHQ2xhc3MtMRcNMDkwNDI3MDIzODA0WhcNMjgw\n" +
1391N/A "NjI2MDIzODA0WjAiMCACAQQXDTA5MDQyNzAyMzgwMVowDDAKBgNVHRUEAwoBBKAO\n" +
1391N/A "MAwwCgYDVR0UBAMCAQIwDQYJKoZIhvcNAQEEBQADgYEAeS+POqYEIHIIJcsLxuUr\n" +
1391N/A "nGKuq4Q1DFj82E7/9d25nXdWGOmFvFCRVO+St2Xe5n8CJuZNBiz388FDSIOiFSCa\n" +
1391N/A "ARGr6Qu68MYGtLMC6ZqP3u0=\n" +
1391N/A // generate certificate from cert string 1391N/A // generate certificate from certificate string 1391N/A // generate CRL from CRL string 1391N/A // generate certificate from certificate string 1391N/A // generate certificate from certificate string