Skip to content

Commit 56b7a05

Browse files
jackctj117jackctj117
committed
Added serial 0 tests to unit tests
1 parent 2ff3ccd commit 56b7a05

18 files changed

Lines changed: 526 additions & 1 deletion

‎certs/include.am‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,7 @@ include certs/ocsp/include.am
146146
include certs/statickeys/include.am
147147
include certs/test/include.am
148148
include certs/test-pathlen/include.am
149+
include certs/test-serial0/include.am
149150
include certs/intermediate/include.am
150151
include certs/falcon/include.am
151152
include certs/rsapss/include.am

‎certs/test-serial0/README.md‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Serial Number 0 Test Certificates
2+
3+
This directory contains test certificates for testing wolfSSL's handling of serial number 0 in certificates, specifically for issue #8615.
4+
5+
## Background
6+
7+
RFC 5280 section 4.1.2.2 requires certificate serial numbers to be positive non-zero integers. However, some legacy root CA certificates in real-world trust stores have serial number 0. Since root CAs are explicitly trusted by configuration (not by chain validation), wolfSSL allows serial 0 specifically for self-signed CA certificates (root CAs) while still enforcing RFC 5280 compliance for other certificate types.
8+
9+
## Test Certificates
10+
11+
This directory contains the following test certificates:
12+
13+
### 1. root_serial0.pem
14+
- **Type**: Root CA (self-signed, CA:TRUE)
15+
- **Serial Number**: 0
16+
- **Expected Behavior**: Should be accepted by wolfSSL
17+
- **Purpose**: Tests that legacy root CAs with serial 0 can be loaded
18+
19+
### 2. root.pem
20+
- **Type**: Root CA (self-signed, CA:TRUE)
21+
- **Serial Number**: 1
22+
- **Expected Behavior**: Should be accepted by wolfSSL
23+
- **Purpose**: Normal root CA for signing test certificates
24+
25+
### 3. ee_serial0.pem
26+
- **Type**: End-entity certificate (CA:FALSE)
27+
- **Serial Number**: 0
28+
- **Signed By**: root.pem (serial 1)
29+
- **Expected Behavior**: Should be rejected by wolfSSL
30+
- **Purpose**: Tests that end-entity certs with serial 0 are still rejected
31+
32+
### 4. ee_normal.pem
33+
- **Type**: End-entity certificate (CA:FALSE)
34+
- **Serial Number**: 100
35+
- **Signed By**: root_serial0.pem (serial 0)
36+
- **Expected Behavior**: Should be accepted by wolfSSL
37+
- **Purpose**: Tests that normal certificates signed by a serial 0 root CA work correctly
38+
39+
### 5. selfsigned_nonca_serial0.pem
40+
- **Type**: Self-signed certificate (CA:FALSE)
41+
- **Serial Number**: 0
42+
- **Expected Behavior**: Should be rejected by wolfSSL
43+
- **Purpose**: Tests that self-signed non-CA certs with serial 0 are rejected (only root CAs get the exception)
44+
45+
## Regenerating Certificates
46+
47+
To regenerate all test certificates:
48+
49+
```bash
50+
cd certs/test-serial0
51+
./generate_certs.sh
52+
```
53+
54+
Requirements:
55+
- OpenSSL command-line tool
56+
57+
## Unit Tests
58+
59+
These certificates are used by the `test_SerialNumber0_RootCA()` function in `tests/api/test_asn.c`.
60+
61+
## Related Issues
62+
63+
- GitHub Issue: https://github.com/wolfSSL/wolfssl/issues/8615
64+
- RFC 5280 Section 4.1.2.2: Certificate Serial Number Requirements
65+
- RFC Errata 3200: Clarification that serial numbers must be non-zero
66+

‎certs/test-serial0/ee_normal.csr‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
-----BEGIN CERTIFICATE REQUEST-----
2+
MIIChTCCAW0CAQAwQDEaMBgGA1UEAwwRRW5kIEVudGl0eSBOb3JtYWwxFTATBgNV
3+
BAoMDHdvbGZTU0wgVGVzdDELMAkGA1UEBhMCVVMwggEiMA0GCSqGSIb3DQEBAQUA
4+
A4IBDwAwggEKAoIBAQDGmfUlMQyqetJsIs9jEX5KljUwq1T9Tg743KhWAFDTpR5T
5+
rx0wsUBTnalsY+FdEzQXf0WJ4jLxBZjhiFlUJsVRF24hqME7WjaeJr3+x+8+B550
6+
81GiBL1B50dVszgyHPTQlhEy/RF3ZUkc+e7ntbmHj7z9es84wBgRhWufV78RcF0L
7+
PwqY5rMOZCxIc9+J7pXZj3eebhXnEar/NwgMfBziKwZ23OFnr0WpYsg/zZxmr1Qr
8+
AExT718RrZ6M5I2T6okgv9vY85oPrut8Gc6C8bFpAg/Z7FpnUaFNfnXzsuG0Lrg8
9+
k/STG6jR1rK/dFy1H9egpnFyhpdZZN3IkIIbA7XZAgMBAAGgADANBgkqhkiG9w0B
10+
AQsFAAOCAQEAmx7S7a3tM4oJMgf9pI6VE+n1pTMhJ1izGs9+7aDU7Vw0/cSIn62X
11+
NpMN59cYU8PEKmEDMhG11AzaajnoHYNV+a3V84is5gmUW3Gnj5a39nD4l7VRcWXk
12+
1SsGxa4XCrss7SA+wydnbx/bH/t3FTkA7eX2v9Ad+z7gdcyxnSK+c1x0hDj5omHA
13+
g0YpoHgNoS+kUG3oxc0ajzghyiiQCJKPTF2rNyzqFaWL48O49ZRpZHxacZhDAscN
14+
ks/UU8T9s8f39/PthXDUvSqwYaqgOU+isgc4BVnLaDfeycpDG9P6LCM/LB8htecJ
15+
9T4+O5ZhbfYWZA+MRawStYwtapWT37vL2Q==
16+
-----END CERTIFICATE REQUEST-----

‎certs/test-serial0/ee_normal.pem‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDeDCCAmCgAwIBAgIBZDANBgkqhkiG9w0BAQsFADBEMR4wHAYDVQQDDBVUZXN0
3+
IFJvb3QgQ0EgU2VyaWFsIDAxFTATBgNVBAoMDHdvbGZTU0wgVGVzdDELMAkGA1UE
4+
BhMCVVMwHhcNMjUxMjE5MjM0MDE4WhcNMjYxMjE5MjM0MDE4WjBAMRowGAYDVQQD
5+
DBFFbmQgRW50aXR5IE5vcm1hbDEVMBMGA1UECgwMd29sZlNTTCBUZXN0MQswCQYD
6+
VQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMaZ9SUxDKp6
7+
0mwiz2MRfkqWNTCrVP1ODvjcqFYAUNOlHlOvHTCxQFOdqWxj4V0TNBd/RYniMvEF
8+
mOGIWVQmxVEXbiGowTtaNp4mvf7H7z4HnnTzUaIEvUHnR1WzODIc9NCWETL9EXdl
9+
SRz57ue1uYePvP16zzjAGBGFa59XvxFwXQs/Cpjmsw5kLEhz34nuldmPd55uFecR
10+
qv83CAx8HOIrBnbc4WevRaliyD/NnGavVCsATFPvXxGtnozkjZPqiSC/29jzmg+u
11+
63wZzoLxsWkCD9nsWmdRoU1+dfOy4bQuuDyT9JMbqNHWsr90XLUf16CmcXKGl1lk
12+
3ciQghsDtdkCAwEAAaN5MHcwCQYDVR0TBAIwADALBgNVHQ8EBAMCBaAwHQYDVR0l
13+
BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBQOtYl8IbuhwNvuxtw/
14+
E0EiPBLdITAfBgNVHSMEGDAWgBTKbzmfzfMDi8bSxDKvXPrVlJO7QTANBgkqhkiG
15+
9w0BAQsFAAOCAQEAp2KWiroy9OFUFghTBWquc5oQUVS5f1IYfVt4Gas0Vz9Sokwm
16+
xl+TiXJAA9mV8RSxxkIokGcOsyycwzwyq9IeGhq1ovEgNNJM5OVjkdX5CjjnWs+i
17+
Kum+TEWAawWnTDSRyhxjcbdAu+5TtF+Wk9UwO6hEOEaTUzpgEaGLgiqyJSV3XEpp
18+
y9BQTQ4wwmLv3qzZR8P6O+pRxMIHKu/kkD/2gxlKyonH+PikbR+d1DNP/Hwn92q7
19+
qs8o7udsluxfHsO8JCiqtRDuHyHPpTTSQIBX1MqIn57dEY67HSIfyXXOsq+ygW/I
20+
coAv4SxQ5arEXmaZXOkcR8Z36FhIw1XO+qBGfg==
21+
-----END CERTIFICATE-----

‎certs/test-serial0/ee_normal_key.pem‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDGmfUlMQyqetJs
3+
Is9jEX5KljUwq1T9Tg743KhWAFDTpR5Trx0wsUBTnalsY+FdEzQXf0WJ4jLxBZjh
4+
iFlUJsVRF24hqME7WjaeJr3+x+8+B55081GiBL1B50dVszgyHPTQlhEy/RF3ZUkc
5+
+e7ntbmHj7z9es84wBgRhWufV78RcF0LPwqY5rMOZCxIc9+J7pXZj3eebhXnEar/
6+
NwgMfBziKwZ23OFnr0WpYsg/zZxmr1QrAExT718RrZ6M5I2T6okgv9vY85oPrut8
7+
Gc6C8bFpAg/Z7FpnUaFNfnXzsuG0Lrg8k/STG6jR1rK/dFy1H9egpnFyhpdZZN3I
8+
kIIbA7XZAgMBAAECggEAEVCl92lN2zqHHbIb67LAPzIruVkOuWD0sYzSHmFmVUrY
9+
QzU0HHqFCw/mur0AjolYlCiJVbVYz1EMxwkIuhYBQ7SBFRfYn7CaAh2K7hYyDRyZ
10+
RkVahiosnVIpPYG5HLa6lMmoqTiNgnUxs9WJ7JNtoAc6U81BGN0NRtB06s5kfwQU
11+
f4cJ0eW9FoAgLorxCQTdfWDecV26wEy7AylEPZwavs7oDjxeIMSmE0X7kaAzXXab
12+
LYrjLY8d2ySQLPOO+0fwCnKqxPAIS11iZOXkyEb1sEurSH/k4F6SPI44qpr3sUP+
13+
W9FSXdFe0d9FXNLAEsUcx1ZlQhTcXatwmTfrsuvgiwKBgQD8VCLCpjmRAYLAWNWd
14+
k8lXXc4XZHKVdW3mSFBoiVTaTTdMncm55VrCaPTizZcjQSP1lsvTaIskjzh/aJ5A
15+
ZoKN7b0d9uI4voSdT72qdjV//CSTwHcxqngxidYhVncTVHGW2SxWCQpCdnkB9Ljt
16+
ONRSSo1eSC7iejKDB1gCyB6hhwKBgQDJfbNX0ZnnzW3dd9Z9dl7HZk0BtdlbLlSn
17+
XZKPpHjDpHKA8tNLAJqfUS7m70rOlk8K6Ls9Lw/BWWQmNH95Syyd99xXw32q2gwJ
18+
U9OQZkOg1TBriXdOy0GMPR1Hva4pTL+p6cUdtTuoiSqDsWQFXCXJX2yZbX9vSHqS
19+
wnOxquxFnwKBgQCQroWH6twTQzR/qfBCfFz0VXs4eoYhIMY1Rr2kUypuSdwteEQU
20+
7WfPFXNlINFKi61cwmx4+fberaiNlaU39A9j5i+MIOWx97v+n5x3Q3SFwEQQ3Ej8
21+
F2z3qrs3PmbklITVJA2B/4j8dwYHkxT+IJnN3aWVq/oGLl8MNofGgIzfvQKBgQCJ
22+
qxMgi5umn9vTGBA7ROdZQnKXGpLaE/vPJsX+0xeYRQHfTQpFErKS7DspmpH4OQbk
23+
o0NbeI5BQzyERhZa35wqirHIXU+9rqHOtbG11cmbWE5vC0uzUHkGwrMA037txPyn
24+
sYv20l9iteWQeWGnr+A5iLOA2Sna9SCaqbW2zNwGbQKBgQCJ9FzkJZTNn5xmFmhH
25+
JaCwl+BUKFIITN9xgoB7G2Fd5s8dMRhATnSxWHxoYh+VMIDZmJVItatSMN84ATN+
26+
xis5DbQdKvCDcBhuDc9U46UhmQvvg5PpHBAdDVg2VGY6n7ZTydOSTEJJIjINxzDD
27+
ditcotkx/ZONY00aSgx/FtmmkA==
28+
-----END PRIVATE KEY-----

‎certs/test-serial0/ee_serial0.csr‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
-----BEGIN CERTIFICATE REQUEST-----
2+
MIIChzCCAW8CAQAwQjEcMBoGA1UEAwwTRW5kIEVudGl0eSBTZXJpYWwgMDEVMBMG
3+
A1UECgwMd29sZlNTTCBUZXN0MQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEB
4+
BQADggEPADCCAQoCggEBANUOzExpAy8FaTQVU4yj2FxAY93lRLhNe9R9CW9LBKZD
5+
6R3tg+EltRK5i4798RnZfXwanU2LeCFi21a7q7FL29gaeTxxP1CrB59lubdvlqIK
6+
82TAubWHBhoPt0dPR5bTsBPtwoqn8ZPAJPTBqFkzpkX8ASNIakvPH546RX+6WHbJ
7+
a175fxyKMRo6V9UKWjA/sqQkhIOA3Drl6x4d7haa35NquZm/OeIQnEqu2XWTdWcx
8+
iMqKquTNyJ2izZ4WRa65QzVMPLQrlh47xtPUC5Hu17sgW2FYY1GiOmTO3iKAXZsn
9+
yt+9UWJru8NuvWkxIZdwOABLJm8K25XW8GvZUvoan7cCAwEAAaAAMA0GCSqGSIb3
10+
DQEBCwUAA4IBAQC/GAHuVZz2p/Tkk7QXrIbovWvw2g1gusPDJrL27471ZwFUnTyA
11+
y5NZDGRSMazZCylclRBIATEEEiTobR32+3NaT/r01wMBW/9R5uh7MpDAJjA9jS/8
12+
zE92TwwT9H8RHnkbJXzxKPbnRZF/Nl5FE0DzH7YlHY9PKAbkeN3l3M5zy8yxoon+
13+
1g2QiEVHiGWPshtpbqpKuxbgwSJ8bP6BdZ51fwmgSCqzaei+OCXrGKKHJqdHpwRd
14+
iX7tp4PtcCWiifwvb1d/az5X/CGBfK6qar8jYNa5dGLXQn2pilAxoddRSDIrrNnN
15+
pT3R8Djb1CQGFtS7RUdtmA5FRqlY3cAFI4o6
16+
-----END CERTIFICATE REQUEST-----

‎certs/test-serial0/ee_serial0.pem‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDeDCCAmCgAwIBAgIBADANBgkqhkiG9w0BAQsFADBCMRwwGgYDVQQDDBNUZXN0
3+
IFJvb3QgQ0EgTm9ybWFsMRUwEwYDVQQKDAx3b2xmU1NMIFRlc3QxCzAJBgNVBAYT
4+
AlVTMB4XDTI1MTIxOTIzNDAxOFoXDTI2MTIxOTIzNDAxOFowQjEcMBoGA1UEAwwT
5+
RW5kIEVudGl0eSBTZXJpYWwgMDEVMBMGA1UECgwMd29sZlNTTCBUZXN0MQswCQYD
6+
VQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANUOzExpAy8F
7+
aTQVU4yj2FxAY93lRLhNe9R9CW9LBKZD6R3tg+EltRK5i4798RnZfXwanU2LeCFi
8+
21a7q7FL29gaeTxxP1CrB59lubdvlqIK82TAubWHBhoPt0dPR5bTsBPtwoqn8ZPA
9+
JPTBqFkzpkX8ASNIakvPH546RX+6WHbJa175fxyKMRo6V9UKWjA/sqQkhIOA3Drl
10+
6x4d7haa35NquZm/OeIQnEqu2XWTdWcxiMqKquTNyJ2izZ4WRa65QzVMPLQrlh47
11+
xtPUC5Hu17sgW2FYY1GiOmTO3iKAXZsnyt+9UWJru8NuvWkxIZdwOABLJm8K25XW
12+
8GvZUvoan7cCAwEAAaN5MHcwCQYDVR0TBAIwADALBgNVHQ8EBAMCBaAwHQYDVR0l
13+
BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBQx+Na6kBfWYPpaWckA
14+
enIUHRBTpjAfBgNVHSMEGDAWgBSHt8mJk7i7mgilD+S1x772GmpVEzANBgkqhkiG
15+
9w0BAQsFAAOCAQEAToFw7Pq59wHF05exYFlSC8R5TRQy9C4fZH55J5urGZ76pOFw
16+
7jyxke2QacP0/3bE3/cJOFPjGm4pu060+lI9sVu0S4ztiRjaNhbHm2vbpZ7ZLXrL
17+
2ytMG4S17rbkCw/nPbNEi4aleB/QPI8g2oVDmxO9ZR8dGhh9CBsNsfy5iHo+clV3
18+
NAim9bhd3otyJRJcEfTUBe2n+DIu87B4s+/8d7NWZm/0s3p+tDZ8b9cvJcakN4Ty
19+
uN42s7goJ+fBQhPyPvxn/DT6wQY0rfEtsPGF4DFliKdnOlrHkctA9mC3ysGWbNa4
20+
m/t6/U2WeTZPSgJad/OHsXHP+/Ke7dEiXHZsCw==
21+
-----END CERTIFICATE-----

‎certs/test-serial0/ee_serial0_key.pem‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDVDsxMaQMvBWk0
3+
FVOMo9hcQGPd5US4TXvUfQlvSwSmQ+kd7YPhJbUSuYuO/fEZ2X18Gp1Ni3ghYttW
4+
u6uxS9vYGnk8cT9QqwefZbm3b5aiCvNkwLm1hwYaD7dHT0eW07AT7cKKp/GTwCT0
5+
wahZM6ZF/AEjSGpLzx+eOkV/ulh2yWte+X8cijEaOlfVClowP7KkJISDgNw65ese
6+
He4Wmt+TarmZvzniEJxKrtl1k3VnMYjKiqrkzcidos2eFkWuuUM1TDy0K5YeO8bT
7+
1AuR7te7IFthWGNRojpkzt4igF2bJ8rfvVFia7vDbr1pMSGXcDgASyZvCtuV1vBr
8+
2VL6Gp+3AgMBAAECggEAFfkjutGtwWC2e+ejKUMQolsFsbHeh39+QOjwWykKfrdM
9+
SIjhbAv+g8LdEM9B2V+j4HPCO2gh6JeQdX5/c5aWQtBgJoqrc/9fluHf6Ho6t9WX
10+
SpHR1VXqnC94wIL9qCGG7Fc+FBzD/m/3n8KFQUXhZSBbYa8rP0xKP4BVAJpQW1e0
11+
WkMxy57kMdZYAgFsGK3vdnaZyBFtIePj1WDplRwR4wCFWq920MWWv5WyG2OyIXiP
12+
BG7o8qhEyU+bPKbIWfaLtIrZHwNk38HoDoluoKx3/W9rEY0jS/Qgwk+Z5Dd4/ufS
13+
C+sf82bh5mlOvCsBt5LTfuIhjXH0QVSWYqiQW5Zk8QKBgQD3G/iQo+yK+7hGiELm
14+
YasBftSJ3kW2J19BWzWsH31P6QzpwldHXDgJo3pITpoBnNvWgfa5y+/D7aN9WrMs
15+
JY3DZO9eyUHw4j2tC0c9HCORObgWYdwQ274UCV6y2o815ty+B/4Vla1ENt2TPWHa
16+
8TCgaBjGH8Px187zJRoKmFdOeQKBgQDcuTEuwLRhky6O4bBh41XZ7CfvfBco1EXx
17+
yk12WJ63bpVmRlmciWQWEwUVOHr3cGRzCCeQ1Y3uz7jYMDit3ZkfkbIjHwwxLaVn
18+
TC+9hptp4oEidO30Qsf7PQKzkE7jg6FVCw/MsPMj6LXI45dM6i0k6zIrmmcUpPaw
19+
6QHnriETrwKBgAJ7I2nAW5WhpV3/7DwH6wGe1l9z/dswVgJ/+e/6ePWeb2TBcMLk
20+
qCNgos+rClzNyF9E+scuxv9+mU+e44Gj9uJpVwXqm2DhxKDCJjr0116T58dBwEXj
21+
DuuAlJTTIPD3mmvGBMUOtaijrGHYEe1y0nwpz2Xd18fL1OYYD0Tf9rBxAoGAT3dR
22+
UL7KcpLV4VU59pQtdY8DdcJcaDO8lue56dDQG8Rxf2f2nVgNs7DXVKOICgvp7kxS
23+
Sl/IgOFCcHsz/MzaczY2R1THQ/FmKoGQcpDC5WVKDsjAXv+oFjkJ/vIGpPzgGcko
24+
wA45C4Wd5RyjfWqWJEOVRYOKdzFJK7pIGExl1jsCgYAzQksueSZmOaekeuSDcOxz
25+
VVAalQcH7Z6mtoPu8NGRtdnQt4fdKWzEEZ1B4jPk2TqgYqsu7DPo/N46Go/96fAY
26+
w4w/OaamuD+Pv3bPkpgArBlcz954/JCzkNwVO1dgbg4KYSxuYWfYGV41c1R5lvYT
27+
wK6SetMgDcNc9rp6OG81xg==
28+
-----END PRIVATE KEY-----

‎certs/test-serial0/generate_certs.sh‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
#!/bin/bash
2+
#
3+
# Generate test certificates for serial number 0 testing (issue #8615)
4+
# This script creates certificates in the certs/test-serial0/ directory
5+
6+
set -e
7+
8+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
9+
cd "$SCRIPT_DIR"
10+
11+
echo "==================================================="
12+
echo "Generating serial 0 test certificates in: $SCRIPT_DIR"
13+
echo "==================================================="
14+
15+
# 1. Create Root CA with serial number 0
16+
echo ""
17+
echo "[1/5] Creating Root CA with serial number 0..."
18+
openssl req -x509 -newkey rsa:2048 -keyout root_serial0_key.pem -out root_serial0.pem \
19+
-days 3650 -nodes -subj "/CN=Test Root CA Serial 0/O=wolfSSL Test/C=US" \
20+
-set_serial 0 \
21+
-addext "basicConstraints=critical,CA:TRUE" \
22+
-addext "keyUsage=critical,keyCertSign,cRLSign"
23+
24+
echo " Root CA serial number:"
25+
openssl x509 -in root_serial0.pem -noout -serial
26+
27+
# 2. Create normal Root CA (serial != 0)
28+
echo ""
29+
echo "[2/5] Creating normal Root CA with serial number 1..."
30+
openssl req -x509 -newkey rsa:2048 -keyout root_key.pem -out root.pem \
31+
-days 3650 -nodes -subj "/CN=Test Root CA Normal/O=wolfSSL Test/C=US" \
32+
-set_serial 1 \
33+
-addext "basicConstraints=critical,CA:TRUE" \
34+
-addext "keyUsage=critical,keyCertSign,cRLSign"
35+
36+
echo " Root CA serial number:"
37+
openssl x509 -in root.pem -noout -serial
38+
39+
# 3. Create end-entity cert with serial 0 signed by normal root
40+
echo ""
41+
echo "[3/5] Creating end-entity certificate with serial number 0..."
42+
openssl req -newkey rsa:2048 -keyout ee_serial0_key.pem -out ee_serial0.csr -nodes \
43+
-subj "/CN=End Entity Serial 0/O=wolfSSL Test/C=US"
44+
45+
openssl x509 -req -in ee_serial0.csr -CA root.pem -CAkey root_key.pem \
46+
-out ee_serial0.pem -days 365 -set_serial 0 \
47+
-extfile <(echo "basicConstraints=CA:FALSE
48+
keyUsage=digitalSignature,keyEncipherment
49+
extendedKeyUsage=serverAuth,clientAuth")
50+
51+
echo " End-entity cert serial number:"
52+
openssl x509 -in ee_serial0.pem -noout -serial
53+
54+
# 4. Create normal end-entity cert signed by root CA with serial 0
55+
echo ""
56+
echo "[4/5] Creating normal end-entity certificate (signed by serial 0 root)..."
57+
openssl req -newkey rsa:2048 -keyout ee_normal_key.pem -out ee_normal.csr -nodes \
58+
-subj "/CN=End Entity Normal/O=wolfSSL Test/C=US"
59+
60+
openssl x509 -req -in ee_normal.csr -CA root_serial0.pem -CAkey root_serial0_key.pem \
61+
-out ee_normal.pem -days 365 -set_serial 100 \
62+
-extfile <(echo "basicConstraints=CA:FALSE
63+
keyUsage=digitalSignature,keyEncipherment
64+
extendedKeyUsage=serverAuth,clientAuth")
65+
66+
echo " Normal end-entity cert serial number:"
67+
openssl x509 -in ee_normal.pem -noout -serial
68+
69+
# 5. Create self-signed non-CA certificate with serial 0
70+
echo ""
71+
echo "[5/5] Creating self-signed non-CA certificate with serial number 0..."
72+
openssl req -x509 -newkey rsa:2048 -keyout selfsigned_nonca_serial0_key.pem \
73+
-out selfsigned_nonca_serial0.pem -days 365 -nodes \
74+
-subj "/CN=Self-Signed Non-CA Serial 0/O=wolfSSL Test/C=US" \
75+
-set_serial 0 \
76+
-addext "basicConstraints=CA:FALSE" \
77+
-addext "keyUsage=digitalSignature,keyEncipherment"
78+
79+
echo " Self-signed non-CA cert serial number:"
80+
openssl x509 -in selfsigned_nonca_serial0.pem -noout -serial
81+
82+
echo ""
83+
echo "==================================================="
84+
echo "Certificate generation complete!"
85+
echo "==================================================="
86+
echo ""
87+
echo "Generated certificates in: $SCRIPT_DIR"
88+
echo " - root_serial0.pem (Root CA with serial 0)"
89+
echo " - root.pem (Normal root CA)"
90+
echo " - ee_serial0.pem (End-entity with serial 0)"
91+
echo " - ee_normal.pem (Normal end-entity)"
92+
echo " - selfsigned_nonca_serial0.pem (Self-signed non-CA with serial 0)"
93+
echo ""
94+

‎certs/test-serial0/include.am‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# vim:ft=automake
2+
# included from Top Level Makefile.am
3+
# All paths should be given relative to the root
4+
5+
dist_doc_DATA+= certs/test-serial0/README.md
6+
7+
EXTRA_DIST+= certs/test-serial0/generate_certs.sh \
8+
certs/test-serial0/root_serial0.pem \
9+
certs/test-serial0/root.pem \
10+
certs/test-serial0/ee_serial0.pem \
11+
certs/test-serial0/ee_normal.pem \
12+
certs/test-serial0/selfsigned_nonca_serial0.pem
13+

0 commit comments

Comments
 (0)