Add mock test cert generation by rajeev-0 · Pull Request #85 · siemens/gencmpclient

rajeev-0 · 2025-05-06T11:34:03Z

Motivation

Script to generate Mock certificates and keys for testing.
Added OpenSSL-3.5 test to CI test.
Added Mock test with PQ algorithm (MLDSA & SLH-DSA) using OpenSSL-3.5.

sonarqubecloud · 2025-05-08T12:32:31Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

DDvO

Nice.
Yet various small improvements.

DDvO · 2025-05-08T13:27:29Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+
+# This script generates the certificates needed for the CMP server and the signer
+
+if [[ ! -f $mkcert_sh ]]; then


Is there a concrete use case for setting mkcert_sh externally?
Otherwise I suggest dropping the guard.

I wanted to make the script flexible, but here I also don't see the benefit. I will drop the guard.

DDvO · 2025-05-08T13:28:48Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+# sever certificate algorithms
+if [ -z "$server_rootca_keyalg" ]; then
+    server_rootca_keyalg="MLDSA65"
+fi
+if [ -z "$server_leaf_keyalg" ]; then
+    server_leaf_keyalg="SLH-DSA-SHAKE-192s"
+fi
+# rootCACert update test case
+if [ -z "$new_rootca_keyalg" ]; then
+    new_rootca_keyalg="SLH-DSA-SHAKE-192s"
+fi
+
+# End-entity certificate algorithms
+if [ -z "$signer_rootca_keyalg" ]; then
+    signer_rootca_keyalg="MLDSA65"
+fi
+if [ -z "$signer_interca_keyalg" ]; then
+    signer_interca_keyalg="MLDSA65"
+fi
+if [ -z "$signer_subinterca_keyalg" ]; then
+    signer_subinterca_keyalg="MLDSA65"
+fi
+if [ -z "$signer_leaf_keyalg" ]; then
+    signer_leaf_keyalg="SLH-DSA-SHAKE-192s"
+fi


Please introduce and use a couple of script parameters, such that the script can be called

for updating the hitherto test credentials with the same classical algorithms as before (RSA)

for the given PQ tests with MLDSA65 and SLH-DSA-SHAKE-192s

for further ones, like KEM

Added only one variable "Algo_used".

DDvO · 2025-05-08T13:58:04Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+
+remove_serverfiles() {
+    echo "Removing server files"
+    rm -f server.key server-crt trusted.crt server_root.crt


typo in a file name, and better use same order as above:

Suggested change

rm -f server.key server-crt trusted.crt server_root.crt

rm -f server_root.crt trusted.crt server.key server.crt

DDvO · 2025-05-08T14:26:02Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+
+gen_servercert() {
+    remove_serverfiles
+    sleep 5


why sleep? Please comment or remove.

comment added

DDvO · 2025-05-08T14:29:31Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+    fi
+
+    gen_demoCAfolder
+    openssl ca -gencrl -keyfile signer_subinterCA-key.pem -cert signer_subinterCA-cert.pem -out signer_subinterCA-crl.pem -crldays 36525 \


Please use $DAYS after adding early in the script:

if [ -z "$DAYS" ]; then DAYS=36524 # 100 years, with 24 leap years per 100 years until 2400 fi

BTW, the 36525 in mkcert.sh typically means 1 day more than 100 years
because a leap year occurs every 4 years, but not every 100 years, but still every 400 years (i.e., in 2000, in 2400, ...)

DDvO · 2025-05-08T15:40:34Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+		      "database = ./demoCA/index.txt" "crlnumber = ./demoCA/crlnumber" "default_md = default")
+    cat signer_leaf-cert.pem signer_subinterCA-cert.pem signer_interCA-cert.pem > signer_chain.pem
+    cat signer_subinterCA-cert.pem signer_interCA-cert.pem signer_root-cert.pem > signer_fullchain.pem
+    openssl pkcs12 -export -out signer.p12 -inkey signer_leaf-key.pem -in signer_leaf-cert.pem -certfile signer_fullchain.pem -password pass:12345


Suggested change

openssl pkcs12 -export -out signer.p12 -inkey signer_leaf-key.pem -in signer_leaf-cert.pem -certfile signer_fullchain.pem -password pass:12345

openssl pkcs12 -export -out signer.p12 -inkey signer_leaf-key.pem -in signer_leaf-cert.pem -certfile signer_fullchain.pem -password file:12345.txt

DDvO · 2025-05-08T15:41:02Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+    openssl pkey -in new.key -out new_pass_12345.key -aes256 -passout pass:12345
+    echo "12345" > 12345.txt


Suggested change

openssl pkey -in new.key -out new_pass_12345.key -aes256 -passout pass:12345

echo "12345" > 12345.txt

openssl pkey -in new.key -out new_pass_12345.key -aes256 -passout file:12345.txt

DDvO · 2025-05-08T15:45:09Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+    new_rootca_keyalg="SLH-DSA-SHAKE-192s"
+fi
+
+# End-entity certificate algorithms


Suggested change

# End-entity certificate algorithms

# algorithms for client certificate chain

DDvO · 2025-05-08T15:46:00Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+    gen_servercert
+    gen_signercert


Suggested change

gen_servercert

gen_signercert

gen_server_chain

gen_client_chain

DDvO · 2025-05-08T15:47:45Z

test/certs/mkcert.sh

@@ -0,0 +1,417 @@
+#! /bin/bash


Please mark in the file the part(s) adapted, or was an unchanged copy sufficient?

Added comment in line 59, to enable PQ algorithms.

DDvO · 2025-05-09T05:59:31Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+    openssl pkey -in new.key -out new_pass_12345.key -aes256 -passout pass:12345
+    echo "12345" > 12345.txt
+    cp new.key signer.key
+    mv signer_leaf-cert.pem signer_only.crt


Please add a further signer cert with NULL-DN subject and without a subjectKeyIdentifier,
which will be needed in a new test case on senderKID.
If there is no simple way of using for this case mkcert_sh genee, you can also use:

openssl x509 -new -subj "/" -days $DAYS -extfile <(printf "subjectKeyIdentifier=none") -out signer_no_SKID.crt -key signer.key

DDvO · 2025-09-22T17:57:59Z

Please also add a run of make -f Makefile_v1 test_Mock when build with OpenSSL 3.5 (where all test cases are enabled since all new CMP features are present).

sonarqubecloud · 2025-10-08T12:38:35Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

setup-Mock.sh: add files for rootCaCert test setup-mock.sh: option to set variables from cli

….pem

rajeev-0

Updated as per comment.

rajeev-0 · 2026-02-02T16:55:32Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+
+# This script generates the certificates needed for the CMP server and the signer
+
+if [[ ! -f $mkcert_sh ]]; then


I wanted to make the script flexible, but here I also don't see the benefit. I will drop the guard.

rajeev-0 · 2026-02-03T14:25:25Z

test/certs/mkcert.sh

@@ -0,0 +1,417 @@
+#! /bin/bash


Added comment in line 59, to enable PQ algorithms.

rajeev-0 · 2026-02-03T14:26:27Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+# CMP server certificate
+rename_serverfiles() {
+    echo "Renaming server files"
+    rm server_root-key.pem server_root-pubkey.pem newWithNew-key.pem newWithNew-pubkey.pem


IMO, wherever possible its better to remove it a central location incase it is needed in future.

rajeev-0 · 2026-02-03T14:26:38Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+
+gen_servercert() {
+    remove_serverfiles
+    sleep 5


comment added

rajeev-0 · 2026-02-03T14:41:25Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+    rm -f signer_root-key.pem signer_interCA-key.pem signer_interCA-cert.pem \
+        signer_subinterCA-key.pem
+    mv signer_subinterCA-cert.pem issuing.crt
+    mv signer_subinterCA-crl.pem newcrl.pem


Updated it to crl.der

rajeev-0 · 2026-02-03T15:23:23Z

test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh

+    gen_demoCAfolder
+    openssl ca -gencrl -keyfile signer_subinterCA-key.pem -cert signer_subinterCA-cert.pem -out signer_subinterCA-crl.pem -crldays 36525 \
+            -config <(printf "[ca]\ndefault_ca= CA_default\n[CA_default]\n%s\n%s\n%s\n" \
+		      "database = ./demoCA/index.txt" "crlnumber = ./demoCA/crlnumber" "default_md = default")


It is part of client credentials and I don't like the idea of creating a function for one line command.

sonarqubecloud · 2026-02-04T09:17:26Z

Quality Gate passed

Issues
42 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

rajeev-0 force-pushed the add_MockTest_cert_generation branch 3 times, most recently from 359b5dc to 57c3c4b Compare May 8, 2025 12:31

rajeev-0 marked this pull request as ready for review May 8, 2025 12:36

rajeev-0 requested a review from DDvO May 8, 2025 12:37

DDvO requested changes May 8, 2025

View reviewed changes

DDvO reviewed May 9, 2025

View reviewed changes

rajeev-0 force-pushed the add_MockTest_cert_generation branch from 57c3c4b to ba840da Compare October 8, 2025 12:36

rajeev-0 added 3 commits February 2, 2026 14:53

add mkcert.sh

5be1a30

add MLDSA*, MLKEM* and SLH-DSA-* algorithm for key generation

16884df

add setup-mock.sh

ff44105

setup-Mock.sh: add files for rootCaCert test setup-mock.sh: option to set variables from cli

rajeev-0 force-pushed the add_MockTest_cert_generation branch from ba840da to 963edeb Compare February 2, 2026 14:17

rajeev-0 added 3 commits February 3, 2026 15:18

test_commands.csv: fix casing- replace oldwithold.pem with oldWithOld…

999358e

….pem

fixup! add setup-mock.sh

90fa26d

test.cnf: add workaround for EJBCA* environment varaible

e206092

rajeev-0 force-pushed the add_MockTest_cert_generation branch from c50937a to e206092 Compare February 3, 2026 14:18

rajeev-0 added 4 commits February 3, 2026 15:23

fixup! add MLDSA*, MLKEM* and SLH-DSA-* algorithm for key generation

8170cdf

fixup! fixup! add setup-mock.sh

7408888

remove unused big_server.crt

817d569

OpenSSL_version.yml: Add test for master branch

6c38d40

rajeev-0 commented Feb 3, 2026

View reviewed changes

rajeev-0 and others added 5 commits February 3, 2026 17:15

add OpenSSL_master-PQC workflow

994dabb

fixup! OpenSSL_version.yml: Add test for master branch

a97ae64

fixup! add OpenSSL_master-PQC workflow

e796eb2

Update OpenSSL_master-PQC.yml

4e8cddb

update OpenSSL master workflow

35a8f6a


		# This script generates the certificates needed for the CMP server and the signer

		if [[ ! -f $mkcert_sh ]]; then

	rm -f server.key server-crt trusted.crt server_root.crt
	rm -f server_root.crt trusted.crt server.key server.crt

	openssl pkcs12 -export -out signer.p12 -inkey signer_leaf-key.pem -in signer_leaf-cert.pem -certfile signer_fullchain.pem -password pass:12345
	openssl pkcs12 -export -out signer.p12 -inkey signer_leaf-key.pem -in signer_leaf-cert.pem -certfile signer_fullchain.pem -password file:12345.txt

		openssl pkey -in new.key -out new_pass_12345.key -aes256 -passout pass:12345
		echo "12345" > 12345.txt

	# End-entity certificate algorithms
	# algorithms for client certificate chain

Conversation

rajeev-0 commented May 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Uh oh!

sonarqubecloud bot commented May 8, 2025

Quality Gate passed

Uh oh!

DDvO left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DDvO May 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DDvO May 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DDvO commented Sep 22, 2025

Uh oh!

sonarqubecloud bot commented Oct 8, 2025

Quality Gate passed

Uh oh!

rajeev-0 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Feb 4, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rajeev-0 commented May 6, 2025 •

edited

Loading

DDvO May 8, 2025 •

edited

Loading

DDvO May 9, 2025 •

edited

Loading