Function TestRevokedCert

security/advancedtls/crl_test.go:356–454

(t *testing.T)

}

func TestRevokedCert(t *testing.T) {
	revokedIntChain := makeChain(t, testdata.Path("crl/revokedInt.pem"))
	revokedLeafChain := makeChain(t, testdata.Path("crl/revokedLeaf.pem"))
	validChain := makeChain(t, testdata.Path("crl/unrevoked.pem"))
	rawCRLs := make([][]byte, 6)
	for i := 1; i <= 6; i++ {
		rawCRL, err := os.ReadFile(testdata.Path(fmt.Sprintf("crl/%d.crl", i)))
		if err != nil {
			t.Fatalf("readFile(%v) failed err = %v", fmt.Sprintf("crl/%d.crl", i), err)
		}
		rawCRLs = append(rawCRLs, rawCRL)
	}
	staticCRLProvider := NewStaticCRLProvider(rawCRLs)
	directoryCRLProvider, err := NewFileWatcherCRLProvider(FileWatcherOptions{CRLDirectory: testdata.Path("crl")})
	if err != nil {
		t.Fatalf("NewFileWatcherCRLProvider: err = %v", err)
	}
	defer directoryCRLProvider.Close()

	var revocationTests = []struct {
		desc             string
		in               tls.ConnectionState
		revoked          bool
		denyUndetermined bool
	}{
		{
			desc:    "Single unrevoked",
			in:      tls.ConnectionState{VerifiedChains: [][]*x509.Certificate{validChain}},
			revoked: false,
		},
		{
			desc:    "Single revoked intermediate",
			in:      tls.ConnectionState{VerifiedChains: [][]*x509.Certificate{revokedIntChain}},
			revoked: true,
		},
		{
			desc:    "Single revoked leaf",
			in:      tls.ConnectionState{VerifiedChains: [][]*x509.Certificate{revokedLeafChain}},
			revoked: true,
		},
		{
			desc:    "Multi one revoked",
			in:      tls.ConnectionState{VerifiedChains: [][]*x509.Certificate{validChain, revokedLeafChain}},
			revoked: false,
		},
		{
			desc:    "Multi revoked",
			in:      tls.ConnectionState{VerifiedChains: [][]*x509.Certificate{revokedLeafChain, revokedIntChain}},
			revoked: true,
		},
		{
			desc:    "Multi unrevoked",
			in:      tls.ConnectionState{VerifiedChains: [][]*x509.Certificate{validChain, validChain}},
			revoked: false,
		},
		{
			desc: "Undetermined revoked",
			in: tls.ConnectionState{VerifiedChains: [][]*x509.Certificate{