2 # -*- coding: cp1251 -*-
3 # создание секретного ключа
4 # создание заявки и самоподписанного сертификата командой req
5 # проверка OIDов алгоритма во всех структурах
6 lappend auto_path [file dirname [info script]]
7 package require ossltest
9 start_tests "Создание ключей и заявок, команда genpkey"
11 if {[info exists env(ALG_LIST)]} {
12 set alg_list $env(ALG_LIST)
14 switch -exact [engine_name] {
15 "ccore" {set alg_list {gost2001:A gost2001:B gost2001:C gost2001:XA gost2001:XB gost2012_256:A gost2012_256:B gost2012_256:C gost2012_256:XA gost2012_256:XB gost2012_512:A gost2012_512:B}}
16 "open" {set alg_list {gost2001:A gost2001:B gost2001:C gost2001:XA gost2001:XB gost2012_256:0 gost2012_256:A gost2012_256:B gost2012_256:C gost2012_256:XA gost2012_256:XB gost2012_512:A gost2012_512:B}}
20 foreach alg $alg_list {
21 set alg_fn [string map {":" "_"} $alg]
22 set username pkey_$alg_fn
23 foreach {alg_only params} [split $alg :] break
25 test -createsfiles $username/seckey.pem "Секретный ключ, алгоритм $alg" {
26 file delete -force $username
28 openssl "genpkey -algorithm $alg_only -pkeyopt paramset:$params -out $username/seckey.pem"
29 expr {[file size $username/seckey.pem] > 0}
32 test -skip {![file exists $username/seckey.pem]} "OID в секретном ключе" {
33 extract_oids $username/seckey.pem
34 } 0 [mkObjList [alg_long_name $alg] [pubkey_long_name $alg] [param_hash_long_name [param_hash $alg]]]
36 test -skip {![file exists $username/seckey.pem]} "Алгоритм $alg, заявка по секретному ключу" {
37 makeFile $username/req.conf [makeConf]
38 openssl "req -new -config $username/req.conf -key $username/seckey.pem -out $username/req.pem"
39 expr {[file size $username/req.pem] > 0}
42 test -skip {![file exists $username/req.pem]} "Подпись под заявкой корректна" {
43 grep "verif" [openssl "req -verify -in $username/req.pem"]
47 test -skip {![file exists $username/req.pem]} "OID в заявке, алгоритм $alg" {
48 extract_oids $username/req.pem
49 } 0 [mkObjList [alg_long_name $alg] [pubkey_long_name $alg] [param_hash_long_name [param_hash $alg]] [hash_with_sign_long_name $alg]]
51 test -skip {![file exists $username/seckey.pem]} "Алгоритм $alg, сертификат по секретному ключу" {
52 openssl "req -new -x509 -config $username/req.conf -key $username/seckey.pem -out $username/cert.pem"
53 expr {[file size $username/cert.pem] > 0}
56 test -skip {![file exists $username/cert.pem]} "OID в сертификате" {
57 extract_oids $username/cert.pem
58 } 0 [mkObjList [hash_with_sign_long_name $alg] [alg_long_name $alg] [pubkey_long_name $alg]\
59 [param_hash_long_name [param_hash $alg]] [hash_with_sign_long_name $alg]]
61 test -createsfiles "$username/seckey.der" "Алгоритм $alg сохраняем ключ в DER-формате" {
62 openssl "genpkey -algorithm $alg_only -pkeyopt paramset:$params -out $username/seckey.der -outform DER"
63 file exists $username/seckey.der
66 test -skip {![file exists $username/seckey.der]} "OID в секретном ключе $alg DER" {
67 extract_oids $username/seckey.der DER
68 } 0 [mkObjList [alg_long_name $alg] [pubkey_long_name $alg] [param_hash_long_name [param_hash $alg]]]
70 test -skip {![file exists $username/seckey.der]} -createsfiles $username/req2.pem "Создаем заявку из ключа в формате DER" {
71 openssl "req -new -config $username/req.conf -key $username/seckey.der -keyform der -out $username/req2.pem"
72 expr {[file size $username/req2.pem] > 0}
75 test -skip {![file exists $username/req2.pem]} "Подпись под заявкой корректна" {
76 grep "verif" [openssl "req -verify -in $username/req2.pem"]