1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include <cert.h> 6 #include <certdb.h> 7 #include <pk11pub.h> 8 9 #include <algorithm> 10 11 #include "base/bind.h" 12 #include "base/file_util.h" 13 #include "base/files/file_path.h" 14 #include "base/lazy_instance.h" 15 #include "base/message_loop/message_loop.h" 16 #include "base/message_loop/message_loop_proxy.h" 17 #include "base/path_service.h" 18 #include "base/run_loop.h" 19 #include "base/strings/string16.h" 20 #include "base/strings/string_util.h" 21 #include "base/strings/utf_string_conversions.h" 22 #include "crypto/nss_util.h" 23 #include "crypto/nss_util_internal.h" 24 #include "crypto/scoped_nss_types.h" 25 #include "net/base/crypto_module.h" 26 #include "net/base/net_errors.h" 27 #include "net/base/test_data_directory.h" 28 #include "net/cert/cert_status_flags.h" 29 #include "net/cert/cert_verify_proc_nss.h" 30 #include "net/cert/cert_verify_result.h" 31 #include "net/cert/nss_cert_database.h" 32 #include "net/cert/x509_certificate.h" 33 #include "net/test/cert_test_util.h" 34 #include "net/third_party/mozilla_security_manager/nsNSSCertificateDB.h" 35 #include "testing/gtest/include/gtest/gtest.h" 36 37 // In NSS 3.13, CERTDB_VALID_PEER was renamed CERTDB_TERMINAL_RECORD. So we use 38 // the new name of the macro. 39 #if !defined(CERTDB_TERMINAL_RECORD) 40 #define CERTDB_TERMINAL_RECORD CERTDB_VALID_PEER 41 #endif 42 43 using base::ASCIIToUTF16; 44 45 namespace net { 46 47 namespace { 48 49 void SwapCertList(CertificateList* destination, 50 scoped_ptr<CertificateList> source) { 51 ASSERT_TRUE(destination); 52 destination->swap(*source); 53 } 54 55 } // namespace 56 57 class CertDatabaseNSSTest : public testing::Test { 58 public: 59 virtual void SetUp() { 60 ASSERT_TRUE(test_nssdb_.is_open()); 61 cert_db_ = NSSCertDatabase::GetInstance(); 62 slot_ = cert_db_->GetPublicModule(); 63 64 // Test db should be empty at start of test. 65 EXPECT_EQ(0U, ListCertsInSlot(slot_->os_module_handle()).size()); 66 } 67 68 virtual void TearDown() { 69 // Don't try to cleanup if the setup failed. 70 ASSERT_TRUE(slot_->os_module_handle()); 71 72 EXPECT_TRUE(CleanupSlotContents()); 73 74 // Run the message loop to process any observer callbacks (e.g. for the 75 // ClientSocketFactory singleton) so that the scoped ref ptrs created in 76 // NSSCertDatabase::NotifyObservers* get released. 77 base::MessageLoop::current()->RunUntilIdle(); 78 79 EXPECT_EQ(0U, ListCertsInSlot(slot_->os_module_handle()).size()); 80 } 81 82 protected: 83 static std::string ReadTestFile(const std::string& name) { 84 std::string result; 85 base::FilePath cert_path = GetTestCertsDirectory().AppendASCII(name); 86 EXPECT_TRUE(base::ReadFileToString(cert_path, &result)); 87 return result; 88 } 89 90 static bool ReadCertIntoList(const std::string& name, 91 CertificateList* certs) { 92 scoped_refptr<X509Certificate> cert( 93 ImportCertFromFile(GetTestCertsDirectory(), name)); 94 if (!cert.get()) 95 return false; 96 97 certs->push_back(cert); 98 return true; 99 } 100 101 static CertificateList ListCertsInSlot(PK11SlotInfo* slot) { 102 CertificateList result; 103 CERTCertList* cert_list = PK11_ListCertsInSlot(slot); 104 for (CERTCertListNode* node = CERT_LIST_HEAD(cert_list); 105 !CERT_LIST_END(node, cert_list); 106 node = CERT_LIST_NEXT(node)) { 107 result.push_back(X509Certificate::CreateFromHandle( 108 node->cert, X509Certificate::OSCertHandles())); 109 } 110 CERT_DestroyCertList(cert_list); 111 112 // Sort the result so that test comparisons can be deterministic. 113 std::sort(result.begin(), result.end(), X509Certificate::LessThan()); 114 return result; 115 } 116 117 scoped_refptr<CryptoModule> slot_; 118 NSSCertDatabase* cert_db_; 119 const CertificateList empty_cert_list_; 120 121 private: 122 bool CleanupSlotContents() { 123 bool ok = true; 124 CertificateList certs = ListCertsInSlot(slot_->os_module_handle()); 125 CERTCertTrust default_trust = {0}; 126 for (size_t i = 0; i < certs.size(); ++i) { 127 // Reset cert trust values to defaults before deleting. Otherwise NSS 128 // somehow seems to remember the trust which can break following tests. 129 SECStatus srv = CERT_ChangeCertTrust( 130 CERT_GetDefaultCertDB(), certs[i]->os_cert_handle(), &default_trust); 131 if (srv != SECSuccess) 132 ok = false; 133 134 if (!cert_db_->DeleteCertAndKey(certs[i].get())) 135 ok = false; 136 } 137 return ok; 138 } 139 140 crypto::ScopedTestNSSDB test_nssdb_; 141 }; 142 143 TEST_F(CertDatabaseNSSTest, ListCertsSync) { 144 // This test isn't terribly useful, though it will at least let valgrind test 145 // for leaks. 146 CertificateList certs; 147 cert_db_->ListCertsSync(&certs); 148 // The test DB is empty, but let's assume there will always be something in 149 // the other slots. 150 EXPECT_LT(0U, certs.size()); 151 } 152 153 TEST_F(CertDatabaseNSSTest, ListCerts) { 154 // This test isn't terribly useful, though it will at least let valgrind test 155 // for leaks. 156 CertificateList certs; 157 cert_db_->SetSlowTaskRunnerForTest(base::MessageLoopProxy::current()); 158 cert_db_->ListCerts(base::Bind(&SwapCertList, base::Unretained(&certs))); 159 EXPECT_EQ(0U, certs.size()); 160 161 base::RunLoop().RunUntilIdle(); 162 163 // The test DB is empty, but let's assume there will always be something in 164 // the other slots. 165 EXPECT_LT(0U, certs.size()); 166 } 167 168 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12WrongPassword) { 169 std::string pkcs12_data = ReadTestFile("client.p12"); 170 171 EXPECT_EQ(ERR_PKCS12_IMPORT_BAD_PASSWORD, 172 cert_db_->ImportFromPKCS12(slot_.get(), 173 pkcs12_data, 174 base::string16(), 175 true, // is_extractable 176 NULL)); 177 178 // Test db should still be empty. 179 EXPECT_EQ(0U, ListCertsInSlot(slot_->os_module_handle()).size()); 180 } 181 182 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12AsExtractableAndExportAgain) { 183 std::string pkcs12_data = ReadTestFile("client.p12"); 184 185 EXPECT_EQ(OK, 186 cert_db_->ImportFromPKCS12(slot_.get(), 187 pkcs12_data, 188 ASCIIToUTF16("12345"), 189 true, // is_extractable 190 NULL)); 191 192 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); 193 ASSERT_EQ(1U, cert_list.size()); 194 scoped_refptr<X509Certificate> cert(cert_list[0]); 195 196 EXPECT_EQ("testusercert", 197 cert->subject().common_name); 198 199 // TODO(mattm): move export test to separate test case? 200 std::string exported_data; 201 EXPECT_EQ(1, cert_db_->ExportToPKCS12(cert_list, ASCIIToUTF16("exportpw"), 202 &exported_data)); 203 ASSERT_LT(0U, exported_data.size()); 204 // TODO(mattm): further verification of exported data? 205 } 206 207 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12Twice) { 208 std::string pkcs12_data = ReadTestFile("client.p12"); 209 210 EXPECT_EQ(OK, 211 cert_db_->ImportFromPKCS12(slot_.get(), 212 pkcs12_data, 213 ASCIIToUTF16("12345"), 214 true, // is_extractable 215 NULL)); 216 EXPECT_EQ(1U, ListCertsInSlot(slot_->os_module_handle()).size()); 217 218 // NSS has a SEC_ERROR_PKCS12_DUPLICATE_DATA error, but it doesn't look like 219 // it's ever used. This test verifies that. 220 EXPECT_EQ(OK, 221 cert_db_->ImportFromPKCS12(slot_.get(), 222 pkcs12_data, 223 ASCIIToUTF16("12345"), 224 true, // is_extractable 225 NULL)); 226 EXPECT_EQ(1U, ListCertsInSlot(slot_->os_module_handle()).size()); 227 } 228 229 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12AsUnextractableAndExportAgain) { 230 std::string pkcs12_data = ReadTestFile("client.p12"); 231 232 EXPECT_EQ(OK, 233 cert_db_->ImportFromPKCS12(slot_.get(), 234 pkcs12_data, 235 ASCIIToUTF16("12345"), 236 false, // is_extractable 237 NULL)); 238 239 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); 240 ASSERT_EQ(1U, cert_list.size()); 241 scoped_refptr<X509Certificate> cert(cert_list[0]); 242 243 EXPECT_EQ("testusercert", 244 cert->subject().common_name); 245 246 std::string exported_data; 247 EXPECT_EQ(0, cert_db_->ExportToPKCS12(cert_list, ASCIIToUTF16("exportpw"), 248 &exported_data)); 249 } 250 251 // Importing a PKCS#12 file with a certificate but no corresponding 252 // private key should not mark an existing private key as unextractable. 253 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12OnlyMarkIncludedKey) { 254 std::string pkcs12_data = ReadTestFile("client.p12"); 255 EXPECT_EQ(OK, 256 cert_db_->ImportFromPKCS12(slot_.get(), 257 pkcs12_data, 258 ASCIIToUTF16("12345"), 259 true, // is_extractable 260 NULL)); 261 262 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); 263 ASSERT_EQ(1U, cert_list.size()); 264 265 // Now import a PKCS#12 file with just a certificate but no private key. 266 pkcs12_data = ReadTestFile("client-nokey.p12"); 267 EXPECT_EQ(OK, 268 cert_db_->ImportFromPKCS12(slot_.get(), 269 pkcs12_data, 270 ASCIIToUTF16("12345"), 271 false, // is_extractable 272 NULL)); 273 274 cert_list = ListCertsInSlot(slot_->os_module_handle()); 275 ASSERT_EQ(1U, cert_list.size()); 276 277 // Make sure the imported private key is still extractable. 278 std::string exported_data; 279 EXPECT_EQ(1, cert_db_->ExportToPKCS12(cert_list, ASCIIToUTF16("exportpw"), 280 &exported_data)); 281 ASSERT_LT(0U, exported_data.size()); 282 } 283 284 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12InvalidFile) { 285 std::string pkcs12_data = "Foobarbaz"; 286 287 EXPECT_EQ(ERR_PKCS12_IMPORT_INVALID_FILE, 288 cert_db_->ImportFromPKCS12(slot_.get(), 289 pkcs12_data, 290 base::string16(), 291 true, // is_extractable 292 NULL)); 293 294 // Test db should still be empty. 295 EXPECT_EQ(0U, ListCertsInSlot(slot_->os_module_handle()).size()); 296 } 297 298 TEST_F(CertDatabaseNSSTest, ImportCACert_SSLTrust) { 299 CertificateList certs = CreateCertificateListFromFile( 300 GetTestCertsDirectory(), "root_ca_cert.pem", 301 X509Certificate::FORMAT_AUTO); 302 ASSERT_EQ(1U, certs.size()); 303 EXPECT_FALSE(certs[0]->os_cert_handle()->isperm); 304 305 // Import it. 306 NSSCertDatabase::ImportCertFailureList failed; 307 EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUSTED_SSL, 308 &failed)); 309 310 EXPECT_EQ(0U, failed.size()); 311 312 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); 313 ASSERT_EQ(1U, cert_list.size()); 314 scoped_refptr<X509Certificate> cert(cert_list[0]); 315 EXPECT_EQ("Test Root CA", cert->subject().common_name); 316 317 EXPECT_EQ(NSSCertDatabase::TRUSTED_SSL, 318 cert_db_->GetCertTrust(cert.get(), CA_CERT)); 319 320 EXPECT_EQ(unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | 321 CERTDB_TRUSTED_CLIENT_CA), 322 cert->os_cert_handle()->trust->sslFlags); 323 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 324 cert->os_cert_handle()->trust->emailFlags); 325 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 326 cert->os_cert_handle()->trust->objectSigningFlags); 327 } 328 329 TEST_F(CertDatabaseNSSTest, ImportCACert_EmailTrust) { 330 CertificateList certs = CreateCertificateListFromFile( 331 GetTestCertsDirectory(), "root_ca_cert.pem", 332 X509Certificate::FORMAT_AUTO); 333 ASSERT_EQ(1U, certs.size()); 334 EXPECT_FALSE(certs[0]->os_cert_handle()->isperm); 335 336 // Import it. 337 NSSCertDatabase::ImportCertFailureList failed; 338 EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUSTED_EMAIL, 339 &failed)); 340 341 EXPECT_EQ(0U, failed.size()); 342 343 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); 344 ASSERT_EQ(1U, cert_list.size()); 345 scoped_refptr<X509Certificate> cert(cert_list[0]); 346 EXPECT_EQ("Test Root CA", cert->subject().common_name); 347 348 EXPECT_EQ(NSSCertDatabase::TRUSTED_EMAIL, 349 cert_db_->GetCertTrust(cert.get(), CA_CERT)); 350 351 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 352 cert->os_cert_handle()->trust->sslFlags); 353 EXPECT_EQ(unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | 354 CERTDB_TRUSTED_CLIENT_CA), 355 cert->os_cert_handle()->trust->emailFlags); 356 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 357 cert->os_cert_handle()->trust->objectSigningFlags); 358 } 359 360 TEST_F(CertDatabaseNSSTest, ImportCACert_ObjSignTrust) { 361 CertificateList certs = CreateCertificateListFromFile( 362 GetTestCertsDirectory(), "root_ca_cert.pem", 363 X509Certificate::FORMAT_AUTO); 364 ASSERT_EQ(1U, certs.size()); 365 EXPECT_FALSE(certs[0]->os_cert_handle()->isperm); 366 367 // Import it. 368 NSSCertDatabase::ImportCertFailureList failed; 369 EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUSTED_OBJ_SIGN, 370 &failed)); 371 372 EXPECT_EQ(0U, failed.size()); 373 374 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); 375 ASSERT_EQ(1U, cert_list.size()); 376 scoped_refptr<X509Certificate> cert(cert_list[0]); 377 EXPECT_EQ("Test Root CA", cert->subject().common_name); 378 379 EXPECT_EQ(NSSCertDatabase::TRUSTED_OBJ_SIGN, 380 cert_db_->GetCertTrust(cert.get(), CA_CERT)); 381 382 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 383 cert->os_cert_handle()->trust->sslFlags); 384 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 385 cert->os_cert_handle()->trust->emailFlags); 386 EXPECT_EQ(unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | 387 CERTDB_TRUSTED_CLIENT_CA), 388 cert->os_cert_handle()->trust->objectSigningFlags); 389 } 390 391 TEST_F(CertDatabaseNSSTest, ImportCA_NotCACert) { 392 CertificateList certs = CreateCertificateListFromFile( 393 GetTestCertsDirectory(), "ok_cert.pem", 394 X509Certificate::FORMAT_AUTO); 395 ASSERT_EQ(1U, certs.size()); 396 EXPECT_FALSE(certs[0]->os_cert_handle()->isperm); 397 398 // Import it. 399 NSSCertDatabase::ImportCertFailureList failed; 400 EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUSTED_SSL, 401 &failed)); 402 ASSERT_EQ(1U, failed.size()); 403 // Note: this compares pointers directly. It's okay in this case because 404 // ImportCACerts returns the same pointers that were passed in. In the 405 // general case IsSameOSCert should be used. 406 EXPECT_EQ(certs[0], failed[0].certificate); 407 EXPECT_EQ(ERR_IMPORT_CA_CERT_NOT_CA, failed[0].net_error); 408 409 EXPECT_EQ(0U, ListCertsInSlot(slot_->os_module_handle()).size()); 410 } 411 412 TEST_F(CertDatabaseNSSTest, ImportCACertHierarchy) { 413 CertificateList certs; 414 ASSERT_TRUE(ReadCertIntoList("dod_root_ca_2_cert.der", &certs)); 415 ASSERT_TRUE(ReadCertIntoList("dod_ca_17_cert.der", &certs)); 416 ASSERT_TRUE(ReadCertIntoList("www_us_army_mil_cert.der", &certs)); 417 418 // Import it. 419 NSSCertDatabase::ImportCertFailureList failed; 420 // Have to specify email trust for the cert verification of the child cert to 421 // work (see 422 // http://mxr.mozilla.org/mozilla/source/security/nss/lib/certhigh/certvfy.c#752 423 // "XXX This choice of trustType seems arbitrary.") 424 EXPECT_TRUE(cert_db_->ImportCACerts( 425 certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL, 426 &failed)); 427 428 ASSERT_EQ(2U, failed.size()); 429 EXPECT_EQ("DOD CA-17", failed[0].certificate->subject().common_name); 430 EXPECT_EQ(ERR_FAILED, failed[0].net_error); // The certificate expired. 431 EXPECT_EQ("www.us.army.mil", failed[1].certificate->subject().common_name); 432 EXPECT_EQ(ERR_IMPORT_CA_CERT_NOT_CA, failed[1].net_error); 433 434 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); 435 ASSERT_EQ(1U, cert_list.size()); 436 EXPECT_EQ("DoD Root CA 2", cert_list[0]->subject().common_name); 437 } 438 439 TEST_F(CertDatabaseNSSTest, ImportCACertHierarchyDupeRoot) { 440 CertificateList certs; 441 ASSERT_TRUE(ReadCertIntoList("dod_root_ca_2_cert.der", &certs)); 442 443 // First import just the root. 444 NSSCertDatabase::ImportCertFailureList failed; 445 EXPECT_TRUE(cert_db_->ImportCACerts( 446 certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL, 447 &failed)); 448 449 EXPECT_EQ(0U, failed.size()); 450 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); 451 ASSERT_EQ(1U, cert_list.size()); 452 EXPECT_EQ("DoD Root CA 2", cert_list[0]->subject().common_name); 453 454 ASSERT_TRUE(ReadCertIntoList("dod_ca_17_cert.der", &certs)); 455 ASSERT_TRUE(ReadCertIntoList("www_us_army_mil_cert.der", &certs)); 456 457 // Now import with the other certs in the list too. Even though the root is 458 // already present, we should still import the rest. 459 failed.clear(); 460 EXPECT_TRUE(cert_db_->ImportCACerts( 461 certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL, 462 &failed)); 463 464 ASSERT_EQ(3U, failed.size()); 465 EXPECT_EQ("DoD Root CA 2", failed[0].certificate->subject().common_name); 466 EXPECT_EQ(ERR_IMPORT_CERT_ALREADY_EXISTS, failed[0].net_error); 467 EXPECT_EQ("DOD CA-17", failed[1].certificate->subject().common_name); 468 EXPECT_EQ(ERR_FAILED, failed[1].net_error); // The certificate expired. 469 EXPECT_EQ("www.us.army.mil", failed[2].certificate->subject().common_name); 470 EXPECT_EQ(ERR_IMPORT_CA_CERT_NOT_CA, failed[2].net_error); 471 472 cert_list = ListCertsInSlot(slot_->os_module_handle()); 473 ASSERT_EQ(1U, cert_list.size()); 474 EXPECT_EQ("DoD Root CA 2", cert_list[0]->subject().common_name); 475 } 476 477 TEST_F(CertDatabaseNSSTest, ImportCACertHierarchyUntrusted) { 478 CertificateList certs; 479 ASSERT_TRUE(ReadCertIntoList("dod_root_ca_2_cert.der", &certs)); 480 ASSERT_TRUE(ReadCertIntoList("dod_ca_17_cert.der", &certs)); 481 482 // Import it. 483 NSSCertDatabase::ImportCertFailureList failed; 484 EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUST_DEFAULT, 485 &failed)); 486 487 ASSERT_EQ(1U, failed.size()); 488 EXPECT_EQ("DOD CA-17", failed[0].certificate->subject().common_name); 489 // TODO(mattm): should check for net error equivalent of 490 // SEC_ERROR_UNTRUSTED_ISSUER 491 EXPECT_EQ(ERR_FAILED, failed[0].net_error); 492 493 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); 494 ASSERT_EQ(1U, cert_list.size()); 495 EXPECT_EQ("DoD Root CA 2", cert_list[0]->subject().common_name); 496 } 497 498 TEST_F(CertDatabaseNSSTest, ImportCACertHierarchyTree) { 499 CertificateList certs; 500 ASSERT_TRUE(ReadCertIntoList("dod_root_ca_2_cert.der", &certs)); 501 ASSERT_TRUE(ReadCertIntoList("dod_ca_13_cert.der", &certs)); 502 ASSERT_TRUE(ReadCertIntoList("dod_ca_17_cert.der", &certs)); 503 504 // Import it. 505 NSSCertDatabase::ImportCertFailureList failed; 506 EXPECT_TRUE(cert_db_->ImportCACerts( 507 certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL, 508 &failed)); 509 510 EXPECT_EQ(2U, failed.size()); 511 EXPECT_EQ("DOD CA-13", failed[0].certificate->subject().common_name); 512 EXPECT_EQ(ERR_FAILED, failed[0].net_error); // The certificate expired. 513 EXPECT_EQ("DOD CA-17", failed[1].certificate->subject().common_name); 514 EXPECT_EQ(ERR_FAILED, failed[1].net_error); // The certificate expired. 515 516 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); 517 ASSERT_EQ(1U, cert_list.size()); 518 EXPECT_EQ("DoD Root CA 2", cert_list[0]->subject().common_name); 519 } 520 521 TEST_F(CertDatabaseNSSTest, ImportCACertNotHierarchy) { 522 CertificateList certs = CreateCertificateListFromFile( 523 GetTestCertsDirectory(), "root_ca_cert.pem", 524 X509Certificate::FORMAT_AUTO); 525 ASSERT_EQ(1U, certs.size()); 526 ASSERT_TRUE(ReadCertIntoList("dod_ca_13_cert.der", &certs)); 527 ASSERT_TRUE(ReadCertIntoList("dod_ca_17_cert.der", &certs)); 528 529 // Import it. 530 NSSCertDatabase::ImportCertFailureList failed; 531 EXPECT_TRUE(cert_db_->ImportCACerts( 532 certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL | 533 NSSCertDatabase::TRUSTED_OBJ_SIGN, &failed)); 534 535 ASSERT_EQ(2U, failed.size()); 536 // TODO(mattm): should check for net error equivalent of 537 // SEC_ERROR_UNKNOWN_ISSUER 538 EXPECT_EQ("DOD CA-13", failed[0].certificate->subject().common_name); 539 EXPECT_EQ(ERR_FAILED, failed[0].net_error); 540 EXPECT_EQ("DOD CA-17", failed[1].certificate->subject().common_name); 541 EXPECT_EQ(ERR_FAILED, failed[1].net_error); 542 543 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); 544 ASSERT_EQ(1U, cert_list.size()); 545 EXPECT_EQ("Test Root CA", cert_list[0]->subject().common_name); 546 } 547 548 // http://crbug.com/108009 - Disabled, as google.chain.pem is an expired 549 // certificate. 550 TEST_F(CertDatabaseNSSTest, DISABLED_ImportServerCert) { 551 // Need to import intermediate cert for the verify of google cert, otherwise 552 // it will try to fetch it automatically with cert_pi_useAIACertFetch, which 553 // will cause OCSPCreateSession on the main thread, which is not allowed. 554 CertificateList certs = CreateCertificateListFromFile( 555 GetTestCertsDirectory(), "google.chain.pem", 556 X509Certificate::FORMAT_AUTO); 557 ASSERT_EQ(2U, certs.size()); 558 559 NSSCertDatabase::ImportCertFailureList failed; 560 EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT, 561 &failed)); 562 563 EXPECT_EQ(0U, failed.size()); 564 565 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); 566 ASSERT_EQ(2U, cert_list.size()); 567 scoped_refptr<X509Certificate> goog_cert(cert_list[0]); 568 scoped_refptr<X509Certificate> thawte_cert(cert_list[1]); 569 EXPECT_EQ("www.google.com", goog_cert->subject().common_name); 570 EXPECT_EQ("Thawte SGC CA", thawte_cert->subject().common_name); 571 572 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 573 cert_db_->GetCertTrust(goog_cert.get(), SERVER_CERT)); 574 575 EXPECT_EQ(0U, goog_cert->os_cert_handle()->trust->sslFlags); 576 577 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 578 int flags = 0; 579 CertVerifyResult verify_result; 580 int error = verify_proc->Verify(goog_cert.get(), 581 "www.google.com", 582 flags, 583 NULL, 584 empty_cert_list_, 585 &verify_result); 586 EXPECT_EQ(OK, error); 587 EXPECT_EQ(0U, verify_result.cert_status); 588 } 589 590 TEST_F(CertDatabaseNSSTest, ImportServerCert_SelfSigned) { 591 CertificateList certs; 592 ASSERT_TRUE(ReadCertIntoList("punycodetest.der", &certs)); 593 594 NSSCertDatabase::ImportCertFailureList failed; 595 EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT, 596 &failed)); 597 598 EXPECT_EQ(0U, failed.size()); 599 600 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); 601 ASSERT_EQ(1U, cert_list.size()); 602 scoped_refptr<X509Certificate> puny_cert(cert_list[0]); 603 604 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 605 cert_db_->GetCertTrust(puny_cert.get(), SERVER_CERT)); 606 EXPECT_EQ(0U, puny_cert->os_cert_handle()->trust->sslFlags); 607 608 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 609 int flags = 0; 610 CertVerifyResult verify_result; 611 int error = verify_proc->Verify(puny_cert.get(), 612 "xn--wgv71a119e.com", 613 flags, 614 NULL, 615 empty_cert_list_, 616 &verify_result); 617 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); 618 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status); 619 } 620 621 TEST_F(CertDatabaseNSSTest, ImportServerCert_SelfSigned_Trusted) { 622 CertificateList certs; 623 ASSERT_TRUE(ReadCertIntoList("punycodetest.der", &certs)); 624 625 NSSCertDatabase::ImportCertFailureList failed; 626 EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUSTED_SSL, 627 &failed)); 628 629 EXPECT_EQ(0U, failed.size()); 630 631 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); 632 ASSERT_EQ(1U, cert_list.size()); 633 scoped_refptr<X509Certificate> puny_cert(cert_list[0]); 634 635 EXPECT_EQ(NSSCertDatabase::TRUSTED_SSL, 636 cert_db_->GetCertTrust(puny_cert.get(), SERVER_CERT)); 637 EXPECT_EQ(unsigned(CERTDB_TRUSTED | CERTDB_TERMINAL_RECORD), 638 puny_cert->os_cert_handle()->trust->sslFlags); 639 640 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 641 int flags = 0; 642 CertVerifyResult verify_result; 643 int error = verify_proc->Verify(puny_cert.get(), 644 "xn--wgv71a119e.com", 645 flags, 646 NULL, 647 empty_cert_list_, 648 &verify_result); 649 EXPECT_EQ(OK, error); 650 EXPECT_EQ(0U, verify_result.cert_status); 651 } 652 653 TEST_F(CertDatabaseNSSTest, ImportCaAndServerCert) { 654 CertificateList ca_certs = CreateCertificateListFromFile( 655 GetTestCertsDirectory(), "root_ca_cert.pem", 656 X509Certificate::FORMAT_AUTO); 657 ASSERT_EQ(1U, ca_certs.size()); 658 659 // Import CA cert and trust it. 660 NSSCertDatabase::ImportCertFailureList failed; 661 EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::TRUSTED_SSL, 662 &failed)); 663 EXPECT_EQ(0U, failed.size()); 664 665 CertificateList certs = CreateCertificateListFromFile( 666 GetTestCertsDirectory(), "ok_cert.pem", 667 X509Certificate::FORMAT_AUTO); 668 ASSERT_EQ(1U, certs.size()); 669 670 // Import server cert with default trust. 671 EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT, 672 &failed)); 673 EXPECT_EQ(0U, failed.size()); 674 675 // Server cert should verify. 676 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 677 int flags = 0; 678 CertVerifyResult verify_result; 679 int error = verify_proc->Verify(certs[0].get(), 680 "127.0.0.1", 681 flags, 682 NULL, 683 empty_cert_list_, 684 &verify_result); 685 EXPECT_EQ(OK, error); 686 EXPECT_EQ(0U, verify_result.cert_status); 687 } 688 689 TEST_F(CertDatabaseNSSTest, ImportCaAndServerCert_DistrustServer) { 690 CertificateList ca_certs = CreateCertificateListFromFile( 691 GetTestCertsDirectory(), "root_ca_cert.pem", 692 X509Certificate::FORMAT_AUTO); 693 ASSERT_EQ(1U, ca_certs.size()); 694 695 // Import CA cert and trust it. 696 NSSCertDatabase::ImportCertFailureList failed; 697 EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::TRUSTED_SSL, 698 &failed)); 699 EXPECT_EQ(0U, failed.size()); 700 701 CertificateList certs = CreateCertificateListFromFile( 702 GetTestCertsDirectory(), "ok_cert.pem", 703 X509Certificate::FORMAT_AUTO); 704 ASSERT_EQ(1U, certs.size()); 705 706 // Import server cert without inheriting trust from issuer (explicit 707 // distrust). 708 EXPECT_TRUE(cert_db_->ImportServerCert( 709 certs, NSSCertDatabase::DISTRUSTED_SSL, &failed)); 710 EXPECT_EQ(0U, failed.size()); 711 EXPECT_EQ(NSSCertDatabase::DISTRUSTED_SSL, 712 cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT)); 713 714 EXPECT_EQ(unsigned(CERTDB_TERMINAL_RECORD), 715 certs[0]->os_cert_handle()->trust->sslFlags); 716 717 // Server cert should fail to verify. 718 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 719 int flags = 0; 720 CertVerifyResult verify_result; 721 int error = verify_proc->Verify(certs[0].get(), 722 "127.0.0.1", 723 flags, 724 NULL, 725 empty_cert_list_, 726 &verify_result); 727 EXPECT_EQ(ERR_CERT_REVOKED, error); 728 EXPECT_EQ(CERT_STATUS_REVOKED, verify_result.cert_status); 729 } 730 731 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa) { 732 CertificateList ca_certs = CreateCertificateListFromFile( 733 GetTestCertsDirectory(), "2048-rsa-root.pem", 734 X509Certificate::FORMAT_AUTO); 735 ASSERT_EQ(1U, ca_certs.size()); 736 737 // Import Root CA cert and distrust it. 738 NSSCertDatabase::ImportCertFailureList failed; 739 EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::DISTRUSTED_SSL, 740 &failed)); 741 EXPECT_EQ(0U, failed.size()); 742 743 CertificateList intermediate_certs = CreateCertificateListFromFile( 744 GetTestCertsDirectory(), "2048-rsa-intermediate.pem", 745 X509Certificate::FORMAT_AUTO); 746 ASSERT_EQ(1U, intermediate_certs.size()); 747 748 // Import Intermediate CA cert and trust it. 749 EXPECT_TRUE(cert_db_->ImportCACerts(intermediate_certs, 750 NSSCertDatabase::TRUSTED_SSL, &failed)); 751 EXPECT_EQ(0U, failed.size()); 752 753 CertificateList certs = CreateCertificateListFromFile( 754 GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem", 755 X509Certificate::FORMAT_AUTO); 756 ASSERT_EQ(1U, certs.size()); 757 758 // Import server cert with default trust. 759 EXPECT_TRUE(cert_db_->ImportServerCert( 760 certs, NSSCertDatabase::TRUST_DEFAULT, &failed)); 761 EXPECT_EQ(0U, failed.size()); 762 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 763 cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT)); 764 765 // Server cert should verify. 766 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 767 int flags = 0; 768 CertVerifyResult verify_result; 769 int error = verify_proc->Verify(certs[0].get(), 770 "127.0.0.1", 771 flags, 772 NULL, 773 empty_cert_list_, 774 &verify_result); 775 EXPECT_EQ(OK, error); 776 EXPECT_EQ(0U, verify_result.cert_status); 777 778 // Trust the root cert and distrust the intermediate. 779 EXPECT_TRUE(cert_db_->SetCertTrust( 780 ca_certs[0].get(), CA_CERT, NSSCertDatabase::TRUSTED_SSL)); 781 EXPECT_TRUE(cert_db_->SetCertTrust( 782 intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::DISTRUSTED_SSL)); 783 EXPECT_EQ( 784 unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA), 785 ca_certs[0]->os_cert_handle()->trust->sslFlags); 786 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 787 ca_certs[0]->os_cert_handle()->trust->emailFlags); 788 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 789 ca_certs[0]->os_cert_handle()->trust->objectSigningFlags); 790 EXPECT_EQ(unsigned(CERTDB_TERMINAL_RECORD), 791 intermediate_certs[0]->os_cert_handle()->trust->sslFlags); 792 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 793 intermediate_certs[0]->os_cert_handle()->trust->emailFlags); 794 EXPECT_EQ( 795 unsigned(CERTDB_VALID_CA), 796 intermediate_certs[0]->os_cert_handle()->trust->objectSigningFlags); 797 798 // Server cert should fail to verify. 799 CertVerifyResult verify_result2; 800 error = verify_proc->Verify(certs[0].get(), 801 "127.0.0.1", 802 flags, 803 NULL, 804 empty_cert_list_, 805 &verify_result2); 806 EXPECT_EQ(ERR_CERT_REVOKED, error); 807 EXPECT_EQ(CERT_STATUS_REVOKED, verify_result2.cert_status); 808 } 809 810 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa2) { 811 if (NSS_VersionCheck("3.14.2") && !NSS_VersionCheck("3.15")) { 812 // See http://bugzil.la/863947 for details. 813 LOG(INFO) << "Skipping test for NSS 3.14.2 - NSS 3.15"; 814 return; 815 } 816 817 NSSCertDatabase::ImportCertFailureList failed; 818 819 CertificateList intermediate_certs = CreateCertificateListFromFile( 820 GetTestCertsDirectory(), "2048-rsa-intermediate.pem", 821 X509Certificate::FORMAT_AUTO); 822 ASSERT_EQ(1U, intermediate_certs.size()); 823 824 // Import Intermediate CA cert and trust it. 825 EXPECT_TRUE(cert_db_->ImportCACerts(intermediate_certs, 826 NSSCertDatabase::TRUSTED_SSL, &failed)); 827 EXPECT_EQ(0U, failed.size()); 828 829 CertificateList certs = CreateCertificateListFromFile( 830 GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem", 831 X509Certificate::FORMAT_AUTO); 832 ASSERT_EQ(1U, certs.size()); 833 834 // Import server cert with default trust. 835 EXPECT_TRUE(cert_db_->ImportServerCert( 836 certs, NSSCertDatabase::TRUST_DEFAULT, &failed)); 837 EXPECT_EQ(0U, failed.size()); 838 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 839 cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT)); 840 841 // Server cert should verify. 842 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 843 int flags = 0; 844 CertVerifyResult verify_result; 845 int error = verify_proc->Verify(certs[0].get(), 846 "127.0.0.1", 847 flags, 848 NULL, 849 empty_cert_list_, 850 &verify_result); 851 EXPECT_EQ(OK, error); 852 EXPECT_EQ(0U, verify_result.cert_status); 853 854 // Without explicit trust of the intermediate, verification should fail. 855 EXPECT_TRUE(cert_db_->SetCertTrust( 856 intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::TRUST_DEFAULT)); 857 858 // Server cert should fail to verify. 859 CertVerifyResult verify_result2; 860 error = verify_proc->Verify(certs[0].get(), 861 "127.0.0.1", 862 flags, 863 NULL, 864 empty_cert_list_, 865 &verify_result2); 866 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); 867 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result2.cert_status); 868 } 869 870 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa3) { 871 if (NSS_VersionCheck("3.14.2") && !NSS_VersionCheck("3.15")) { 872 // See http://bugzil.la/863947 for details. 873 LOG(INFO) << "Skipping test for NSS 3.14.2 - NSS 3.15"; 874 return; 875 } 876 877 NSSCertDatabase::ImportCertFailureList failed; 878 879 CertificateList ca_certs = CreateCertificateListFromFile( 880 GetTestCertsDirectory(), "2048-rsa-root.pem", 881 X509Certificate::FORMAT_AUTO); 882 ASSERT_EQ(1U, ca_certs.size()); 883 884 // Import Root CA cert and default trust it. 885 EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::TRUST_DEFAULT, 886 &failed)); 887 EXPECT_EQ(0U, failed.size()); 888 889 CertificateList intermediate_certs = CreateCertificateListFromFile( 890 GetTestCertsDirectory(), "2048-rsa-intermediate.pem", 891 X509Certificate::FORMAT_AUTO); 892 ASSERT_EQ(1U, intermediate_certs.size()); 893 894 // Import Intermediate CA cert and trust it. 895 EXPECT_TRUE(cert_db_->ImportCACerts(intermediate_certs, 896 NSSCertDatabase::TRUSTED_SSL, &failed)); 897 EXPECT_EQ(0U, failed.size()); 898 899 CertificateList certs = CreateCertificateListFromFile( 900 GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem", 901 X509Certificate::FORMAT_AUTO); 902 ASSERT_EQ(1U, certs.size()); 903 904 // Import server cert with default trust. 905 EXPECT_TRUE(cert_db_->ImportServerCert( 906 certs, NSSCertDatabase::TRUST_DEFAULT, &failed)); 907 EXPECT_EQ(0U, failed.size()); 908 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 909 cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT)); 910 911 // Server cert should verify. 912 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 913 int flags = 0; 914 CertVerifyResult verify_result; 915 int error = verify_proc->Verify(certs[0].get(), 916 "127.0.0.1", 917 flags, 918 NULL, 919 empty_cert_list_, 920 &verify_result); 921 EXPECT_EQ(OK, error); 922 EXPECT_EQ(0U, verify_result.cert_status); 923 924 // Without explicit trust of the intermediate, verification should fail. 925 EXPECT_TRUE(cert_db_->SetCertTrust( 926 intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::TRUST_DEFAULT)); 927 928 // Server cert should fail to verify. 929 CertVerifyResult verify_result2; 930 error = verify_proc->Verify(certs[0].get(), 931 "127.0.0.1", 932 flags, 933 NULL, 934 empty_cert_list_, 935 &verify_result2); 936 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); 937 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result2.cert_status); 938 } 939 940 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa4) { 941 NSSCertDatabase::ImportCertFailureList failed; 942 943 CertificateList ca_certs = CreateCertificateListFromFile( 944 GetTestCertsDirectory(), "2048-rsa-root.pem", 945 X509Certificate::FORMAT_AUTO); 946 ASSERT_EQ(1U, ca_certs.size()); 947 948 // Import Root CA cert and trust it. 949 EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::TRUSTED_SSL, 950 &failed)); 951 EXPECT_EQ(0U, failed.size()); 952 953 CertificateList intermediate_certs = CreateCertificateListFromFile( 954 GetTestCertsDirectory(), "2048-rsa-intermediate.pem", 955 X509Certificate::FORMAT_AUTO); 956 ASSERT_EQ(1U, intermediate_certs.size()); 957 958 // Import Intermediate CA cert and distrust it. 959 EXPECT_TRUE(cert_db_->ImportCACerts( 960 intermediate_certs, NSSCertDatabase::DISTRUSTED_SSL, &failed)); 961 EXPECT_EQ(0U, failed.size()); 962 963 CertificateList certs = CreateCertificateListFromFile( 964 GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem", 965 X509Certificate::FORMAT_AUTO); 966 ASSERT_EQ(1U, certs.size()); 967 968 // Import server cert with default trust. 969 EXPECT_TRUE(cert_db_->ImportServerCert( 970 certs, NSSCertDatabase::TRUST_DEFAULT, &failed)); 971 EXPECT_EQ(0U, failed.size()); 972 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 973 cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT)); 974 975 // Server cert should not verify. 976 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 977 int flags = 0; 978 CertVerifyResult verify_result; 979 int error = verify_proc->Verify(certs[0].get(), 980 "127.0.0.1", 981 flags, 982 NULL, 983 empty_cert_list_, 984 &verify_result); 985 EXPECT_EQ(ERR_CERT_REVOKED, error); 986 EXPECT_EQ(CERT_STATUS_REVOKED, verify_result.cert_status); 987 988 // Without explicit distrust of the intermediate, verification should succeed. 989 EXPECT_TRUE(cert_db_->SetCertTrust( 990 intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::TRUST_DEFAULT)); 991 992 // Server cert should verify. 993 CertVerifyResult verify_result2; 994 error = verify_proc->Verify(certs[0].get(), 995 "127.0.0.1", 996 flags, 997 NULL, 998 empty_cert_list_, 999 &verify_result2); 1000 EXPECT_EQ(OK, error); 1001 EXPECT_EQ(0U, verify_result2.cert_status); 1002 } 1003 1004 // Importing two certificates with the same issuer and subject common name, 1005 // but overall distinct subject names, should succeed and generate a unique 1006 // nickname for the second certificate. 1007 TEST_F(CertDatabaseNSSTest, ImportDuplicateCommonName) { 1008 CertificateList certs = 1009 CreateCertificateListFromFile(GetTestCertsDirectory(), 1010 "duplicate_cn_1.pem", 1011 X509Certificate::FORMAT_AUTO); 1012 ASSERT_EQ(1U, certs.size()); 1013 1014 EXPECT_EQ(0U, ListCertsInSlot(slot_->os_module_handle()).size()); 1015 1016 // Import server cert with default trust. 1017 NSSCertDatabase::ImportCertFailureList failed; 1018 EXPECT_TRUE(cert_db_->ImportServerCert( 1019 certs, NSSCertDatabase::TRUST_DEFAULT, &failed)); 1020 EXPECT_EQ(0U, failed.size()); 1021 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 1022 cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT)); 1023 1024 CertificateList new_certs = ListCertsInSlot(slot_->os_module_handle()); 1025 ASSERT_EQ(1U, new_certs.size()); 1026 1027 // Now attempt to import a different certificate with the same common name. 1028 CertificateList certs2 = 1029 CreateCertificateListFromFile(GetTestCertsDirectory(), 1030 "duplicate_cn_2.pem", 1031 X509Certificate::FORMAT_AUTO); 1032 ASSERT_EQ(1U, certs2.size()); 1033 1034 // Import server cert with default trust. 1035 EXPECT_TRUE(cert_db_->ImportServerCert( 1036 certs2, NSSCertDatabase::TRUST_DEFAULT, &failed)); 1037 EXPECT_EQ(0U, failed.size()); 1038 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 1039 cert_db_->GetCertTrust(certs2[0].get(), SERVER_CERT)); 1040 1041 new_certs = ListCertsInSlot(slot_->os_module_handle()); 1042 ASSERT_EQ(2U, new_certs.size()); 1043 EXPECT_STRNE(new_certs[0]->os_cert_handle()->nickname, 1044 new_certs[1]->os_cert_handle()->nickname); 1045 } 1046 1047 } // namespace net 1048
