README
1 This directory contains various certificates for use with SSL-related 2 unit tests. 3 4 - google.binary.p7b 5 - google.chain.pem 6 - google.pem_cert.p7b 7 - google.pem_pkcs7.p7b 8 - google.pkcs7.p7b 9 - google.single.der 10 - google.single.pem 11 - thawte.single.pem : Certificates for testing parsing of different formats. 12 13 - googlenew.chain.pem : The refreshed Google certificate 14 (valid until Sept 30 2013). 15 16 - mit.davidben.der : An expired MIT client certificate. 17 18 - foaf.me.chromium-test-cert.der : A client certificate for a FOAF.ME identity 19 created for testing. 20 21 - www_us_army_mil_cert.der 22 - dod_ca_17_cert.der 23 - dod_root_ca_2_cert.der : 24 A certificate chain used for testing certificate imports 25 26 - unosoft_hu_cert : Certificate used by X509CertificateTest.UnoSoftCertParsing. 27 28 - client.p12 : A PKCS #12 file containing a client certificate and a private 29 key created for testing. The password is "12345". 30 31 - client-nokey.p12 : A PKCS #12 file containing a client certificate (the same 32 as the one in client.p12) but no private key. The password is "12345". 33 34 - punycodetest.der : A test self-signed server certificate with punycode name. 35 The common name is "xn--wgv71a119e.com" (.com) 36 37 - unittest.selfsigned.der : A self-signed certificate generated using private 38 key in unittest.key.bin. The common name is "unittest". 39 40 - unittest.key.bin : private key stored unencrypted. 41 42 - unittest.originbound.der: A test origin-bound certificate for 43 https://www.google.com:443. 44 - unittest.originbound.key.der: matching PrivateKeyInfo. 45 46 - x509_verify_results.chain.pem : A simple certificate chain used to test that 47 the correctly ordered, filtered certificate chain is returned during 48 verification, regardless of the order in which the intermediate/root CA 49 certificates are provided. 50 51 - google_diginotar.pem 52 - diginotar_public_ca_2025.pem : A certificate chain for the regression test 53 of http://crbug.com/94673 54 55 - test_mail_google_com.pem : A certificate signed by the test CA for 56 "mail.google.com". Because it is signed by that CA instead of the true CA 57 for that host, it will fail the 58 TransportSecurityState::IsChainOfPublicKeysPermitted test. 59 60 - salesforce_com_test.pem 61 - verisign_intermediate_ca_2011.pem 62 - verisign_intermediate_ca_2016.pem : Certificates for testing two 63 X509Certificate objects that contain the same server certificate but 64 different intermediate CA certificates. The two intermediate CA 65 certificates actually represent the same intermediate CA but have 66 different validity periods. 67 68 - multivalue_rdn.pem : A regression test for http://crbug.com/101009. A 69 certificate with all of the AttributeTypeAndValues stored within a single 70 RelativeDistinguishedName, rather than one AVA per RDN as normally seen. 71 72 - unescaped.pem : Regression test for http://crbug.com/102839. Contains 73 characters such as '=' and '"' that would normally be escaped when 74 converting a subject/issuer name to their stringized form. 75 76 - 2048-rsa-root.pem 77 - {768-rsa,1024-rsa,2048-rsa,prime256v1-ecdsa}-intermediate.pem 78 - {768-rsa,1024-rsa,2048-rsa,prime256v1-ecdsa}-ee-by- 79 {768-rsa,1024-rsa,2048-rsa,prime256v1-ecdsa}-intermediate.pem 80 These certficates are generated by 81 net/data/ssl/scripts/generate-weak-test-chains.sh and used in the 82 RejectWeakKeys test in net/base/x509_certificate_unittest.cc. 83 84 - cross-signed-leaf.pem 85 - cross-signed-root-md5.pem 86 - cross-signed-root-sha1.pem 87 A certificate chain for regression testing http://crbug.com/108514, 88 generated via scripts/generate-cross-signed-certs.sh 89 90 - redundant-validated-chain.pem 91 - redundant-server-chain.pem 92 - redundant-validated-chain-root.pem 93 94 Two chains, A -> B -> C -> D and A -> B -> C2 (C and C2 share the same 95 public key) to test that SSLInfo gets the reconstructed, re-ordered 96 chain instead of the chain as served. See 97 SSLClientSocketTest.VerifyReturnChainProperlyOrdered in 98 net/socket/ssl_client_socket_unittest.cc. These chains are valid until 99 26 Feb 2022 and are generated by 100 net/data/ssl/scripts/generate-redundant-test-chains.sh. 101 102 - multi-root-chain1.pem 103 - multi-root-chain2.pem 104 Two chains, A -> B -> C -> D and A -> B -> C2 -> E (C and C2 share the 105 same public key) to test that certificate validation caching does not 106 interfere with the chain_verify_callback used by CertVerifyProcChromeOS. 107 See CertVerifyProcChromeOSTest. 108 109 - comodo.chain.pem : A certificate chain for www.comodo.com which should be 110 recognised as EV. Expires Jun 21 2013. 111 112 - ocsp-test-root.pem : A root certificate for the code in 113 net/tools/testserver/minica.py 114 115 - spdy_pooling.pem : Used to test the handling of spdy IP connection pooling 116 Generated by using the command 117 "openssl req -x509 -days 3650 -sha1 -extensions req_spdy_pooling \ 118 -config ../scripts/ee.cnf -newkey rsa:1024 -text \ 119 -out spdy_pooling.pem" 120 121 - subjectAltName_sanity_check.pem : Used to test the handling of various types 122 within the subjectAltName extension of a certificate. Generated by using 123 the command 124 "openssl req -x509 -days 3650 -sha1 -extensions req_san_sanity \ 125 -config ../scripts/ee.cnf -newkey rsa:1024 -text \ 126 -out subjectAltName_sanity_check.pem" 127 128 - ndn.ca.crt: "New Dream Network Certificate Authority" root certificate. 129 This is an X.509 v1 certificate that omits the version field. Used to 130 test that the certificate version gets the default value v1. 131 132 - websocket_cacert.pem : The testing root CA for testing WebSocket client 133 certificate authentication. 134 This file is used in SSLUITest.TestWSSClientCert. 135 136 - websocket_client_cert.p12 : A PKCS #12 file containing a client certificate 137 and a private key created for WebSocket testing. The password is "". 138 This file is used in SSLUITest.TestWSSClientCert. 139 140 - android-test-key-rsa.pem 141 - android-test-key-dsa.pem 142 - android-test-key-dsa-public.pem 143 - android-test-key-ecdsa.pem 144 - android-test-key-ecdsa-public.pem 145 This is a set of test RSA/DSA/ECDSA keys used by the Android-specific 146 unit test in net/android/keystore_unittest.c. They are used to verify 147 that the OpenSSL-specific wrapper for platform PrivateKey objects 148 works properly. See the generate-android-test-keys.sh script. 149 150 - client_1.pem 151 - client_1.key 152 - client_1_ca.pem 153 - client_2.pem 154 - client_2.key 155 - client_2_ca.pem 156 This is a set of files used to unit test SSL client certificate 157 authentication. These are generated by 158 net/data/ssl/scripts/generate-client-certificates.sh 159 - client_1_ca.pem and client_2_ca.pem are the certificates of 160 two distinct signing CAs. 161 - client_1.pem and client_1.key correspond to the certificate and 162 private key for a first certificate signed by client_1_ca.pem. 163 - client_2.pem and client_2.key correspond to the certificate and 164 private key for a second certificate signed by client_2_ca.pem. 165 166 - eku-test-root.pem 167 - non-crit-codeSigning-chain.pem 168 - crit-codeSigning-chain.pem 169 Two code-signing certificates (eKU: codeSigning; eKU: critical, 170 codeSigning) which we use to test that clients are making sure that web 171 server certs are checked for correct eKU fields (when an eKU field is 172 present). Since codeSigning is not valid for web server auth, the checks 173 should fail. 174 175 - duplicate_cn_1.p12 176 - duplicate_cn_1.pem 177 - duplicate_cn_2.p12 178 - duplicate_cn_2.pem 179 Two certificates from the same issuer that share the same common name, 180 but have distinct subject names (namely, their O fields differ). NSS 181 requires that certificates have unique nicknames if they do not share the 182 same subject, and these certificates are used to test that the nickname 183 generation algorithm generates unique nicknames. 184 The .pem versions contain just the certs, while the .p12 versions contain 185 both the cert and a private key, since there are multiple ways to import 186 certificates into NSS. 187 188 - aia-cert.pem 189 - aia-intermediate.der 190 - aia-root.pem 191 A certificate chain which we use to ensure AIA fetching works correctly 192 when using NSS to verify certificates (which uses our HTTP stack). 193 aia-cert.pem has a caIssuers that points to "aia-test.invalid" as the URL 194 containing the intermediate, which can be served via a URLRequestFilter. 195 aia-intermediate.der is stored in DER form for convenience, since that is 196 the form expected of certificates discovered via AIA. 197 198 - cybertrust_gte_root.pem 199 - cybertrust_baltimore_root.pem 200 - cybertrust_omniroot_chain.pem 201 - cybertrust_baltimore_cross_certified_1.pem 202 - cybertrust_baltimore_cross_certified_2.pem 203 These certificates are reflect a portion of the CyberTrust (Verizon 204 Business) CA hierarchy. _gte_root.pem is a legacy 1024-bit root that is 205 still widely supported, while _baltimore_root.pem reflects the newer 206 2048-bit root. For clients that only support the GTE root, two versions 207 of the Baltimore root were cross-signed by GTE, namely 208 _cross_certified_[1,2].pem. _omniroot_chain.pem contains a certificate 209 chain that was issued under the Baltimore root. Combined, these 210 certificates can be used to test real-world cross-signing; in practice, 211 they are used to test certain workarounds for OS X's chain building code. 212 213 - no_subject_common_name_cert.pem: Used to test the function that generates a 214 NSS certificate nickname for a user certificate. This certificate's Subject 215 field doesn't have a common name. 216 217 - expired_cert.pem 218 - ok_cert.pem 219 - root_ca_cert.pem 220 These certificates are the common certificates used by the Python test 221 server for simulating HTTPS connections. They are generated by running 222 the script net/data/ssl/scripts/generate-test-certs.sh. 223 224 - quic_intermediate.crt 225 - quic_test_ecc.example.com.crt 226 - quic_test.example.com.crt 227 - quic_root.crt 228 These certificates are used by the ProofVerifier's unit tests of QUIC. 229 230 - explicit-policy-chain.pem 231 A test certificate chain with requireExplicitPolicy field set on the 232 intermediate, with SkipCerts=0. This is used for regression testing 233 http://crbug.com/31497. It is generated by running the script 234 net/data/ssl/scripts/generate-policy-certs.sh 235 236 - ct-test-embedded-cert.pem 237 - ct-test-embedded-with-intermediate-chain.pem 238 - ct-test-embedded-with-intermediate-preca-chain.pem 239 - ct-test-embedded-with-preca-chain.pem 240 Test certificate chains for Certificate Transparency: Each of these 241 files contains a leaf certificate as the first certificate, which has 242 embedded SCTs, followed by the issuer certificates chain. 243 All files are from the src/test/testdada directory in 244 https://code.google.com/p/certificate-transparency/ 245
