X.509 Certificate Parsing and Verification Tests

This page contains a set of tests which are designed to test the ability of the X.509 code to parse certificates from a variety of sources. They serve as interoperability tests; these particular certificates are not generally good for any purposes other than testing.

A variety of features need testing. These are tested by acquiring valid certificates from a variety of sources, which utilize various X.509 features:

NOTE: X.509 certificates eventually become invalid due to the passing of time. Some certs here are intentionally invalid. However, not all of the certificates used as test cases should be invalid! When tests fail, be prepared to collect more certificates.


POSITIVE RSA Parsing and Signing Tests

These certificates are self-signed using the Rivest Shamir Adelson (RSA) cryptosystem. There are two message digest algorithms (MD2, MD5) tested. None of these certificates should have expired.

This test is supposed to pass, with the result "TBS". It tests the "MD5 with RSA" certificate signing algorithm, as well as certificate parsing code.
titleRSA_cert_1
nameRSA_cert_1
Description:
sourceCertParse.java
executeClasssun.security.x509.tests.CertParse
executeArgsentrust.cer pass

This test is supposed to pass, with the result "TBS". It tests the "MD2 with RSA" certificate signing algorithm, as well as certificate parsing code.
titleRSA_cert_2
nameRSA_cert_2
Description:
sourceCertParse.java
executeClasssun.security.x509.tests.CertParse
executeArgsincog1.cer pass

This test is supposed to pass, with the result "TBS". It tests the "MD2 with RSA" certificate signing algorithm, as well as certificate parsing code for X.509v3.
titleRSA_cert_2
nameRSA_cert_2
Description:
sourceCertParse.java
executeClasssun.security.x509.tests.CertParse
executeArgsnortel.cer pass

NEGATIVE RSA Parsing and Signing Tests

This test is supposed to fail, with the result "TBS". The certificate has expired.
titleN_RSA_cert_1
nameN_RSA_cert_1
Description:
sourceCertParse.java
executeClasssun.security.x509.tests.CertParse
executeArgsrajaram.cer fail

This test is supposed to fail, with the result "TBS". The certificate has expired. Note that the certificate itself has a non-simple X.500 attribute-value assertion; this should be parsed correctly.
titleN_RSA_cert_2
nameN_RSA_cert_2
Description:
sourceCertParse.java
executeClasssun.security.x509.tests.CertParse
executeArgsmit.cer fail


POSITIVE DSA Parsing and Signing Tests

These certificates use the Digital Signature Algorithm (DSA), FIPS 186. The certificates are self-signed using DSA. None of these certificates should have expired.

This test is supposed to pass, with the result "TBS". The certificate holds a 512 bit (minumum size) DSA public key.
titleDSA_cert_1
nameDSA_cert_1
Description:
sourceCertParse.java
executeClasssun.security.x509.tests.CertParse
executeArgsdave.cer pass

This test is supposed to pass, with the result "TBS". The certificate holds a 1024 bit (maximum size) DSA public key.
titleDSA_cert_2
nameDSA_cert_2
Description:
sourceCertParse.java
executeClasssun.security.x509.tests.CertParse
executeArgsincog-dsa-ca.cer pass

NEGATIVE DSA Parsing and Signing Tests

This test is supposed to fail, with the result "TBS". The self-signed certificate holds a 512 bit (minimum size) DSA public key, but the signature has been manually corrupted.
titleN_DSA_cert_1
nameN_DSA_cert_1
Description:
sourceCertParse.java
executeClasssun.security.x509.tests.CertParse
executeArgszap2.cer fail


POSITIVE Cert Parsing and Chaining Tests

Certificates are used in chains, where one certificate is issued by a "Certificate Authority" (CA), whose certificate was either issued by another certificate authority (etc) or else is "self-signed" and distributed through some trusted data distribution scheme. All of the self-signed certificates above are effectively CA certificates.

This test is supposed to pass, with the result "TBS". It consists of a two-element certificate chain. The first certificate holds a Diffie-Hellman key, signed using RSA using the cert from the second certificate.
titleCertChain_1
nameCertChain_1
Description:
sourceCertParse.java
executeClasssun.security.x509.tests.CertParse
executeArgsincog2.cer incog1.cer pass