1/*
2 * Copyright (C) 2013 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17package libcore.java.security.cert;
18
19import java.io.File;
20import java.io.FileInputStream;
21import java.io.IOException;
22import java.io.InputStream;
23import java.security.InvalidAlgorithmParameterException;
24import java.security.NoSuchAlgorithmException;
25import java.security.cert.CertPath;
26import java.security.cert.CertPathValidator;
27import java.security.cert.CertPathValidatorException;
28import java.security.cert.CertStore;
29import java.security.cert.CertificateFactory;
30import java.security.cert.CollectionCertStoreParameters;
31import java.security.cert.PKIXCertPathValidatorResult;
32import java.security.cert.PKIXParameters;
33import java.security.cert.TrustAnchor;
34import java.security.cert.X509CRL;
35import java.security.cert.X509Certificate;
36import java.util.ArrayList;
37import java.util.Arrays;
38import java.util.Collection;
39import java.util.HashSet;
40import java.util.Set;
41
42import junit.framework.TestCase;
43
44public class X509CertificateNistPkitsTest extends TestCase {
45    public static final String RESOURCE_PACKAGE = "/tests/resources/";
46
47    public static InputStream getStream(String name) {
48        // If we have the resources packaged up in our jar file, get them that way.
49        String path = RESOURCE_PACKAGE + name;
50        InputStream result = X509CertificateNistPkitsTest.class.getResourceAsStream(path);
51        if (result != null) {
52            return result;
53        }
54        // Otherwise, if we're in an Android build tree, get the files directly.
55        String ANDROID_BUILD_TOP = System.getenv("ANDROID_BUILD_TOP");
56        if (ANDROID_BUILD_TOP != null) {
57            File resource = new File(ANDROID_BUILD_TOP + "/external/nist-pkits/res" + path);
58            if (resource.exists()) {
59                try {
60                    return new FileInputStream(resource);
61                } catch (IOException ex) {
62                    throw new IllegalArgumentException("Couldn't open: " + resource, ex);
63                }
64            }
65        }
66        throw new IllegalArgumentException("No such resource: " + path);
67    }
68
69    private final X509Certificate getCertificate(CertificateFactory f, String name)
70            throws Exception {
71        final String fileName = "nist-pkits/certs/" + name;
72        final InputStream is = getStream(fileName);
73        assertNotNull("File does not exist: " + fileName, is);
74        try {
75            return (X509Certificate) f.generateCertificate(is);
76        } finally {
77            try {
78                is.close();
79            } catch (IOException ignored) {
80            }
81        }
82    }
83
84    private final X509Certificate[] getCertificates(CertificateFactory f, String[] names)
85            throws Exception {
86        X509Certificate[] certs = new X509Certificate[names.length];
87
88        for (int i = 0; i < names.length; i++) {
89            certs[i] = getCertificate(f, names[i]);
90        }
91
92        return certs;
93    }
94
95    private final X509CRL getCRL(CertificateFactory f, String name) throws Exception {
96        final String fileName = "nist-pkits/crls/" + name;
97        final InputStream is = getStream(fileName);
98        assertNotNull("File does not exist: " + fileName, is);
99        try {
100            return (X509CRL) f.generateCRL(is);
101        } finally {
102            try {
103                is.close();
104            } catch (IOException ignored) {
105            }
106        }
107    }
108
109    private final X509CRL[] getCRLs(CertificateFactory f, String[] names) throws Exception {
110        X509CRL[] crls = new X509CRL[names.length];
111
112        for (int i = 0; i < names.length; i++) {
113            crls[i] = getCRL(f, names[i]);
114        }
115
116        return crls;
117    }
118
119    private CertPath getTestPath(CertificateFactory f, String[] pathCerts) throws Exception {
120        X509Certificate[] certs = getCertificates(f, pathCerts);
121        return f.generateCertPath(Arrays.asList(certs));
122    }
123
124    private PKIXParameters getTestPathParams(CertificateFactory f, String trustedCAName,
125            String[] pathCerts, String[] pathCRLs) throws Exception {
126        X509Certificate[] certs = getCertificates(f, pathCerts);
127        X509CRL[] crls = getCRLs(f, pathCRLs);
128        X509Certificate trustedCA = getCertificate(f, trustedCAName);
129
130        Collection<Object> certCollection = new ArrayList<Object>();
131        certCollection.addAll(Arrays.asList(crls));
132        certCollection.addAll(Arrays.asList(certs));
133        certCollection.add(trustedCA);
134        CollectionCertStoreParameters certStoreParams = new CollectionCertStoreParameters(
135                certCollection);
136        CertStore certStore = CertStore.getInstance("Collection", certStoreParams);
137
138        Set<TrustAnchor> anchors = new HashSet<TrustAnchor>();
139        anchors.add(new TrustAnchor(trustedCA, null));
140
141        PKIXParameters params = new PKIXParameters(anchors);
142        params.addCertStore(certStore);
143
144        return params;
145    }
146
147    private void assertInvalidPath(String trustAnchor, String[] certs, String[] crls)
148            throws Exception, NoSuchAlgorithmException, InvalidAlgorithmParameterException {
149        CertificateFactory f = CertificateFactory.getInstance("X.509");
150
151        PKIXParameters params = getTestPathParams(f, trustAnchor, certs, crls);
152        CertPath cp = getTestPath(f, certs);
153        CertPathValidator cpv = CertPathValidator.getInstance("PKIX");
154
155        try {
156            PKIXCertPathValidatorResult cpvResult = (PKIXCertPathValidatorResult) cpv.validate(cp,
157                    params);
158            fail();
159        } catch (CertPathValidatorException expected) {
160        }
161    }
162
163    private void assertValidPath(String trustAnchor, String[] certs, String[] crls)
164            throws Exception, NoSuchAlgorithmException, CertPathValidatorException,
165            InvalidAlgorithmParameterException {
166        CertificateFactory f = CertificateFactory.getInstance("X.509");
167
168        PKIXParameters params = getTestPathParams(f, trustAnchor, certs, crls);
169        CertPath cp = getTestPath(f, certs);
170        CertPathValidator cpv = CertPathValidator.getInstance("PKIX");
171
172        PKIXCertPathValidatorResult cpvResult = (PKIXCertPathValidatorResult) cpv.validate(cp,
173                params);
174    }
175
176    /* DO NOT MANUALLY EDIT -- BEGIN AUTOMATICALLY GENERATED TESTS */
177    /** NIST PKITS test 4.1.1 */
178    public void testSignatureVerification_ValidSignaturesTest1() throws Exception {
179        String trustAnchor = "TrustAnchorRootCertificate.crt";
180
181        String[] certs = {
182                "ValidCertificatePathTest1EE.crt",
183                "GoodCACert.crt",
184        };
185
186        String[] crls = {
187                "TrustAnchorRootCRL.crl",
188                "GoodCACRL.crl",
189        };
190
191        assertValidPath(trustAnchor, certs, crls);
192    }
193
194    /** NIST PKITS test 4.1.2 */
195    public void testSignatureVerification_InvalidCASignatureTest2() throws Exception {
196        String trustAnchor = "TrustAnchorRootCertificate.crt";
197
198        String[] certs = {
199                "InvalidCASignatureTest2EE.crt",
200                "BadSignedCACert.crt",
201        };
202
203        String[] crls = {
204                "TrustAnchorRootCRL.crl",
205                "BadSignedCACRL.crl",
206        };
207
208        assertInvalidPath(trustAnchor, certs, crls);
209    }
210
211    /** NIST PKITS test 4.1.3 */
212    public void testSignatureVerification_InvalidEESignatureTest3() throws Exception {
213        String trustAnchor = "TrustAnchorRootCertificate.crt";
214
215        String[] certs = {
216                "InvalidEESignatureTest3EE.crt",
217                "GoodCACert.crt",
218        };
219
220        String[] crls = {
221                "TrustAnchorRootCRL.crl",
222                "GoodCACRL.crl",
223        };
224
225        assertInvalidPath(trustAnchor, certs, crls);
226    }
227
228    /** NIST PKITS test 4.1.4 */
229    public void testSignatureVerification_ValidDSASignaturesTest4() throws Exception {
230        String trustAnchor = "TrustAnchorRootCertificate.crt";
231
232        String[] certs = {
233                "ValidDSASignaturesTest4EE.crt",
234                "DSACACert.crt",
235        };
236
237        String[] crls = {
238                "TrustAnchorRootCRL.crl",
239                "DSACACRL.crl",
240        };
241
242        assertValidPath(trustAnchor, certs, crls);
243    }
244
245    /** NIST PKITS test 4.1.5 */
246    public void testSignatureVerification_ValidDSAParameterInheritanceTest5() throws Exception {
247        String trustAnchor = "TrustAnchorRootCertificate.crt";
248
249        String[] certs = {
250                "ValidDSAParameterInheritanceTest5EE.crt",
251                "DSAParametersInheritedCACert.crt",
252                "DSACACert.crt",
253        };
254
255        String[] crls = {
256                "TrustAnchorRootCRL.crl",
257                "DSACACRL.crl",
258                "DSAParametersInheritedCACRL.crl",
259        };
260
261        assertValidPath(trustAnchor, certs, crls);
262    }
263
264    /** NIST PKITS test 4.1.6 */
265    public void testSignatureVerification_InvalidDSASignatureTest6() throws Exception {
266        String trustAnchor = "TrustAnchorRootCertificate.crt";
267
268        String[] certs = {
269                "InvalidDSASignatureTest6EE.crt",
270                "DSACACert.crt",
271        };
272
273        String[] crls = {
274                "TrustAnchorRootCRL.crl",
275                "DSACACRL.crl",
276        };
277
278        assertInvalidPath(trustAnchor, certs, crls);
279    }
280
281    /** NIST PKITS test 4.2.1 */
282    public void testValidityPeriods_InvalidCAnotBeforeDateTest1() throws Exception {
283        String trustAnchor = "TrustAnchorRootCertificate.crt";
284
285        String[] certs = {
286                "InvalidCAnotBeforeDateTest1EE.crt",
287                "BadnotBeforeDateCACert.crt",
288        };
289
290        String[] crls = {
291                "TrustAnchorRootCRL.crl",
292                "BadnotBeforeDateCACRL.crl",
293        };
294
295        assertInvalidPath(trustAnchor, certs, crls);
296    }
297
298    /** NIST PKITS test 4.2.2 */
299    public void testValidityPeriods_InvalidEEnotBeforeDateTest2() throws Exception {
300        String trustAnchor = "TrustAnchorRootCertificate.crt";
301
302        String[] certs = {
303                "InvalidEEnotBeforeDateTest2EE.crt",
304                "GoodCACert.crt",
305        };
306
307        String[] crls = {
308                "TrustAnchorRootCRL.crl",
309                "GoodCACRL.crl",
310        };
311
312        assertInvalidPath(trustAnchor, certs, crls);
313    }
314
315    /** NIST PKITS test 4.2.3 */
316    public void testValidityPeriods_Validpre2000UTCnotBeforeDateTest3() throws Exception {
317        String trustAnchor = "TrustAnchorRootCertificate.crt";
318
319        String[] certs = {
320                "Validpre2000UTCnotBeforeDateTest3EE.crt",
321                "GoodCACert.crt",
322        };
323
324        String[] crls = {
325                "TrustAnchorRootCRL.crl",
326                "GoodCACRL.crl",
327        };
328
329        assertValidPath(trustAnchor, certs, crls);
330    }
331
332    /** NIST PKITS test 4.2.4 */
333    public void testValidityPeriods_ValidGeneralizedTimenotBeforeDateTest4() throws Exception {
334        String trustAnchor = "TrustAnchorRootCertificate.crt";
335
336        String[] certs = {
337                "ValidGeneralizedTimenotBeforeDateTest4EE.crt",
338                "GoodCACert.crt",
339        };
340
341        String[] crls = {
342                "TrustAnchorRootCRL.crl",
343                "GoodCACRL.crl",
344        };
345
346        assertValidPath(trustAnchor, certs, crls);
347    }
348
349    /** NIST PKITS test 4.2.5 */
350    public void testValidityPeriods_InvalidCAnotAfterDateTest5() throws Exception {
351        String trustAnchor = "TrustAnchorRootCertificate.crt";
352
353        String[] certs = {
354                "InvalidCAnotAfterDateTest5EE.crt",
355                "BadnotAfterDateCACert.crt",
356        };
357
358        String[] crls = {
359                "TrustAnchorRootCRL.crl",
360                "BadnotAfterDateCACRL.crl",
361        };
362
363        assertInvalidPath(trustAnchor, certs, crls);
364    }
365
366    /** NIST PKITS test 4.2.6 */
367    public void testValidityPeriods_InvalidEEnotAfterDateTest6() throws Exception {
368        String trustAnchor = "TrustAnchorRootCertificate.crt";
369
370        String[] certs = {
371                "InvalidEEnotAfterDateTest6EE.crt",
372                "GoodCACert.crt",
373        };
374
375        String[] crls = {
376                "TrustAnchorRootCRL.crl",
377                "GoodCACRL.crl",
378        };
379
380        assertInvalidPath(trustAnchor, certs, crls);
381    }
382
383    /** NIST PKITS test 4.2.7 */
384    public void testValidityPeriods_Invalidpre2000UTCEEnotAfterDateTest7() throws Exception {
385        String trustAnchor = "TrustAnchorRootCertificate.crt";
386
387        String[] certs = {
388                "Invalidpre2000UTCEEnotAfterDateTest7EE.crt",
389                "GoodCACert.crt",
390        };
391
392        String[] crls = {
393                "TrustAnchorRootCRL.crl",
394                "GoodCACRL.crl",
395        };
396
397        assertInvalidPath(trustAnchor, certs, crls);
398    }
399
400    /** NIST PKITS test 4.2.8 */
401    public void testValidityPeriods_ValidGeneralizedTimenotAfterDateTest8() throws Exception {
402        String trustAnchor = "TrustAnchorRootCertificate.crt";
403
404        String[] certs = {
405                "ValidGeneralizedTimenotAfterDateTest8EE.crt",
406                "GoodCACert.crt",
407        };
408
409        String[] crls = {
410                "TrustAnchorRootCRL.crl",
411                "GoodCACRL.crl",
412        };
413
414        assertValidPath(trustAnchor, certs, crls);
415    }
416
417    /** NIST PKITS test 4.3.1 */
418    public void testVerifyingNameChaining_InvalidNameChainingEETest1() throws Exception {
419        String trustAnchor = "TrustAnchorRootCertificate.crt";
420
421        String[] certs = {
422                "InvalidNameChainingTest1EE.crt",
423                "GoodCACert.crt",
424        };
425
426        String[] crls = {
427                "TrustAnchorRootCRL.crl",
428                "GoodCACRL.crl",
429        };
430
431        assertInvalidPath(trustAnchor, certs, crls);
432    }
433
434    /** NIST PKITS test 4.3.2 */
435    public void testVerifyingNameChaining_InvalidNameChainingOrderTest2() throws Exception {
436        String trustAnchor = "TrustAnchorRootCertificate.crt";
437
438        String[] certs = {
439                "InvalidNameChainingOrderTest2EE.crt",
440                "NameOrderingCACert.crt",
441        };
442
443        String[] crls = {
444                "TrustAnchorRootCRL.crl",
445                "NameOrderCACRL.crl",
446        };
447
448        assertInvalidPath(trustAnchor, certs, crls);
449    }
450
451    /** NIST PKITS test 4.3.3 */
452    public void testVerifyingNameChaining_ValidNameChainingWhitespaceTest3() throws Exception {
453        String trustAnchor = "TrustAnchorRootCertificate.crt";
454
455        String[] certs = {
456                "ValidNameChainingWhitespaceTest3EE.crt",
457                "GoodCACert.crt",
458        };
459
460        String[] crls = {
461                "TrustAnchorRootCRL.crl",
462                "GoodCACRL.crl",
463        };
464
465        assertValidPath(trustAnchor, certs, crls);
466    }
467
468    /** NIST PKITS test 4.3.4 */
469    public void testVerifyingNameChaining_ValidNameChainingWhitespaceTest4() throws Exception {
470        String trustAnchor = "TrustAnchorRootCertificate.crt";
471
472        String[] certs = {
473                "ValidNameChainingWhitespaceTest4EE.crt",
474                "GoodCACert.crt",
475        };
476
477        String[] crls = {
478                "TrustAnchorRootCRL.crl",
479                "GoodCACRL.crl",
480        };
481
482        assertValidPath(trustAnchor, certs, crls);
483    }
484
485    /** NIST PKITS test 4.3.5 */
486    public void testVerifyingNameChaining_ValidNameChainingCapitalizationTest5() throws Exception {
487        String trustAnchor = "TrustAnchorRootCertificate.crt";
488
489        String[] certs = {
490                "ValidNameChainingCapitalizationTest5EE.crt",
491                "GoodCACert.crt",
492        };
493
494        String[] crls = {
495                "TrustAnchorRootCRL.crl",
496                "GoodCACRL.crl",
497        };
498
499        assertValidPath(trustAnchor, certs, crls);
500    }
501
502    /** NIST PKITS test 4.3.6 */
503    public void testVerifyingNameChaining_ValidNameChainingUIDsTest6() throws Exception {
504        String trustAnchor = "TrustAnchorRootCertificate.crt";
505
506        String[] certs = {
507                "ValidNameUIDsTest6EE.crt",
508                "UIDCACert.crt",
509        };
510
511        String[] crls = {
512                "TrustAnchorRootCRL.crl",
513                "UIDCACRL.crl",
514        };
515
516        assertValidPath(trustAnchor, certs, crls);
517    }
518
519    /** NIST PKITS test 4.3.7 */
520    public void testVerifyingNameChaining_ValidRFC3280MandatoryAttributeTypesTest7() throws Exception {
521        String trustAnchor = "TrustAnchorRootCertificate.crt";
522
523        String[] certs = {
524                "ValidRFC3280MandatoryAttributeTypesTest7EE.crt",
525                "RFC3280MandatoryAttributeTypesCACert.crt",
526        };
527
528        String[] crls = {
529                "TrustAnchorRootCRL.crl",
530                "RFC3280MandatoryAttributeTypesCACRL.crl",
531        };
532
533        assertValidPath(trustAnchor, certs, crls);
534    }
535
536    /** NIST PKITS test 4.3.8 */
537    public void testVerifyingNameChaining_ValidRFC3280OptionalAttributeTypesTest8() throws Exception {
538        String trustAnchor = "TrustAnchorRootCertificate.crt";
539
540        String[] certs = {
541                "ValidRFC3280OptionalAttributeTypesTest8EE.crt",
542                "RFC3280OptionalAttributeTypesCACert.crt",
543        };
544
545        String[] crls = {
546                "TrustAnchorRootCRL.crl",
547                "RFC3280OptionalAttributeTypesCACRL.crl",
548        };
549
550        assertValidPath(trustAnchor, certs, crls);
551    }
552
553    /** NIST PKITS test 4.3.9 */
554    public void testVerifyingNameChaining_ValidUTF8StringEncodedNamesTest9() throws Exception {
555        String trustAnchor = "TrustAnchorRootCertificate.crt";
556
557        String[] certs = {
558                "ValidUTF8StringEncodedNamesTest9EE.crt",
559                "UTF8StringEncodedNamesCACert.crt",
560        };
561
562        String[] crls = {
563                "TrustAnchorRootCRL.crl",
564                "UTF8StringEncodedNamesCACRL.crl",
565        };
566
567        assertValidPath(trustAnchor, certs, crls);
568    }
569
570    /** NIST PKITS test 4.3.10 */
571    public void testVerifyingNameChaining_ValidRolloverfromPrintableStringtoUTF8StringTest10() throws Exception {
572        String trustAnchor = "TrustAnchorRootCertificate.crt";
573
574        String[] certs = {
575                "ValidRolloverfromPrintableStringtoUTF8StringTest10EE.crt",
576                "RolloverfromPrintableStringtoUTF8StringCACert.crt",
577        };
578
579        String[] crls = {
580                "TrustAnchorRootCRL.crl",
581                "RolloverfromPrintableStringtoUTF8StringCACRL.crl",
582        };
583
584        assertValidPath(trustAnchor, certs, crls);
585    }
586
587    /** NIST PKITS test 4.3.11 */
588    public void testVerifyingNameChaining_ValidUTF8StringCaseInsensitiveMatchTest11() throws Exception {
589        String trustAnchor = "TrustAnchorRootCertificate.crt";
590
591        String[] certs = {
592                "ValidUTF8StringCaseInsensitiveMatchTest11EE.crt",
593                "UTF8StringCaseInsensitiveMatchCACert.crt",
594        };
595
596        String[] crls = {
597                "TrustAnchorRootCRL.crl",
598                "UTF8StringCaseInsensitiveMatchCACRL.crl",
599        };
600
601        assertValidPath(trustAnchor, certs, crls);
602    }
603
604    /** NIST PKITS test 4.4.1 */
605    public void testBasicCertificateRevocationTests_MissingCRLTest1() throws Exception {
606        String trustAnchor = "TrustAnchorRootCertificate.crt";
607
608        String[] certs = {
609                "InvalidMissingCRLTest1EE.crt",
610                "NoCRLCACert.crt",
611        };
612
613        String[] crls = {
614                "TrustAnchorRootCRL.crl",
615        };
616
617        assertInvalidPath(trustAnchor, certs, crls);
618    }
619
620    /** NIST PKITS test 4.4.2 */
621    public void testBasicCertificateRevocationTests_InvalidRevokedCATest2() throws Exception {
622        String trustAnchor = "TrustAnchorRootCertificate.crt";
623
624        String[] certs = {
625                "InvalidRevokedCATest2EE.crt",
626                "RevokedsubCACert.crt",
627                "GoodCACert.crt",
628        };
629
630        String[] crls = {
631                "TrustAnchorRootCRL.crl",
632                "GoodCACRL.crl",
633                "RevokedsubCACRL.crl",
634        };
635
636        assertInvalidPath(trustAnchor, certs, crls);
637    }
638
639    /** NIST PKITS test 4.4.3 */
640    public void testBasicCertificateRevocationTests_InvalidRevokedEETest3() throws Exception {
641        String trustAnchor = "TrustAnchorRootCertificate.crt";
642
643        String[] certs = {
644                "InvalidRevokedEETest3EE.crt",
645                "GoodCACert.crt",
646        };
647
648        String[] crls = {
649                "TrustAnchorRootCRL.crl",
650                "GoodCACRL.crl",
651        };
652
653        assertInvalidPath(trustAnchor, certs, crls);
654    }
655
656    /** NIST PKITS test 4.4.4 */
657    public void testBasicCertificateRevocationTests_InvalidBadCRLSignatureTest4() throws Exception {
658        String trustAnchor = "TrustAnchorRootCertificate.crt";
659
660        String[] certs = {
661                "InvalidBadCRLSignatureTest4EE.crt",
662                "BadCRLSignatureCACert.crt",
663        };
664
665        String[] crls = {
666                "TrustAnchorRootCRL.crl",
667                "BadCRLSignatureCACRL.crl",
668        };
669
670        assertInvalidPath(trustAnchor, certs, crls);
671    }
672
673    /** NIST PKITS test 4.4.5 */
674    public void testBasicCertificateRevocationTests_InvalidBadCRLIssuerNameTest5() throws Exception {
675        String trustAnchor = "TrustAnchorRootCertificate.crt";
676
677        String[] certs = {
678                "InvalidBadCRLIssuerNameTest5EE.crt",
679                "BadCRLIssuerNameCACert.crt",
680        };
681
682        String[] crls = {
683                "TrustAnchorRootCRL.crl",
684                "BadCRLIssuerNameCACRL.crl",
685        };
686
687        assertInvalidPath(trustAnchor, certs, crls);
688    }
689
690    /** NIST PKITS test 4.4.6 */
691    public void testBasicCertificateRevocationTests_InvalidWrongCRLTest6() throws Exception {
692        String trustAnchor = "TrustAnchorRootCertificate.crt";
693
694        String[] certs = {
695                "InvalidWrongCRLTest6EE.crt",
696                "WrongCRLCACert.crt",
697        };
698
699        String[] crls = {
700                "TrustAnchorRootCRL.crl",
701                "WrongCRLCACRL.crl",
702        };
703
704        assertInvalidPath(trustAnchor, certs, crls);
705    }
706
707    /** NIST PKITS test 4.4.7 */
708    public void testBasicCertificateRevocationTests_ValidTwoCRLsTest7() throws Exception {
709        String trustAnchor = "TrustAnchorRootCertificate.crt";
710
711        String[] certs = {
712                "ValidTwoCRLsTest7EE.crt",
713                "TwoCRLsCACert.crt",
714        };
715
716        String[] crls = {
717                "TrustAnchorRootCRL.crl",
718                "TwoCRLsCAGoodCRL.crl",
719                "TwoCRLsCABadCRL.crl",
720        };
721
722        assertValidPath(trustAnchor, certs, crls);
723    }
724
725    /** NIST PKITS test 4.4.8 */
726    public void testBasicCertificateRevocationTests_InvalidUnknownCRLEntryExtensionTest8() throws Exception {
727        String trustAnchor = "TrustAnchorRootCertificate.crt";
728
729        String[] certs = {
730                "InvalidUnknownCRLEntryExtensionTest8EE.crt",
731                "UnknownCRLEntryExtensionCACert.crt",
732        };
733
734        String[] crls = {
735                "TrustAnchorRootCRL.crl",
736                "UnknownCRLEntryExtensionCACRL.crl",
737        };
738
739        assertInvalidPath(trustAnchor, certs, crls);
740    }
741
742    /** NIST PKITS test 4.4.9 */
743    public void testBasicCertificateRevocationTests_InvalidUnknownCRLExtensionTest9() throws Exception {
744        String trustAnchor = "TrustAnchorRootCertificate.crt";
745
746        String[] certs = {
747                "InvalidUnknownCRLExtensionTest9EE.crt",
748                "UnknownCRLExtensionCACert.crt",
749        };
750
751        String[] crls = {
752                "TrustAnchorRootCRL.crl",
753                "UnknownCRLExtensionCACRL.crl",
754        };
755
756        assertInvalidPath(trustAnchor, certs, crls);
757    }
758
759    /** NIST PKITS test 4.4.10 */
760    public void testBasicCertificateRevocationTests_InvalidUnknownCRLExtensionTest10() throws Exception {
761        String trustAnchor = "TrustAnchorRootCertificate.crt";
762
763        String[] certs = {
764                "InvalidUnknownCRLExtensionTest10EE.crt",
765                "UnknownCRLExtensionCACert.crt",
766        };
767
768        String[] crls = {
769                "TrustAnchorRootCRL.crl",
770                "UnknownCRLExtensionCACRL.crl",
771        };
772
773        assertInvalidPath(trustAnchor, certs, crls);
774    }
775
776    /** NIST PKITS test 4.4.11 */
777    public void testBasicCertificateRevocationTests_InvalidOldCRLnextUpdateTest11() throws Exception {
778        String trustAnchor = "TrustAnchorRootCertificate.crt";
779
780        String[] certs = {
781                "InvalidOldCRLnextUpdateTest11EE.crt",
782                "OldCRLnextUpdateCACert.crt",
783        };
784
785        String[] crls = {
786                "TrustAnchorRootCRL.crl",
787                "OldCRLnextUpdateCACRL.crl",
788        };
789
790        assertInvalidPath(trustAnchor, certs, crls);
791    }
792
793    /** NIST PKITS test 4.4.12 */
794    public void testBasicCertificateRevocationTests_Invalidpre2000CRLnextUpdateTest12() throws Exception {
795        String trustAnchor = "TrustAnchorRootCertificate.crt";
796
797        String[] certs = {
798                "Invalidpre2000CRLnextUpdateTest12EE.crt",
799                "pre2000CRLnextUpdateCACert.crt",
800        };
801
802        String[] crls = {
803                "TrustAnchorRootCRL.crl",
804                "pre2000CRLnextUpdateCACRL.crl",
805        };
806
807        assertInvalidPath(trustAnchor, certs, crls);
808    }
809
810    /** NIST PKITS test 4.4.13 */
811    public void testBasicCertificateRevocationTests_ValidGeneralizedTimeCRLnextUpdateTest13() throws Exception {
812        String trustAnchor = "TrustAnchorRootCertificate.crt";
813
814        String[] certs = {
815                "ValidGeneralizedTimeCRLnextUpdateTest13EE.crt",
816                "GeneralizedTimeCRLnextUpdateCACert.crt",
817        };
818
819        String[] crls = {
820                "TrustAnchorRootCRL.crl",
821                "GeneralizedTimeCRLnextUpdateCACRL.crl",
822        };
823
824        assertValidPath(trustAnchor, certs, crls);
825    }
826
827    /** NIST PKITS test 4.4.14 */
828    public void testBasicCertificateRevocationTests_ValidNegativeSerialNumberTest14() throws Exception {
829        String trustAnchor = "TrustAnchorRootCertificate.crt";
830
831        String[] certs = {
832                "ValidNegativeSerialNumberTest14EE.crt",
833                "NegativeSerialNumberCACert.crt",
834        };
835
836        String[] crls = {
837                "TrustAnchorRootCRL.crl",
838                "NegativeSerialNumberCACRL.crl",
839        };
840
841        assertValidPath(trustAnchor, certs, crls);
842    }
843
844    /** NIST PKITS test 4.4.15 */
845    public void testBasicCertificateRevocationTests_InvalidNegativeSerialNumberTest15() throws Exception {
846        String trustAnchor = "TrustAnchorRootCertificate.crt";
847
848        String[] certs = {
849                "InvalidNegativeSerialNumberTest15EE.crt",
850                "NegativeSerialNumberCACert.crt",
851        };
852
853        String[] crls = {
854                "TrustAnchorRootCRL.crl",
855                "NegativeSerialNumberCACRL.crl",
856        };
857
858        assertInvalidPath(trustAnchor, certs, crls);
859    }
860
861    /** NIST PKITS test 4.4.16 */
862    public void testBasicCertificateRevocationTests_ValidLongSerialNumberTest16() throws Exception {
863        String trustAnchor = "TrustAnchorRootCertificate.crt";
864
865        String[] certs = {
866                "ValidLongSerialNumberTest16EE.crt",
867                "LongSerialNumberCACert.crt",
868        };
869
870        String[] crls = {
871                "TrustAnchorRootCRL.crl",
872                "LongSerialNumberCACRL.crl",
873        };
874
875        assertValidPath(trustAnchor, certs, crls);
876    }
877
878    /** NIST PKITS test 4.4.17 */
879    public void testBasicCertificateRevocationTests_ValidLongSerialNumberTest17() throws Exception {
880        String trustAnchor = "TrustAnchorRootCertificate.crt";
881
882        String[] certs = {
883                "ValidLongSerialNumberTest17EE.crt",
884                "LongSerialNumberCACert.crt",
885        };
886
887        String[] crls = {
888                "TrustAnchorRootCRL.crl",
889                "LongSerialNumberCACRL.crl",
890        };
891
892        assertValidPath(trustAnchor, certs, crls);
893    }
894
895    /** NIST PKITS test 4.4.18 */
896    public void testBasicCertificateRevocationTests_InvalidLongSerialNumberTest18() throws Exception {
897        String trustAnchor = "TrustAnchorRootCertificate.crt";
898
899        String[] certs = {
900                "InvalidLongSerialNumberTest18EE.crt",
901                "LongSerialNumberCACert.crt",
902        };
903
904        String[] crls = {
905                "TrustAnchorRootCRL.crl",
906                "LongSerialNumberCACRL.crl",
907        };
908
909        assertInvalidPath(trustAnchor, certs, crls);
910    }
911
912    /** NIST PKITS test 4.4.19 */
913    public void testBasicCertificateRevocationTests_ValidSeparateCertificateandCRLKeysTest19() throws Exception {
914        String trustAnchor = "TrustAnchorRootCertificate.crt";
915
916        String[] certs = {
917                "ValidSeparateCertificateandCRLKeysTest19EE.crt",
918                "SeparateCertificateandCRLKeysCRLSigningCert.crt",
919                "SeparateCertificateandCRLKeysCertificateSigningCACert.crt",
920        };
921
922        String[] crls = {
923                "TrustAnchorRootCRL.crl",
924                "SeparateCertificateandCRLKeysCRL.crl",
925        };
926
927        assertValidPath(trustAnchor, certs, crls);
928    }
929
930    /** NIST PKITS test 4.4.20 */
931    public void testBasicCertificateRevocationTests_InvalidSeparateCertificateandCRLKeysTest20() throws Exception {
932        String trustAnchor = "TrustAnchorRootCertificate.crt";
933
934        String[] certs = {
935                "InvalidSeparateCertificateandCRLKeysTest20EE.crt",
936                "SeparateCertificateandCRLKeysCRLSigningCert.crt",
937                "SeparateCertificateandCRLKeysCertificateSigningCACert.crt",
938        };
939
940        String[] crls = {
941                "TrustAnchorRootCRL.crl",
942                "SeparateCertificateandCRLKeysCRL.crl",
943        };
944
945        assertValidPath(trustAnchor, certs, crls);
946    }
947
948    /** NIST PKITS test 4.4.21 */
949    public void testBasicCertificateRevocationTests_InvalidSeparateCertificateandCRLKeysTest21() throws Exception {
950        String trustAnchor = "TrustAnchorRootCertificate.crt";
951
952        String[] certs = {
953                "InvalidSeparateCertificateandCRLKeysTest21EE.crt",
954                "SeparateCertificateandCRLKeysCA2CRLSigningCert.crt",
955                "SeparateCertificateandCRLKeysCA2CertificateSigningCACert.crt",
956        };
957
958        String[] crls = {
959                "TrustAnchorRootCRL.crl",
960                "SeparateCertificateandCRLKeysCA2CRL.crl",
961        };
962
963        assertValidPath(trustAnchor, certs, crls);
964    }
965
966    /** NIST PKITS test 4.5.1 */
967    public void testVerifyingPathswithSelfIssuedCertificates_ValidBasicSelfIssuedOldWithNewTest1() throws Exception {
968        String trustAnchor = "TrustAnchorRootCertificate.crt";
969
970        String[] certs = {
971                "ValidBasicSelfIssuedOldWithNewTest1EE.crt",
972                "BasicSelfIssuedNewKeyOldWithNewCACert.crt",
973                "BasicSelfIssuedNewKeyCACert.crt",
974        };
975
976        String[] crls = {
977                "TrustAnchorRootCRL.crl",
978                "BasicSelfIssuedNewKeyCACRL.crl",
979        };
980
981        assertValidPath(trustAnchor, certs, crls);
982    }
983
984    /** NIST PKITS test 4.5.2 */
985    public void testVerifyingPathswithSelfIssuedCertificates_InvalidBasicSelfIssuedOldWithNewTest2() throws Exception {
986        String trustAnchor = "TrustAnchorRootCertificate.crt";
987
988        String[] certs = {
989                "InvalidBasicSelfIssuedOldWithNewTest2EE.crt",
990                "BasicSelfIssuedNewKeyOldWithNewCACert.crt",
991                "BasicSelfIssuedNewKeyCACert.crt",
992        };
993
994        String[] crls = {
995                "TrustAnchorRootCRL.crl",
996                "BasicSelfIssuedNewKeyCACRL.crl",
997        };
998
999        assertInvalidPath(trustAnchor, certs, crls);
1000    }
1001
1002    /** NIST PKITS test 4.5.3 */
1003    public void testVerifyingPathswithSelfIssuedCertificates_ValidBasicSelfIssuedNewWithOldTest3() throws Exception {
1004        String trustAnchor = "TrustAnchorRootCertificate.crt";
1005
1006        String[] certs = {
1007                "ValidBasicSelfIssuedNewWithOldTest3EE.crt",
1008                "BasicSelfIssuedOldKeyNewWithOldCACert.crt",
1009                "BasicSelfIssuedOldKeyCACert.crt",
1010        };
1011
1012        String[] crls = {
1013                "TrustAnchorRootCRL.crl",
1014                "BasicSelfIssuedOldKeySelfIssuedCertCRL.crl",
1015                "BasicSelfIssuedOldKeyCACRL.crl",
1016        };
1017
1018        assertValidPath(trustAnchor, certs, crls);
1019    }
1020
1021    /** NIST PKITS test 4.5.4 */
1022    public void testVerifyingPathswithSelfIssuedCertificates_ValidBasicSelfIssuedNewWithOldTest4() throws Exception {
1023        String trustAnchor = "TrustAnchorRootCertificate.crt";
1024
1025        String[] certs = {
1026                "ValidBasicSelfIssuedNewWithOldTest4EE.crt",
1027                "BasicSelfIssuedOldKeyNewWithOldCACert.crt",
1028                "BasicSelfIssuedOldKeyCACert.crt",
1029        };
1030
1031        String[] crls = {
1032                "TrustAnchorRootCRL.crl",
1033                "BasicSelfIssuedOldKeySelfIssuedCertCRL.crl",
1034                "BasicSelfIssuedOldKeyCACRL.crl",
1035        };
1036
1037        assertValidPath(trustAnchor, certs, crls);
1038    }
1039
1040    /** NIST PKITS test 4.5.5 */
1041    public void testVerifyingPathswithSelfIssuedCertificates_InvalidBasicSelfIssuedNewWithOldTest5() throws Exception {
1042        String trustAnchor = "TrustAnchorRootCertificate.crt";
1043
1044        String[] certs = {
1045                "InvalidBasicSelfIssuedNewWithOldTest5EE.crt",
1046                "BasicSelfIssuedOldKeyNewWithOldCACert.crt",
1047                "BasicSelfIssuedOldKeyCACert.crt",
1048        };
1049
1050        String[] crls = {
1051                "TrustAnchorRootCRL.crl",
1052                "BasicSelfIssuedOldKeySelfIssuedCertCRL.crl",
1053                "BasicSelfIssuedOldKeyCACRL.crl",
1054        };
1055
1056        assertInvalidPath(trustAnchor, certs, crls);
1057    }
1058
1059    /** NIST PKITS test 4.5.6 */
1060    public void testVerifyingPathswithSelfIssuedCertificates_ValidBasicSelfIssuedCRLSigningKeyTest6() throws Exception {
1061        String trustAnchor = "TrustAnchorRootCertificate.crt";
1062
1063        String[] certs = {
1064                "ValidBasicSelfIssuedCRLSigningKeyTest6EE.crt",
1065                "BasicSelfIssuedCRLSigningKeyCRLCert.crt",
1066                "BasicSelfIssuedCRLSigningKeyCACert.crt",
1067        };
1068
1069        String[] crls = {
1070                "TrustAnchorRootCRL.crl",
1071                "BasicSelfIssuedCRLSigningKeyCRLCertCRL.crl",
1072                "BasicSelfIssuedCRLSigningKeyCACRL.crl",
1073        };
1074
1075        assertValidPath(trustAnchor, certs, crls);
1076    }
1077
1078    /** NIST PKITS test 4.5.7 */
1079    public void testVerifyingPathswithSelfIssuedCertificates_InvalidBasicSelfIssuedCRLSigningKeyTest7() throws Exception {
1080        String trustAnchor = "TrustAnchorRootCertificate.crt";
1081
1082        String[] certs = {
1083                "InvalidBasicSelfIssuedCRLSigningKeyTest7EE.crt",
1084                "BasicSelfIssuedCRLSigningKeyCRLCert.crt",
1085                "BasicSelfIssuedCRLSigningKeyCACert.crt",
1086        };
1087
1088        String[] crls = {
1089                "TrustAnchorRootCRL.crl",
1090                "BasicSelfIssuedCRLSigningKeyCRLCertCRL.crl",
1091                "BasicSelfIssuedCRLSigningKeyCACRL.crl",
1092        };
1093
1094        assertInvalidPath(trustAnchor, certs, crls);
1095    }
1096
1097    /** NIST PKITS test 4.5.8 */
1098    public void testVerifyingPathswithSelfIssuedCertificates_InvalidBasicSelfIssuedCRLSigningKeyTest8() throws Exception {
1099        String trustAnchor = "TrustAnchorRootCertificate.crt";
1100
1101        String[] certs = {
1102                "InvalidBasicSelfIssuedCRLSigningKeyTest8EE.crt",
1103                "BasicSelfIssuedCRLSigningKeyCRLCert.crt",
1104                "BasicSelfIssuedCRLSigningKeyCACert.crt",
1105        };
1106
1107        String[] crls = {
1108                "TrustAnchorRootCRL.crl",
1109                "BasicSelfIssuedCRLSigningKeyCRLCertCRL.crl",
1110                "BasicSelfIssuedCRLSigningKeyCACRL.crl",
1111        };
1112
1113        assertInvalidPath(trustAnchor, certs, crls);
1114    }
1115
1116    /** NIST PKITS test 4.6.1 */
1117    public void testVerifyingBasicConstraints_InvalidMissingbasicConstraintsTest1() throws Exception {
1118        String trustAnchor = "TrustAnchorRootCertificate.crt";
1119
1120        String[] certs = {
1121                "InvalidMissingbasicConstraintsTest1EE.crt",
1122                "MissingbasicConstraintsCACert.crt",
1123        };
1124
1125        String[] crls = {
1126                "TrustAnchorRootCRL.crl",
1127                "MissingbasicConstraintsCACRL.crl",
1128        };
1129
1130        assertInvalidPath(trustAnchor, certs, crls);
1131    }
1132
1133    /** NIST PKITS test 4.6.2 */
1134    public void testVerifyingBasicConstraints_InvalidcAFalseTest2() throws Exception {
1135        String trustAnchor = "TrustAnchorRootCertificate.crt";
1136
1137        String[] certs = {
1138                "InvalidcAFalseTest2EE.crt",
1139                "basicConstraintsCriticalcAFalseCACert.crt",
1140        };
1141
1142        String[] crls = {
1143                "TrustAnchorRootCRL.crl",
1144                "basicConstraintsCriticalcAFalseCACRL.crl",
1145        };
1146
1147        assertInvalidPath(trustAnchor, certs, crls);
1148    }
1149
1150    /** NIST PKITS test 4.6.3 */
1151    public void testVerifyingBasicConstraints_InvalidcAFalseTest3() throws Exception {
1152        String trustAnchor = "TrustAnchorRootCertificate.crt";
1153
1154        String[] certs = {
1155                "InvalidcAFalseTest3EE.crt",
1156                "basicConstraintsNotCriticalcAFalseCACert.crt",
1157        };
1158
1159        String[] crls = {
1160                "TrustAnchorRootCRL.crl",
1161                "basicConstraintsNotCriticalcAFalseCACRL.crl",
1162        };
1163
1164        assertInvalidPath(trustAnchor, certs, crls);
1165    }
1166
1167    /** NIST PKITS test 4.6.4 */
1168    public void testVerifyingBasicConstraints_ValidbasicConstraintsNotCriticalTest4() throws Exception {
1169        String trustAnchor = "TrustAnchorRootCertificate.crt";
1170
1171        String[] certs = {
1172                "ValidbasicConstraintsNotCriticalTest4EE.crt",
1173                "basicConstraintsNotCriticalCACert.crt",
1174        };
1175
1176        String[] crls = {
1177                "TrustAnchorRootCRL.crl",
1178                "basicConstraintsNotCriticalCACRL.crl",
1179        };
1180
1181        assertValidPath(trustAnchor, certs, crls);
1182    }
1183
1184    /** NIST PKITS test 4.6.5 */
1185    public void testVerifyingBasicConstraints_InvalidpathLenConstraintTest5() throws Exception {
1186        String trustAnchor = "TrustAnchorRootCertificate.crt";
1187
1188        String[] certs = {
1189                "InvalidpathLenConstraintTest5EE.crt",
1190                "pathLenConstraint0subCACert.crt",
1191                "pathLenConstraint0CACert.crt",
1192        };
1193
1194        String[] crls = {
1195                "TrustAnchorRootCRL.crl",
1196                "pathLenConstraint0CACRL.crl",
1197                "pathLenConstraint0subCACRL.crl",
1198        };
1199
1200        assertInvalidPath(trustAnchor, certs, crls);
1201    }
1202
1203    /** NIST PKITS test 4.6.6 */
1204    public void testVerifyingBasicConstraints_InvalidpathLenConstraintTest6() throws Exception {
1205        String trustAnchor = "TrustAnchorRootCertificate.crt";
1206
1207        String[] certs = {
1208                "InvalidpathLenConstraintTest6EE.crt",
1209                "pathLenConstraint0subCACert.crt",
1210                "pathLenConstraint0CACert.crt",
1211        };
1212
1213        String[] crls = {
1214                "TrustAnchorRootCRL.crl",
1215                "pathLenConstraint0CACRL.crl",
1216                "pathLenConstraint0subCACRL.crl",
1217        };
1218
1219        assertInvalidPath(trustAnchor, certs, crls);
1220    }
1221
1222    /** NIST PKITS test 4.6.7 */
1223    public void testVerifyingBasicConstraints_ValidpathLenConstraintTest7() throws Exception {
1224        String trustAnchor = "TrustAnchorRootCertificate.crt";
1225
1226        String[] certs = {
1227                "ValidpathLenConstraintTest7EE.crt",
1228                "pathLenConstraint0CACert.crt",
1229        };
1230
1231        String[] crls = {
1232                "TrustAnchorRootCRL.crl",
1233                "pathLenConstraint0CACRL.crl",
1234        };
1235
1236        assertValidPath(trustAnchor, certs, crls);
1237    }
1238
1239    /** NIST PKITS test 4.6.8 */
1240    public void testVerifyingBasicConstraints_ValidpathLenConstraintTest8() throws Exception {
1241        String trustAnchor = "TrustAnchorRootCertificate.crt";
1242
1243        String[] certs = {
1244                "ValidpathLenConstraintTest8EE.crt",
1245                "pathLenConstraint0CACert.crt",
1246        };
1247
1248        String[] crls = {
1249                "TrustAnchorRootCRL.crl",
1250                "pathLenConstraint0CACRL.crl",
1251        };
1252
1253        assertValidPath(trustAnchor, certs, crls);
1254    }
1255
1256    /** NIST PKITS test 4.6.9 */
1257    public void testVerifyingBasicConstraints_InvalidpathLenConstraintTest9() throws Exception {
1258        String trustAnchor = "TrustAnchorRootCertificate.crt";
1259
1260        String[] certs = {
1261                "InvalidpathLenConstraintTest9EE.crt",
1262                "pathLenConstraint6subsubCA00Cert.crt",
1263                "pathLenConstraint6subCA0Cert.crt",
1264                "pathLenConstraint6CACert.crt",
1265        };
1266
1267        String[] crls = {
1268                "TrustAnchorRootCRL.crl",
1269                "pathLenConstraint6CACRL.crl",
1270                "pathLenConstraint6subCA0CRL.crl",
1271                "pathLenConstraint6subsubCA00CRL.crl",
1272        };
1273
1274        assertInvalidPath(trustAnchor, certs, crls);
1275    }
1276
1277    /** NIST PKITS test 4.6.10 */
1278    public void testVerifyingBasicConstraints_InvalidpathLenConstraintTest10() throws Exception {
1279        String trustAnchor = "TrustAnchorRootCertificate.crt";
1280
1281        String[] certs = {
1282                "InvalidpathLenConstraintTest10EE.crt",
1283                "pathLenConstraint6subsubCA00Cert.crt",
1284                "pathLenConstraint6subCA0Cert.crt",
1285                "pathLenConstraint6CACert.crt",
1286        };
1287
1288        String[] crls = {
1289                "TrustAnchorRootCRL.crl",
1290                "pathLenConstraint6CACRL.crl",
1291                "pathLenConstraint6subCA0CRL.crl",
1292                "pathLenConstraint6subsubCA00CRL.crl",
1293        };
1294
1295        assertInvalidPath(trustAnchor, certs, crls);
1296    }
1297
1298    /** NIST PKITS test 4.6.11 */
1299    public void testVerifyingBasicConstraints_InvalidpathLenConstraintTest11() throws Exception {
1300        String trustAnchor = "TrustAnchorRootCertificate.crt";
1301
1302        String[] certs = {
1303                "InvalidpathLenConstraintTest11EE.crt",
1304                "pathLenConstraint6subsubsubCA11XCert.crt",
1305                "pathLenConstraint6subsubCA11Cert.crt",
1306                "pathLenConstraint6subCA1Cert.crt",
1307                "pathLenConstraint6CACert.crt",
1308        };
1309
1310        String[] crls = {
1311                "TrustAnchorRootCRL.crl",
1312                "pathLenConstraint6CACRL.crl",
1313                "pathLenConstraint6subCA1CRL.crl",
1314                "pathLenConstraint6subsubCA11CRL.crl",
1315                "pathLenConstraint6subsubsubCA11XCRL.crl",
1316        };
1317
1318        assertInvalidPath(trustAnchor, certs, crls);
1319    }
1320
1321    /** NIST PKITS test 4.6.12 */
1322    public void testVerifyingBasicConstraints_InvalidpathLenConstraintTest12() throws Exception {
1323        String trustAnchor = "TrustAnchorRootCertificate.crt";
1324
1325        String[] certs = {
1326                "InvalidpathLenConstraintTest12EE.crt",
1327                "pathLenConstraint6subsubsubCA11XCert.crt",
1328                "pathLenConstraint6subsubCA11Cert.crt",
1329                "pathLenConstraint6subCA1Cert.crt",
1330                "pathLenConstraint6CACert.crt",
1331        };
1332
1333        String[] crls = {
1334                "TrustAnchorRootCRL.crl",
1335                "pathLenConstraint6CACRL.crl",
1336                "pathLenConstraint6subCA1CRL.crl",
1337                "pathLenConstraint6subsubCA11CRL.crl",
1338                "pathLenConstraint6subsubsubCA11XCRL.crl",
1339        };
1340
1341        assertInvalidPath(trustAnchor, certs, crls);
1342    }
1343
1344    /** NIST PKITS test 4.6.13 */
1345    public void testVerifyingBasicConstraints_ValidpathLenConstraintTest13() throws Exception {
1346        String trustAnchor = "TrustAnchorRootCertificate.crt";
1347
1348        String[] certs = {
1349                "ValidpathLenConstraintTest13EE.crt",
1350                "pathLenConstraint6subsubsubCA41XCert.crt",
1351                "pathLenConstraint6subsubCA41Cert.crt",
1352                "pathLenConstraint6subCA4Cert.crt",
1353                "pathLenConstraint6CACert.crt",
1354        };
1355
1356        String[] crls = {
1357                "TrustAnchorRootCRL.crl",
1358                "pathLenConstraint6CACRL.crl",
1359                "pathLenConstraint6subCA4CRL.crl",
1360                "pathLenConstraint6subsubCA41CRL.crl",
1361                "pathLenConstraint6subsubsubCA41XCRL.crl",
1362        };
1363
1364        assertValidPath(trustAnchor, certs, crls);
1365    }
1366
1367    /** NIST PKITS test 4.6.14 */
1368    public void testVerifyingBasicConstraints_ValidpathLenConstraintTest14() throws Exception {
1369        String trustAnchor = "TrustAnchorRootCertificate.crt";
1370
1371        String[] certs = {
1372                "ValidpathLenConstraintTest14EE.crt",
1373                "pathLenConstraint6subsubsubCA41XCert.crt",
1374                "pathLenConstraint6subsubCA41Cert.crt",
1375                "pathLenConstraint6subCA4Cert.crt",
1376                "pathLenConstraint6CACert.crt",
1377        };
1378
1379        String[] crls = {
1380                "TrustAnchorRootCRL.crl",
1381                "pathLenConstraint6CACRL.crl",
1382                "pathLenConstraint6subCA4CRL.crl",
1383                "pathLenConstraint6subsubCA41CRL.crl",
1384                "pathLenConstraint6subsubsubCA41XCRL.crl",
1385        };
1386
1387        assertValidPath(trustAnchor, certs, crls);
1388    }
1389
1390    /** NIST PKITS test 4.6.15 */
1391    public void testVerifyingBasicConstraints_ValidSelfIssuedpathLenConstraintTest15() throws Exception {
1392        String trustAnchor = "TrustAnchorRootCertificate.crt";
1393
1394        String[] certs = {
1395                "ValidSelfIssuedpathLenConstraintTest15EE.crt",
1396                "pathLenConstraint0SelfIssuedCACert.crt",
1397                "pathLenConstraint0CACert.crt",
1398        };
1399
1400        String[] crls = {
1401                "TrustAnchorRootCRL.crl",
1402                "pathLenConstraint0CACRL.crl",
1403        };
1404
1405        assertValidPath(trustAnchor, certs, crls);
1406    }
1407
1408    /** NIST PKITS test 4.6.16 */
1409    public void testVerifyingBasicConstraints_InvalidSelfIssuedpathLenConstraintTest16() throws Exception {
1410        String trustAnchor = "TrustAnchorRootCertificate.crt";
1411
1412        String[] certs = {
1413                "InvalidSelfIssuedpathLenConstraintTest16EE.crt",
1414                "pathLenConstraint0subCA2Cert.crt",
1415                "pathLenConstraint0SelfIssuedCACert.crt",
1416                "pathLenConstraint0CACert.crt",
1417        };
1418
1419        String[] crls = {
1420                "TrustAnchorRootCRL.crl",
1421                "pathLenConstraint0CACRL.crl",
1422                "pathLenConstraint0subCA2CRL.crl",
1423        };
1424
1425        assertInvalidPath(trustAnchor, certs, crls);
1426    }
1427
1428    /** NIST PKITS test 4.6.17 */
1429    public void testVerifyingBasicConstraints_ValidSelfIssuedpathLenConstraintTest17() throws Exception {
1430        String trustAnchor = "TrustAnchorRootCertificate.crt";
1431
1432        String[] certs = {
1433                "ValidSelfIssuedpathLenConstraintTest17EE.crt",
1434                "pathLenConstraint1SelfIssuedsubCACert.crt",
1435                "pathLenConstraint1subCACert.crt",
1436                "pathLenConstraint1SelfIssuedCACert.crt",
1437                "pathLenConstraint1CACert.crt",
1438        };
1439
1440        String[] crls = {
1441                "TrustAnchorRootCRL.crl",
1442                "pathLenConstraint1CACRL.crl",
1443                "pathLenConstraint1subCACRL.crl",
1444        };
1445
1446        assertValidPath(trustAnchor, certs, crls);
1447    }
1448
1449    /** NIST PKITS test 4.7.1 */
1450    public void testKeyUsage_InvalidkeyUsageCriticalkeyCertSignFalseTest1() throws Exception {
1451        String trustAnchor = "TrustAnchorRootCertificate.crt";
1452
1453        String[] certs = {
1454                "InvalidkeyUsageCriticalkeyCertSignFalseTest1EE.crt",
1455                "keyUsageCriticalkeyCertSignFalseCACert.crt",
1456        };
1457
1458        String[] crls = {
1459                "TrustAnchorRootCRL.crl",
1460                "keyUsageCriticalkeyCertSignFalseCACRL.crl",
1461        };
1462
1463        assertInvalidPath(trustAnchor, certs, crls);
1464    }
1465
1466    /** NIST PKITS test 4.7.2 */
1467    public void testKeyUsage_InvalidkeyUsageNotCriticalkeyCertSignFalseTest2() throws Exception {
1468        String trustAnchor = "TrustAnchorRootCertificate.crt";
1469
1470        String[] certs = {
1471                "InvalidkeyUsageNotCriticalkeyCertSignFalseTest2EE.crt",
1472                "keyUsageNotCriticalkeyCertSignFalseCACert.crt",
1473        };
1474
1475        String[] crls = {
1476                "TrustAnchorRootCRL.crl",
1477                "keyUsageNotCriticalkeyCertSignFalseCACRL.crl",
1478        };
1479
1480        assertInvalidPath(trustAnchor, certs, crls);
1481    }
1482
1483    /** NIST PKITS test 4.7.3 */
1484    public void testKeyUsage_ValidkeyUsageNotCriticalTest3() throws Exception {
1485        String trustAnchor = "TrustAnchorRootCertificate.crt";
1486
1487        String[] certs = {
1488                "ValidkeyUsageNotCriticalTest3EE.crt",
1489                "keyUsageNotCriticalCACert.crt",
1490        };
1491
1492        String[] crls = {
1493                "TrustAnchorRootCRL.crl",
1494                "keyUsageNotCriticalCACRL.crl",
1495        };
1496
1497        assertValidPath(trustAnchor, certs, crls);
1498    }
1499
1500    /** NIST PKITS test 4.7.4 */
1501    public void testKeyUsage_InvalidkeyUsageCriticalcRLSignFalseTest4() throws Exception {
1502        String trustAnchor = "TrustAnchorRootCertificate.crt";
1503
1504        String[] certs = {
1505                "InvalidkeyUsageCriticalcRLSignFalseTest4EE.crt",
1506                "keyUsageCriticalcRLSignFalseCACert.crt",
1507        };
1508
1509        String[] crls = {
1510                "TrustAnchorRootCRL.crl",
1511                "keyUsageCriticalcRLSignFalseCACRL.crl",
1512        };
1513
1514        assertInvalidPath(trustAnchor, certs, crls);
1515    }
1516
1517    /** NIST PKITS test 4.7.5 */
1518    public void testKeyUsage_InvalidkeyUsageNotCriticalcRLSignFalseTest5() throws Exception {
1519        String trustAnchor = "TrustAnchorRootCertificate.crt";
1520
1521        String[] certs = {
1522                "InvalidkeyUsageNotCriticalcRLSignFalseTest5EE.crt",
1523                "keyUsageNotCriticalcRLSignFalseCACert.crt",
1524        };
1525
1526        String[] crls = {
1527                "TrustAnchorRootCRL.crl",
1528                "keyUsageNotCriticalcRLSignFalseCACRL.crl",
1529        };
1530
1531        assertInvalidPath(trustAnchor, certs, crls);
1532    }
1533
1534    // skipping sections 4.8 to 4.12
1535
1536    /** NIST PKITS test 4.13.1 */
1537    public void testKeyUsage_ValidDNnameConstraintsTest1() throws Exception {
1538        String trustAnchor = "TrustAnchorRootCertificate.crt";
1539
1540        String[] certs = {
1541                "ValidDNnameConstraintsTest1EE.crt",
1542                "nameConstraintsDN1CACert.crt",
1543        };
1544
1545        String[] crls = {
1546                "TrustAnchorRootCRL.crl",
1547                "nameConstraintsDN1CACRL.crl",
1548        };
1549
1550        assertValidPath(trustAnchor, certs, crls);
1551    }
1552
1553    /** NIST PKITS test 4.13.2 */
1554    public void testKeyUsage_InvalidDNnameConstraintsTest2() throws Exception {
1555        String trustAnchor = "TrustAnchorRootCertificate.crt";
1556
1557        String[] certs = {
1558                "InvalidDNnameConstraintsTest2EE.crt",
1559                "nameConstraintsDN1CACert.crt",
1560        };
1561
1562        String[] crls = {
1563                "TrustAnchorRootCRL.crl",
1564                "nameConstraintsDN1CACRL.crl",
1565        };
1566
1567        assertInvalidPath(trustAnchor, certs, crls);
1568    }
1569
1570    /** NIST PKITS test 4.13.3 */
1571    public void testKeyUsage_InvalidDNnameConstraintsTest3() throws Exception {
1572        String trustAnchor = "TrustAnchorRootCertificate.crt";
1573
1574        String[] certs = {
1575                "InvalidDNnameConstraintsTest3EE.crt",
1576                "nameConstraintsDN1CACert.crt",
1577        };
1578
1579        String[] crls = {
1580                "TrustAnchorRootCRL.crl",
1581                "nameConstraintsDN1CACRL.crl",
1582        };
1583
1584        assertInvalidPath(trustAnchor, certs, crls);
1585    }
1586
1587    /** NIST PKITS test 4.13.4 */
1588    public void testKeyUsage_ValidDNnameConstraintsTest4() throws Exception {
1589        String trustAnchor = "TrustAnchorRootCertificate.crt";
1590
1591        String[] certs = {
1592                "ValidDNnameConstraintsTest4EE.crt",
1593                "nameConstraintsDN1CACert.crt",
1594        };
1595
1596        String[] crls = {
1597                "TrustAnchorRootCRL.crl",
1598                "nameConstraintsDN1CACRL.crl",
1599        };
1600
1601        assertValidPath(trustAnchor, certs, crls);
1602    }
1603
1604    /** NIST PKITS test 4.13.5 */
1605    public void testKeyUsage_ValidDNnameConstraintsTest5() throws Exception {
1606        String trustAnchor = "TrustAnchorRootCertificate.crt";
1607
1608        String[] certs = {
1609                "ValidDNnameConstraintsTest5EE.crt",
1610                "nameConstraintsDN2CACert.crt",
1611        };
1612
1613        String[] crls = {
1614                "TrustAnchorRootCRL.crl",
1615                "nameConstraintsDN2CACRL.crl",
1616        };
1617
1618        assertValidPath(trustAnchor, certs, crls);
1619    }
1620
1621    /** NIST PKITS test 4.13.6 */
1622    public void testKeyUsage_ValidDNnameConstraintsTest6() throws Exception {
1623        String trustAnchor = "TrustAnchorRootCertificate.crt";
1624
1625        String[] certs = {
1626                "ValidDNnameConstraintsTest6EE.crt",
1627                "nameConstraintsDN3CACert.crt",
1628        };
1629
1630        String[] crls = {
1631                "TrustAnchorRootCRL.crl",
1632                "nameConstraintsDN3CACRL.crl",
1633        };
1634
1635        assertValidPath(trustAnchor, certs, crls);
1636    }
1637
1638    /** NIST PKITS test 4.13.7 */
1639    public void testKeyUsage_InvalidDNnameConstraintsTest7() throws Exception {
1640        String trustAnchor = "TrustAnchorRootCertificate.crt";
1641
1642        String[] certs = {
1643                "InvalidDNnameConstraintsTest7EE.crt",
1644                "nameConstraintsDN3CACert.crt",
1645        };
1646
1647        String[] crls = {
1648                "TrustAnchorRootCRL.crl",
1649                "nameConstraintsDN3CACRL.crl",
1650        };
1651
1652        assertInvalidPath(trustAnchor, certs, crls);
1653    }
1654
1655    /** NIST PKITS test 4.13.8 */
1656    public void testKeyUsage_InvalidDNnameConstraintsTest8() throws Exception {
1657        String trustAnchor = "TrustAnchorRootCertificate.crt";
1658
1659        String[] certs = {
1660                "InvalidDNnameConstraintsTest8EE.crt",
1661                "nameConstraintsDN4CACert.crt",
1662        };
1663
1664        String[] crls = {
1665                "TrustAnchorRootCRL.crl",
1666                "nameConstraintsDN4CACRL.crl",
1667        };
1668
1669        assertInvalidPath(trustAnchor, certs, crls);
1670    }
1671
1672    /** NIST PKITS test 4.13.9 */
1673    public void testKeyUsage_InvalidDNnameConstraintsTest9() throws Exception {
1674        String trustAnchor = "TrustAnchorRootCertificate.crt";
1675
1676        String[] certs = {
1677                "InvalidDNnameConstraintsTest9EE.crt",
1678                "nameConstraintsDN4CACert.crt",
1679        };
1680
1681        String[] crls = {
1682                "TrustAnchorRootCRL.crl",
1683                "nameConstraintsDN4CACRL.crl",
1684        };
1685
1686        assertInvalidPath(trustAnchor, certs, crls);
1687    }
1688
1689    /** NIST PKITS test 4.13.10 */
1690    public void testKeyUsage_InvalidDNnameConstraintsTest10() throws Exception {
1691        String trustAnchor = "TrustAnchorRootCertificate.crt";
1692
1693        String[] certs = {
1694                "InvalidDNnameConstraintsTest10EE.crt",
1695                "nameConstraintsDN5CACert.crt",
1696        };
1697
1698        String[] crls = {
1699                "TrustAnchorRootCRL.crl",
1700                "nameConstraintsDN5CACRL.crl",
1701        };
1702
1703        assertInvalidPath(trustAnchor, certs, crls);
1704    }
1705
1706    /** NIST PKITS test 4.13.11 */
1707    public void testKeyUsage_ValidDNnameConstraintsTest11() throws Exception {
1708        String trustAnchor = "TrustAnchorRootCertificate.crt";
1709
1710        String[] certs = {
1711                "ValidDNnameConstraintsTest11EE.crt",
1712                "nameConstraintsDN5CACert.crt",
1713        };
1714
1715        String[] crls = {
1716                "TrustAnchorRootCRL.crl",
1717                "nameConstraintsDN5CACRL.crl",
1718        };
1719
1720        assertValidPath(trustAnchor, certs, crls);
1721    }
1722
1723    /** NIST PKITS test 4.13.12 */
1724    public void testKeyUsage_InvalidDNnameConstraintsTest12() throws Exception {
1725        String trustAnchor = "TrustAnchorRootCertificate.crt";
1726
1727        String[] certs = {
1728                "InvalidDNnameConstraintsTest12EE.crt",
1729                "nameConstraintsDN1subCA1Cert.crt",
1730                "nameConstraintsDN1CACert.crt",
1731        };
1732
1733        String[] crls = {
1734                "TrustAnchorRootCRL.crl",
1735                "nameConstraintsDN1CACRL.crl",
1736                "nameConstraintsDN1subCA1CRL.crl",
1737        };
1738
1739        assertInvalidPath(trustAnchor, certs, crls);
1740    }
1741
1742    /** NIST PKITS test 4.13.13 */
1743    public void testKeyUsage_InvalidDNnameConstraintsTest13() throws Exception {
1744        String trustAnchor = "TrustAnchorRootCertificate.crt";
1745
1746        String[] certs = {
1747                "InvalidDNnameConstraintsTest13EE.crt",
1748                "nameConstraintsDN1subCA2Cert.crt",
1749                "nameConstraintsDN1CACert.crt",
1750        };
1751
1752        String[] crls = {
1753                "TrustAnchorRootCRL.crl",
1754                "nameConstraintsDN1CACRL.crl",
1755                "nameConstraintsDN1subCA2CRL.crl",
1756        };
1757
1758        assertInvalidPath(trustAnchor, certs, crls);
1759    }
1760
1761    /** NIST PKITS test 4.13.14 */
1762    public void testKeyUsage_ValidDNnameConstraintsTest14() throws Exception {
1763        String trustAnchor = "TrustAnchorRootCertificate.crt";
1764
1765        String[] certs = {
1766                "ValidDNnameConstraintsTest14EE.crt",
1767                "nameConstraintsDN1subCA2Cert.crt",
1768                "nameConstraintsDN1CACert.crt",
1769        };
1770
1771        String[] crls = {
1772                "TrustAnchorRootCRL.crl",
1773                "nameConstraintsDN1CACRL.crl",
1774                "nameConstraintsDN1subCA2CRL.crl",
1775        };
1776
1777        assertValidPath(trustAnchor, certs, crls);
1778    }
1779
1780    /** NIST PKITS test 4.13.15 */
1781    public void testKeyUsage_InvalidDNnameConstraintsTest15() throws Exception {
1782        String trustAnchor = "TrustAnchorRootCertificate.crt";
1783
1784        String[] certs = {
1785                "InvalidDNnameConstraintsTest15EE.crt",
1786                "nameConstraintsDN3subCA1Cert.crt",
1787                "nameConstraintsDN3CACert.crt",
1788        };
1789
1790        String[] crls = {
1791                "TrustAnchorRootCRL.crl",
1792                "nameConstraintsDN3CACRL.crl",
1793                "nameConstraintsDN3subCA1CRL.crl",
1794        };
1795
1796        assertInvalidPath(trustAnchor, certs, crls);
1797    }
1798
1799    /** NIST PKITS test 4.13.16 */
1800    public void testKeyUsage_InvalidDNnameConstraintsTest16() throws Exception {
1801        String trustAnchor = "TrustAnchorRootCertificate.crt";
1802
1803        String[] certs = {
1804                "InvalidDNnameConstraintsTest16EE.crt",
1805                "nameConstraintsDN3subCA1Cert.crt",
1806                "nameConstraintsDN3CACert.crt",
1807        };
1808
1809        String[] crls = {
1810                "TrustAnchorRootCRL.crl",
1811                "nameConstraintsDN3CACRL.crl",
1812                "nameConstraintsDN3subCA1CRL.crl",
1813        };
1814
1815        assertInvalidPath(trustAnchor, certs, crls);
1816    }
1817
1818    /** NIST PKITS test 4.13.17 */
1819    public void testKeyUsage_InvalidDNnameConstraintsTest17() throws Exception {
1820        String trustAnchor = "TrustAnchorRootCertificate.crt";
1821
1822        String[] certs = {
1823                "InvalidDNnameConstraintsTest17EE.crt",
1824                "nameConstraintsDN3subCA2Cert.crt",
1825                "nameConstraintsDN3CACert.crt",
1826        };
1827
1828        String[] crls = {
1829                "TrustAnchorRootCRL.crl",
1830                "nameConstraintsDN3CACRL.crl",
1831                "nameConstraintsDN3subCA2CRL.crl",
1832        };
1833
1834        assertInvalidPath(trustAnchor, certs, crls);
1835    }
1836
1837    /** NIST PKITS test 4.13.18 */
1838    public void testKeyUsage_ValidDNnameConstraintsTest18() throws Exception {
1839        String trustAnchor = "TrustAnchorRootCertificate.crt";
1840
1841        String[] certs = {
1842                "ValidDNnameConstraintsTest18EE.crt",
1843                "nameConstraintsDN3subCA2Cert.crt",
1844                "nameConstraintsDN3CACert.crt",
1845        };
1846
1847        String[] crls = {
1848                "TrustAnchorRootCRL.crl",
1849                "nameConstraintsDN3CACRL.crl",
1850                "nameConstraintsDN3subCA2CRL.crl",
1851        };
1852
1853        assertValidPath(trustAnchor, certs, crls);
1854    }
1855
1856    /** NIST PKITS test 4.13.19 */
1857    public void testKeyUsage_ValidSelfIssuedDNnameConstraintsTest19() throws Exception {
1858        String trustAnchor = "TrustAnchorRootCertificate.crt";
1859
1860        String[] certs = {
1861                "ValidDNnameConstraintsTest19EE.crt",
1862                "nameConstraintsDN1SelfIssuedCACert.crt",
1863                "nameConstraintsDN1CACert.crt",
1864        };
1865
1866        String[] crls = {
1867                "TrustAnchorRootCRL.crl",
1868                "nameConstraintsDN1CACRL.crl",
1869        };
1870
1871        assertValidPath(trustAnchor, certs, crls);
1872    }
1873
1874    /** NIST PKITS test 4.13.20 */
1875    public void testKeyUsage_InvalidSelfIssuedDNnameConstraintsTest20() throws Exception {
1876        String trustAnchor = "TrustAnchorRootCertificate.crt";
1877
1878        String[] certs = {
1879                "InvalidDNnameConstraintsTest20EE.crt",
1880                "nameConstraintsDN1CACert.crt",
1881        };
1882
1883        String[] crls = {
1884                "TrustAnchorRootCRL.crl",
1885                "nameConstraintsDN1CACRL.crl",
1886        };
1887
1888        assertInvalidPath(trustAnchor, certs, crls);
1889    }
1890
1891    /** NIST PKITS test 4.13.21 */
1892    public void testKeyUsage_ValidRFC822nameConstraintsTest21() throws Exception {
1893        String trustAnchor = "TrustAnchorRootCertificate.crt";
1894
1895        String[] certs = {
1896                "ValidRFC822nameConstraintsTest21EE.crt",
1897                "nameConstraintsRFC822CA1Cert.crt",
1898        };
1899
1900        String[] crls = {
1901                "TrustAnchorRootCRL.crl",
1902                "nameConstraintsRFC822CA1CRL.crl",
1903        };
1904
1905        assertValidPath(trustAnchor, certs, crls);
1906    }
1907
1908    /** NIST PKITS test 4.13.22 */
1909    public void testKeyUsage_InvalidRFC822nameConstraintsTest22() throws Exception {
1910        String trustAnchor = "TrustAnchorRootCertificate.crt";
1911
1912        String[] certs = {
1913                "InvalidRFC822nameConstraintsTest22EE.crt",
1914                "nameConstraintsRFC822CA1Cert.crt",
1915        };
1916
1917        String[] crls = {
1918                "TrustAnchorRootCRL.crl",
1919                "nameConstraintsRFC822CA1CRL.crl",
1920        };
1921
1922        assertInvalidPath(trustAnchor, certs, crls);
1923    }
1924
1925    /** NIST PKITS test 4.13.23 */
1926    public void testKeyUsage_ValidRFC822nameConstraintsTest23() throws Exception {
1927        String trustAnchor = "TrustAnchorRootCertificate.crt";
1928
1929        String[] certs = {
1930                "ValidRFC822nameConstraintsTest23EE.crt",
1931                "nameConstraintsRFC822CA2Cert.crt",
1932        };
1933
1934        String[] crls = {
1935                "TrustAnchorRootCRL.crl",
1936                "nameConstraintsRFC822CA2CRL.crl",
1937        };
1938
1939        assertValidPath(trustAnchor, certs, crls);
1940    }
1941
1942    /** NIST PKITS test 4.13.24 */
1943    public void testKeyUsage_InvalidRFC822nameConstraintsTest24() throws Exception {
1944        String trustAnchor = "TrustAnchorRootCertificate.crt";
1945
1946        String[] certs = {
1947                "InvalidRFC822nameConstraintsTest24EE.crt",
1948                "nameConstraintsRFC822CA2Cert.crt",
1949        };
1950
1951        String[] crls = {
1952                "TrustAnchorRootCRL.crl",
1953                "nameConstraintsRFC822CA2CRL.crl",
1954        };
1955
1956        assertInvalidPath(trustAnchor, certs, crls);
1957    }
1958
1959    /** NIST PKITS test 4.13.25 */
1960    public void testKeyUsage_ValidRFC822nameConstraintsTest25() throws Exception {
1961        String trustAnchor = "TrustAnchorRootCertificate.crt";
1962
1963        String[] certs = {
1964                "ValidRFC822nameConstraintsTest25EE.crt",
1965                "nameConstraintsRFC822CA3Cert.crt",
1966        };
1967
1968        String[] crls = {
1969                "TrustAnchorRootCRL.crl",
1970                "nameConstraintsRFC822CA3CRL.crl",
1971        };
1972
1973        assertValidPath(trustAnchor, certs, crls);
1974    }
1975
1976    /** NIST PKITS test 4.13.26 */
1977    public void testKeyUsage_InvalidRFC822nameConstraintsTest26() throws Exception {
1978        String trustAnchor = "TrustAnchorRootCertificate.crt";
1979
1980        String[] certs = {
1981                "InvalidRFC822nameConstraintsTest26EE.crt",
1982                "nameConstraintsRFC822CA3Cert.crt",
1983        };
1984
1985        String[] crls = {
1986                "TrustAnchorRootCRL.crl",
1987                "nameConstraintsRFC822CA3CRL.crl",
1988        };
1989
1990        assertInvalidPath(trustAnchor, certs, crls);
1991    }
1992
1993    /** NIST PKITS test 4.13.27 */
1994    public void testKeyUsage_ValidDNandRFC822nameConstraintsTest27() throws Exception {
1995        String trustAnchor = "TrustAnchorRootCertificate.crt";
1996
1997        String[] certs = {
1998                "ValidDNandRFC822nameConstraintsTest27EE.crt",
1999                "nameConstraintsDN1subCA3Cert.crt",
2000                "nameConstraintsDN1CACert.crt",
2001        };
2002
2003        String[] crls = {
2004                "TrustAnchorRootCRL.crl",
2005                "nameConstraintsDN1CACRL.crl",
2006                "nameConstraintsDN1subCA3CRL.crl",
2007        };
2008
2009        assertValidPath(trustAnchor, certs, crls);
2010    }
2011
2012    /** NIST PKITS test 4.13.28 */
2013    public void testKeyUsage_InvalidDNandRFC822nameConstraintsTest28() throws Exception {
2014        String trustAnchor = "TrustAnchorRootCertificate.crt";
2015
2016        String[] certs = {
2017                "InvalidDNandRFC822nameConstraintsTest28EE.crt",
2018                "nameConstraintsDN1subCA3Cert.crt",
2019                "nameConstraintsDN1CACert.crt",
2020        };
2021
2022        String[] crls = {
2023                "TrustAnchorRootCRL.crl",
2024                "nameConstraintsDN1CACRL.crl",
2025                "nameConstraintsDN1subCA3CRL.crl",
2026        };
2027
2028        assertInvalidPath(trustAnchor, certs, crls);
2029    }
2030
2031    /** NIST PKITS test 4.13.29 */
2032    public void testKeyUsage_InvalidDNandRFC822nameConstraintsTest29() throws Exception {
2033        String trustAnchor = "TrustAnchorRootCertificate.crt";
2034
2035        String[] certs = {
2036                "InvalidDNandRFC822nameConstraintsTest29EE.crt",
2037                "nameConstraintsDN1subCA3Cert.crt",
2038                "nameConstraintsDN1CACert.crt",
2039        };
2040
2041        String[] crls = {
2042                "TrustAnchorRootCRL.crl",
2043                "nameConstraintsDN1CACRL.crl",
2044                "nameConstraintsDN1subCA3CRL.crl",
2045        };
2046
2047        assertInvalidPath(trustAnchor, certs, crls);
2048    }
2049
2050    /** NIST PKITS test 4.13.30 */
2051    public void testKeyUsage_ValidDNSnameConstraintsTest30() throws Exception {
2052        String trustAnchor = "TrustAnchorRootCertificate.crt";
2053
2054        String[] certs = {
2055                "ValidDNSnameConstraintsTest30EE.crt",
2056                "nameConstraintsDNS1CACert.crt",
2057        };
2058
2059        String[] crls = {
2060                "TrustAnchorRootCRL.crl",
2061                "nameConstraintsDNS1CACRL.crl",
2062        };
2063
2064        assertValidPath(trustAnchor, certs, crls);
2065    }
2066
2067    /** NIST PKITS test 4.13.31 */
2068    public void testKeyUsage_InvalidDNSnameConstraintsTest31() throws Exception {
2069        String trustAnchor = "TrustAnchorRootCertificate.crt";
2070
2071        String[] certs = {
2072                "InvalidDNSnameConstraintsTest31EE.crt",
2073                "nameConstraintsDNS1CACert.crt",
2074        };
2075
2076        String[] crls = {
2077                "TrustAnchorRootCRL.crl",
2078                "nameConstraintsDNS1CACRL.crl",
2079        };
2080
2081        assertInvalidPath(trustAnchor, certs, crls);
2082    }
2083
2084    /** NIST PKITS test 4.13.32 */
2085    public void testKeyUsage_ValidDNSnameConstraintsTest32() throws Exception {
2086        String trustAnchor = "TrustAnchorRootCertificate.crt";
2087
2088        String[] certs = {
2089                "ValidDNSnameConstraintsTest32EE.crt",
2090                "nameConstraintsDNS2CACert.crt",
2091        };
2092
2093        String[] crls = {
2094                "TrustAnchorRootCRL.crl",
2095                "nameConstraintsDNS2CACRL.crl",
2096        };
2097
2098        assertValidPath(trustAnchor, certs, crls);
2099    }
2100
2101    /** NIST PKITS test 4.13.33 */
2102    public void testKeyUsage_InvalidDNSnameConstraintsTest33() throws Exception {
2103        String trustAnchor = "TrustAnchorRootCertificate.crt";
2104
2105        String[] certs = {
2106                "InvalidDNSnameConstraintsTest33EE.crt",
2107                "nameConstraintsDNS2CACert.crt",
2108        };
2109
2110        String[] crls = {
2111                "TrustAnchorRootCRL.crl",
2112                "nameConstraintsDNS2CACRL.crl",
2113        };
2114
2115        assertInvalidPath(trustAnchor, certs, crls);
2116    }
2117
2118    /** NIST PKITS test 4.13.34 */
2119    public void testKeyUsage_ValidURInameConstraintsTest34() throws Exception {
2120        String trustAnchor = "TrustAnchorRootCertificate.crt";
2121
2122        String[] certs = {
2123                "ValidURInameConstraintsTest34EE.crt",
2124                "nameConstraintsURI1CACert.crt",
2125        };
2126
2127        String[] crls = {
2128                "TrustAnchorRootCRL.crl",
2129                "nameConstraintsURI1CACRL.crl",
2130        };
2131
2132        assertValidPath(trustAnchor, certs, crls);
2133    }
2134
2135    /** NIST PKITS test 4.13.35 */
2136    public void testKeyUsage_InvalidURInameConstraintsTest35() throws Exception {
2137        String trustAnchor = "TrustAnchorRootCertificate.crt";
2138
2139        String[] certs = {
2140                "InvalidURInameConstraintsTest35EE.crt",
2141                "nameConstraintsURI1CACert.crt",
2142        };
2143
2144        String[] crls = {
2145                "TrustAnchorRootCRL.crl",
2146                "nameConstraintsURI1CACRL.crl",
2147        };
2148
2149        assertInvalidPath(trustAnchor, certs, crls);
2150    }
2151
2152    /** NIST PKITS test 4.13.36 */
2153    public void testKeyUsage_ValidURInameConstraintsTest36() throws Exception {
2154        String trustAnchor = "TrustAnchorRootCertificate.crt";
2155
2156        String[] certs = {
2157                "ValidURInameConstraintsTest36EE.crt",
2158                "nameConstraintsURI2CACert.crt",
2159        };
2160
2161        String[] crls = {
2162                "TrustAnchorRootCRL.crl",
2163                "nameConstraintsURI2CACRL.crl",
2164        };
2165
2166        assertValidPath(trustAnchor, certs, crls);
2167    }
2168
2169    /** NIST PKITS test 4.13.37 */
2170    public void testKeyUsage_InvalidURInameConstraintsTest37() throws Exception {
2171        String trustAnchor = "TrustAnchorRootCertificate.crt";
2172
2173        String[] certs = {
2174                "InvalidURInameConstraintsTest37EE.crt",
2175                "nameConstraintsURI2CACert.crt",
2176        };
2177
2178        String[] crls = {
2179                "TrustAnchorRootCRL.crl",
2180                "nameConstraintsURI2CACRL.crl",
2181        };
2182
2183        assertInvalidPath(trustAnchor, certs, crls);
2184    }
2185
2186    /** NIST PKITS test 4.13.38 */
2187    public void testKeyUsage_InvalidDNSnameConstraintsTest38() throws Exception {
2188        String trustAnchor = "TrustAnchorRootCertificate.crt";
2189
2190        String[] certs = {
2191                "InvalidDNSnameConstraintsTest38EE.crt",
2192                "nameConstraintsDNS1CACert.crt",
2193        };
2194
2195        String[] crls = {
2196                "TrustAnchorRootCRL.crl",
2197                "nameConstraintsDNS1CACRL.crl",
2198        };
2199
2200        assertInvalidPath(trustAnchor, certs, crls);
2201    }
2202
2203    /** NIST PKITS test 4.14.1 */
2204    public void testDistributionPoints_ValiddistributionPointTest1() throws Exception {
2205        String trustAnchor = "TrustAnchorRootCertificate.crt";
2206
2207        String[] certs = {
2208                "ValiddistributionPointTest1EE.crt",
2209                "distributionPoint1CACert.crt",
2210        };
2211
2212        String[] crls = {
2213                "TrustAnchorRootCRL.crl",
2214                "distributionPoint1CACRL.crl",
2215        };
2216
2217        assertValidPath(trustAnchor, certs, crls);
2218    }
2219
2220    /** NIST PKITS test 4.14.2 */
2221    public void testDistributionPoints_InvaliddistributionPointTest2() throws Exception {
2222        String trustAnchor = "TrustAnchorRootCertificate.crt";
2223
2224        String[] certs = {
2225                "InvaliddistributionPointTest2EE.crt",
2226                "distributionPoint1CACert.crt",
2227        };
2228
2229        String[] crls = {
2230                "TrustAnchorRootCRL.crl",
2231                "distributionPoint1CACRL.crl",
2232        };
2233
2234        assertInvalidPath(trustAnchor, certs, crls);
2235    }
2236
2237    /** NIST PKITS test 4.14.3 */
2238    public void testDistributionPoints_InvaliddistributionPointTest3() throws Exception {
2239        String trustAnchor = "TrustAnchorRootCertificate.crt";
2240
2241        String[] certs = {
2242                "InvaliddistributionPointTest3EE.crt",
2243                "distributionPoint1CACert.crt",
2244        };
2245
2246        String[] crls = {
2247                "TrustAnchorRootCRL.crl",
2248                "distributionPoint1CACRL.crl",
2249        };
2250
2251        assertInvalidPath(trustAnchor, certs, crls);
2252    }
2253
2254    /** NIST PKITS test 4.14.4 */
2255    public void testDistributionPoints_ValiddistributionPointTest4() throws Exception {
2256        String trustAnchor = "TrustAnchorRootCertificate.crt";
2257
2258        String[] certs = {
2259                "ValiddistributionPointTest4EE.crt",
2260                "distributionPoint1CACert.crt",
2261        };
2262
2263        String[] crls = {
2264                "TrustAnchorRootCRL.crl",
2265                "distributionPoint1CACRL.crl",
2266        };
2267
2268        assertValidPath(trustAnchor, certs, crls);
2269    }
2270
2271    /** NIST PKITS test 4.14.5 */
2272    public void testDistributionPoints_ValiddistributionPointTest5() throws Exception {
2273        String trustAnchor = "TrustAnchorRootCertificate.crt";
2274
2275        String[] certs = {
2276                "ValiddistributionPointTest5EE.crt",
2277                "distributionPoint2CACert.crt",
2278        };
2279
2280        String[] crls = {
2281                "TrustAnchorRootCRL.crl",
2282                "distributionPoint2CACRL.crl",
2283        };
2284
2285        assertValidPath(trustAnchor, certs, crls);
2286    }
2287
2288    /** NIST PKITS test 4.14.6 */
2289    public void testDistributionPoints_InvaliddistributionPointTest6() throws Exception {
2290        String trustAnchor = "TrustAnchorRootCertificate.crt";
2291
2292        String[] certs = {
2293                "InvaliddistributionPointTest6EE.crt",
2294                "distributionPoint2CACert.crt",
2295        };
2296
2297        String[] crls = {
2298                "TrustAnchorRootCRL.crl",
2299                "distributionPoint2CACRL.crl",
2300        };
2301
2302        assertInvalidPath(trustAnchor, certs, crls);
2303    }
2304
2305    /** NIST PKITS test 4.14.7 */
2306    public void testDistributionPoints_ValiddistributionPointTest7() throws Exception {
2307        String trustAnchor = "TrustAnchorRootCertificate.crt";
2308
2309        String[] certs = {
2310                "ValiddistributionPointTest7EE.crt",
2311                "distributionPoint2CACert.crt",
2312        };
2313
2314        String[] crls = {
2315                "TrustAnchorRootCRL.crl",
2316                "distributionPoint2CACRL.crl",
2317        };
2318
2319        assertValidPath(trustAnchor, certs, crls);
2320    }
2321
2322    /** NIST PKITS test 4.14.8 */
2323    public void testDistributionPoints_InvaliddistributionPointTest8() throws Exception {
2324        String trustAnchor = "TrustAnchorRootCertificate.crt";
2325
2326        String[] certs = {
2327                "InvaliddistributionPointTest8EE.crt",
2328                "distributionPoint2CACert.crt",
2329        };
2330
2331        String[] crls = {
2332                "TrustAnchorRootCRL.crl",
2333                "distributionPoint2CACRL.crl",
2334        };
2335
2336        assertInvalidPath(trustAnchor, certs, crls);
2337    }
2338
2339    /** NIST PKITS test 4.14.9 */
2340    public void testDistributionPoints_InvaliddistributionPointTest9() throws Exception {
2341        String trustAnchor = "TrustAnchorRootCertificate.crt";
2342
2343        String[] certs = {
2344                "InvaliddistributionPointTest9EE.crt",
2345                "distributionPoint2CACert.crt",
2346        };
2347
2348        String[] crls = {
2349                "TrustAnchorRootCRL.crl",
2350                "distributionPoint2CACRL.crl",
2351        };
2352
2353        assertInvalidPath(trustAnchor, certs, crls);
2354    }
2355
2356    /** NIST PKITS test 4.14.10 */
2357    public void testDistributionPoints_ValidNoissuingDistributionPointTest10() throws Exception {
2358        String trustAnchor = "TrustAnchorRootCertificate.crt";
2359
2360        String[] certs = {
2361                "ValidNoissuingDistributionPointTest10EE.crt",
2362                "NoissuingDistributionPointCACert.crt",
2363        };
2364
2365        String[] crls = {
2366                "TrustAnchorRootCRL.crl",
2367                "NoissuingDistributionPointCACRL.crl",
2368        };
2369
2370        assertValidPath(trustAnchor, certs, crls);
2371    }
2372
2373    /** NIST PKITS test 4.14.11 */
2374    public void testDistributionPoints_InvalidonlyContainsUserCertsCRLTest11() throws Exception {
2375        String trustAnchor = "TrustAnchorRootCertificate.crt";
2376
2377        String[] certs = {
2378                "InvalidonlyContainsUserCertsTest11EE.crt",
2379                "onlyContainsUserCertsCACert.crt",
2380        };
2381
2382        String[] crls = {
2383                "TrustAnchorRootCRL.crl",
2384                "onlyContainsUserCertsCACRL.crl",
2385        };
2386
2387        assertInvalidPath(trustAnchor, certs, crls);
2388    }
2389
2390    /** NIST PKITS test 4.14.12 */
2391    public void testDistributionPoints_InvalidonlyContainsCACertsCRLTest12() throws Exception {
2392        String trustAnchor = "TrustAnchorRootCertificate.crt";
2393
2394        String[] certs = {
2395                "InvalidonlyContainsCACertsTest12EE.crt",
2396                "onlyContainsCACertsCACert.crt",
2397        };
2398
2399        String[] crls = {
2400                "TrustAnchorRootCRL.crl",
2401                "onlyContainsCACertsCACRL.crl",
2402        };
2403
2404        assertInvalidPath(trustAnchor, certs, crls);
2405    }
2406
2407    /** NIST PKITS test 4.14.13 */
2408    public void testDistributionPoints_ValidonlyContainsCACertsCRLTest13() throws Exception {
2409        String trustAnchor = "TrustAnchorRootCertificate.crt";
2410
2411        String[] certs = {
2412                "ValidonlyContainsCACertsTest13EE.crt",
2413                "onlyContainsCACertsCACert.crt",
2414        };
2415
2416        String[] crls = {
2417                "TrustAnchorRootCRL.crl",
2418                "onlyContainsCACertsCACRL.crl",
2419        };
2420
2421        assertValidPath(trustAnchor, certs, crls);
2422    }
2423
2424    /** NIST PKITS test 4.14.14 */
2425    public void testDistributionPoints_InvalidonlyContainsAttributeCertsTest14() throws Exception {
2426        String trustAnchor = "TrustAnchorRootCertificate.crt";
2427
2428        String[] certs = {
2429                "InvalidonlyContainsAttributeCertsTest14EE.crt",
2430                "onlyContainsAttributeCertsCACert.crt",
2431        };
2432
2433        String[] crls = {
2434                "TrustAnchorRootCRL.crl",
2435                "onlyContainsAttributeCertsCACRL.crl",
2436        };
2437
2438        assertInvalidPath(trustAnchor, certs, crls);
2439    }
2440
2441    /** NIST PKITS test 4.14.15 */
2442    public void testDistributionPoints_InvalidonlySomeReasonsTest15() throws Exception {
2443        String trustAnchor = "TrustAnchorRootCertificate.crt";
2444
2445        String[] certs = {
2446                "InvalidonlySomeReasonsTest15EE.crt",
2447                "onlySomeReasonsCA1Cert.crt",
2448        };
2449
2450        String[] crls = {
2451                "TrustAnchorRootCRL.crl",
2452                "onlySomeReasonsCA1compromiseCRL.crl",
2453                "onlySomeReasonsCA1otherreasonsCRL.crl",
2454        };
2455
2456        assertInvalidPath(trustAnchor, certs, crls);
2457    }
2458
2459    /** NIST PKITS test 4.14.16 */
2460    public void testDistributionPoints_InvalidonlySomeReasonsTest16() throws Exception {
2461        String trustAnchor = "TrustAnchorRootCertificate.crt";
2462
2463        String[] certs = {
2464                "InvalidonlySomeReasonsTest16EE.crt",
2465                "onlySomeReasonsCA1Cert.crt",
2466        };
2467
2468        String[] crls = {
2469                "TrustAnchorRootCRL.crl",
2470                "onlySomeReasonsCA1compromiseCRL.crl",
2471                "onlySomeReasonsCA1otherreasonsCRL.crl",
2472        };
2473
2474        assertInvalidPath(trustAnchor, certs, crls);
2475    }
2476
2477    /** NIST PKITS test 4.14.17 */
2478    public void testDistributionPoints_InvalidonlySomeReasonsTest17() throws Exception {
2479        String trustAnchor = "TrustAnchorRootCertificate.crt";
2480
2481        String[] certs = {
2482                "InvalidonlySomeReasonsTest17EE.crt",
2483                "onlySomeReasonsCA2Cert.crt",
2484        };
2485
2486        String[] crls = {
2487                "TrustAnchorRootCRL.crl",
2488                "onlySomeReasonsCA2CRL1.crl",
2489                "onlySomeReasonsCA2CRL2.crl",
2490        };
2491
2492        assertInvalidPath(trustAnchor, certs, crls);
2493    }
2494
2495    /** NIST PKITS test 4.14.18 */
2496    public void testDistributionPoints_ValidonlySomeReasonsTest18() throws Exception {
2497        String trustAnchor = "TrustAnchorRootCertificate.crt";
2498
2499        String[] certs = {
2500                "ValidonlySomeReasonsTest18EE.crt",
2501                "onlySomeReasonsCA3Cert.crt",
2502        };
2503
2504        String[] crls = {
2505                "TrustAnchorRootCRL.crl",
2506                "onlySomeReasonsCA3compromiseCRL.crl",
2507                "onlySomeReasonsCA3otherreasonsCRL.crl",
2508        };
2509
2510        assertValidPath(trustAnchor, certs, crls);
2511    }
2512
2513    /** NIST PKITS test 4.14.19 */
2514    public void testDistributionPoints_ValidonlySomeReasonsTest19() throws Exception {
2515        String trustAnchor = "TrustAnchorRootCertificate.crt";
2516
2517        String[] certs = {
2518                "ValidonlySomeReasonsTest19EE.crt",
2519                "onlySomeReasonsCA4Cert.crt",
2520        };
2521
2522        String[] crls = {
2523                "TrustAnchorRootCRL.crl",
2524                "onlySomeReasonsCA4compromiseCRL.crl",
2525                "onlySomeReasonsCA4otherreasonsCRL.crl",
2526        };
2527
2528        assertValidPath(trustAnchor, certs, crls);
2529    }
2530
2531    /** NIST PKITS test 4.14.20 */
2532    public void testDistributionPoints_InvalidonlySomeReasonsTest20() throws Exception {
2533        String trustAnchor = "TrustAnchorRootCertificate.crt";
2534
2535        String[] certs = {
2536                "InvalidonlySomeReasonsTest20EE.crt",
2537                "onlySomeReasonsCA4Cert.crt",
2538        };
2539
2540        String[] crls = {
2541                "TrustAnchorRootCRL.crl",
2542                "onlySomeReasonsCA4compromiseCRL.crl",
2543                "onlySomeReasonsCA4otherreasonsCRL.crl",
2544        };
2545
2546        assertInvalidPath(trustAnchor, certs, crls);
2547    }
2548
2549    /** NIST PKITS test 4.14.21 */
2550    public void testDistributionPoints_InvalidonlySomeReasonsTest21() throws Exception {
2551        String trustAnchor = "TrustAnchorRootCertificate.crt";
2552
2553        String[] certs = {
2554                "InvalidonlySomeReasonsTest21EE.crt",
2555                "onlySomeReasonsCA4Cert.crt",
2556        };
2557
2558        String[] crls = {
2559                "TrustAnchorRootCRL.crl",
2560                "onlySomeReasonsCA4compromiseCRL.crl",
2561                "onlySomeReasonsCA4otherreasonsCRL.crl",
2562        };
2563
2564        assertInvalidPath(trustAnchor, certs, crls);
2565    }
2566
2567    /** NIST PKITS test 4.14.22 */
2568    public void testDistributionPoints_ValidIDPwithindirectCRLTest22() throws Exception {
2569        String trustAnchor = "TrustAnchorRootCertificate.crt";
2570
2571        String[] certs = {
2572                "ValidIDPwithindirectCRLTest22EE.crt",
2573                "indirectCRLCA1Cert.crt",
2574        };
2575
2576        String[] crls = {
2577                "TrustAnchorRootCRL.crl",
2578                "indirectCRLCA1CRL.crl",
2579        };
2580
2581        assertValidPath(trustAnchor, certs, crls);
2582    }
2583
2584    /** NIST PKITS test 4.14.23 */
2585    public void testDistributionPoints_InvalidIDPwithindirectCRLTest23() throws Exception {
2586        String trustAnchor = "TrustAnchorRootCertificate.crt";
2587
2588        String[] certs = {
2589                "InvalidIDPwithindirectCRLTest23EE.crt",
2590                "indirectCRLCA1Cert.crt",
2591        };
2592
2593        String[] crls = {
2594                "TrustAnchorRootCRL.crl",
2595                "indirectCRLCA1CRL.crl",
2596        };
2597
2598        assertInvalidPath(trustAnchor, certs, crls);
2599    }
2600
2601    /** NIST PKITS test 4.14.24 */
2602    public void testDistributionPoints_ValidIDPwithindirectCRLTest24() throws Exception {
2603        String trustAnchor = "TrustAnchorRootCertificate.crt";
2604
2605        String[] certs = {
2606                "ValidIDPwithindirectCRLTest24EE.crt",
2607                "indirectCRLCA1Cert.crt",
2608                "indirectCRLCA2Cert.crt",
2609        };
2610
2611        String[] crls = {
2612                "TrustAnchorRootCRL.crl",
2613                "indirectCRLCA1CRL.crl",
2614        };
2615
2616        assertValidPath(trustAnchor, certs, crls);
2617    }
2618
2619    /** NIST PKITS test 4.14.25 */
2620    public void testDistributionPoints_ValidIDPwithindirectCRLTest25() throws Exception {
2621        String trustAnchor = "TrustAnchorRootCertificate.crt";
2622
2623        String[] certs = {
2624                "ValidIDPwithindirectCRLTest25EE.crt",
2625                "indirectCRLCA1Cert.crt",
2626                "indirectCRLCA2Cert.crt",
2627        };
2628
2629        String[] crls = {
2630                "TrustAnchorRootCRL.crl",
2631                "indirectCRLCA1CRL.crl",
2632        };
2633
2634        assertValidPath(trustAnchor, certs, crls);
2635    }
2636
2637    /** NIST PKITS test 4.14.26 */
2638    public void testDistributionPoints_InvalidIDPwithindirectCRLTest26() throws Exception {
2639        String trustAnchor = "TrustAnchorRootCertificate.crt";
2640
2641        String[] certs = {
2642                "InvalidIDPwithindirectCRLTest26EE.crt",
2643                "indirectCRLCA1Cert.crt",
2644                "indirectCRLCA2Cert.crt",
2645        };
2646
2647        String[] crls = {
2648                "TrustAnchorRootCRL.crl",
2649                "indirectCRLCA1CRL.crl",
2650        };
2651
2652        assertInvalidPath(trustAnchor, certs, crls);
2653    }
2654
2655    /** NIST PKITS test 4.14.27 */
2656    public void testDistributionPoints_InvalidcRLIssuerTest27() throws Exception {
2657        String trustAnchor = "TrustAnchorRootCertificate.crt";
2658
2659        String[] certs = {
2660                "InvalidcRLIssuerTest27EE.crt",
2661                "GoodCACert.crt",
2662                "indirectCRLCA2Cert.crt",
2663        };
2664
2665        String[] crls = {
2666                "TrustAnchorRootCRL.crl",
2667                "GoodCACRL.crl",
2668        };
2669
2670        assertInvalidPath(trustAnchor, certs, crls);
2671    }
2672
2673    /** NIST PKITS test 4.14.28 */
2674    public void testDistributionPoints_ValidcRLIssuerTest28() throws Exception {
2675        String trustAnchor = "TrustAnchorRootCertificate.crt";
2676
2677        String[] certs = {
2678                "ValidcRLIssuerTest28EE.crt",
2679                "indirectCRLCA3cRLIssuerCert.crt",
2680                "indirectCRLCA3Cert.crt",
2681        };
2682
2683        String[] crls = {
2684                "TrustAnchorRootCRL.crl",
2685                "indirectCRLCA3CRL.crl",
2686                "indirectCRLCA3cRLIssuerCRL.crl",
2687        };
2688
2689        assertValidPath(trustAnchor, certs, crls);
2690    }
2691
2692    /** NIST PKITS test 4.14.29 */
2693    public void testDistributionPoints_ValidcRLIssuerTest29() throws Exception {
2694        String trustAnchor = "TrustAnchorRootCertificate.crt";
2695
2696        String[] certs = {
2697                "ValidcRLIssuerTest29EE.crt",
2698                "indirectCRLCA3cRLIssuerCert.crt",
2699                "indirectCRLCA3Cert.crt",
2700        };
2701
2702        String[] crls = {
2703                "TrustAnchorRootCRL.crl",
2704                "indirectCRLCA3CRL.crl",
2705                "indirectCRLCA3cRLIssuerCRL.crl",
2706        };
2707
2708        assertValidPath(trustAnchor, certs, crls);
2709    }
2710
2711    /** NIST PKITS test 4.14.30 */
2712    public void testDistributionPoints_ValidcRLIssuerTest30() throws Exception {
2713        String trustAnchor = "TrustAnchorRootCertificate.crt";
2714
2715        String[] certs = {
2716                "ValidcRLIssuerTest30EE.crt",
2717                "indirectCRLCA4cRLIssuerCert.crt",
2718                "indirectCRLCA4Cert.crt",
2719        };
2720
2721        String[] crls = {
2722                "TrustAnchorRootCRL.crl",
2723                "indirectCRLCA4cRLIssuerCRL.crl",
2724        };
2725
2726        assertValidPath(trustAnchor, certs, crls);
2727    }
2728
2729    /** NIST PKITS test 4.14.31 */
2730    public void testDistributionPoints_InvalidcRLIssuerTest31() throws Exception {
2731        String trustAnchor = "TrustAnchorRootCertificate.crt";
2732
2733        String[] certs = {
2734                "InvalidcRLIssuerTest31EE.crt",
2735                "indirectCRLCA6Cert.crt",
2736                "indirectCRLCA5Cert.crt",
2737        };
2738
2739        String[] crls = {
2740                "TrustAnchorRootCRL.crl",
2741                "indirectCRLCA5CRL.crl",
2742        };
2743
2744        assertInvalidPath(trustAnchor, certs, crls);
2745    }
2746
2747    /** NIST PKITS test 4.14.32 */
2748    public void testDistributionPoints_InvalidcRLIssuerTest32() throws Exception {
2749        String trustAnchor = "TrustAnchorRootCertificate.crt";
2750
2751        String[] certs = {
2752                "InvalidcRLIssuerTest32EE.crt",
2753                "indirectCRLCA6Cert.crt",
2754                "indirectCRLCA5Cert.crt",
2755        };
2756
2757        String[] crls = {
2758                "TrustAnchorRootCRL.crl",
2759                "indirectCRLCA5CRL.crl",
2760        };
2761
2762        assertInvalidPath(trustAnchor, certs, crls);
2763    }
2764
2765    /** NIST PKITS test 4.14.33 */
2766    public void testDistributionPoints_ValidcRLIssuerTest33() throws Exception {
2767        String trustAnchor = "TrustAnchorRootCertificate.crt";
2768
2769        String[] certs = {
2770                "ValidcRLIssuerTest33EE.crt",
2771                "indirectCRLCA6Cert.crt",
2772                "indirectCRLCA5Cert.crt",
2773        };
2774
2775        String[] crls = {
2776                "TrustAnchorRootCRL.crl",
2777                "indirectCRLCA5CRL.crl",
2778        };
2779
2780        assertValidPath(trustAnchor, certs, crls);
2781    }
2782
2783    /** NIST PKITS test 4.14.34 */
2784    public void testDistributionPoints_InvalidcRLIssuerTest34() throws Exception {
2785        String trustAnchor = "TrustAnchorRootCertificate.crt";
2786
2787        String[] certs = {
2788                "InvalidcRLIssuerTest34EE.crt",
2789                "indirectCRLCA5Cert.crt",
2790        };
2791
2792        String[] crls = {
2793                "TrustAnchorRootCRL.crl",
2794                "indirectCRLCA5CRL.crl",
2795        };
2796
2797        assertInvalidPath(trustAnchor, certs, crls);
2798    }
2799
2800    /** NIST PKITS test 4.14.35 */
2801    public void testDistributionPoints_InvalidcRLIssuerTest35() throws Exception {
2802        String trustAnchor = "TrustAnchorRootCertificate.crt";
2803
2804        String[] certs = {
2805                "InvalidcRLIssuerTest35EE.crt",
2806                "indirectCRLCA5Cert.crt",
2807        };
2808
2809        String[] crls = {
2810                "TrustAnchorRootCRL.crl",
2811                "indirectCRLCA5CRL.crl",
2812        };
2813
2814        assertInvalidPath(trustAnchor, certs, crls);
2815    }
2816
2817    /** NIST PKITS test 4.15.1 */
2818    public void testDeltaCRLs_InvaliddeltaCRLIndicatorNoBaseTest1() throws Exception {
2819        String trustAnchor = "TrustAnchorRootCertificate.crt";
2820
2821        String[] certs = {
2822                "InvaliddeltaCRLIndicatorNoBaseTest1EE.crt",
2823                "deltaCRLIndicatorNoBaseCACert.crt",
2824        };
2825
2826        String[] crls = {
2827                "TrustAnchorRootCRL.crl",
2828                "deltaCRLIndicatorNoBaseCACRL.crl",
2829        };
2830
2831        assertInvalidPath(trustAnchor, certs, crls);
2832    }
2833
2834    /** NIST PKITS test 4.15.2 */
2835    public void testDeltaCRLs_ValiddeltaCRLTest2() throws Exception {
2836        String trustAnchor = "TrustAnchorRootCertificate.crt";
2837
2838        String[] certs = {
2839                "ValiddeltaCRLTest2EE.crt",
2840                "deltaCRLCA1Cert.crt",
2841        };
2842
2843        String[] crls = {
2844                "TrustAnchorRootCRL.crl",
2845                "deltaCRLCA1CRL.crl",
2846                "deltaCRLCA1deltaCRL.crl",
2847        };
2848
2849        assertValidPath(trustAnchor, certs, crls);
2850    }
2851
2852    /** NIST PKITS test 4.15.3 */
2853    public void testDeltaCRLs_InvaliddeltaCRLTest3() throws Exception {
2854        String trustAnchor = "TrustAnchorRootCertificate.crt";
2855
2856        String[] certs = {
2857                "InvaliddeltaCRLTest3EE.crt",
2858                "deltaCRLCA1Cert.crt",
2859        };
2860
2861        String[] crls = {
2862                "TrustAnchorRootCRL.crl",
2863                "deltaCRLCA1CRL.crl",
2864                "deltaCRLCA1deltaCRL.crl",
2865        };
2866
2867        assertInvalidPath(trustAnchor, certs, crls);
2868    }
2869
2870    /** NIST PKITS test 4.15.4 */
2871    public void testDeltaCRLs_InvaliddeltaCRLTest4() throws Exception {
2872        String trustAnchor = "TrustAnchorRootCertificate.crt";
2873
2874        String[] certs = {
2875                "InvaliddeltaCRLTest4EE.crt",
2876                "deltaCRLCA1Cert.crt",
2877        };
2878
2879        String[] crls = {
2880                "TrustAnchorRootCRL.crl",
2881                "deltaCRLCA1CRL.crl",
2882                "deltaCRLCA1deltaCRL.crl",
2883        };
2884
2885        assertInvalidPath(trustAnchor, certs, crls);
2886    }
2887
2888    /** NIST PKITS test 4.15.5 */
2889    public void testDeltaCRLs_ValiddeltaCRLTest5() throws Exception {
2890        String trustAnchor = "TrustAnchorRootCertificate.crt";
2891
2892        String[] certs = {
2893                "ValiddeltaCRLTest5EE.crt",
2894                "deltaCRLCA1Cert.crt",
2895        };
2896
2897        String[] crls = {
2898                "TrustAnchorRootCRL.crl",
2899                "deltaCRLCA1CRL.crl",
2900                "deltaCRLCA1deltaCRL.crl",
2901        };
2902
2903        assertValidPath(trustAnchor, certs, crls);
2904    }
2905
2906    /** NIST PKITS test 4.15.6 */
2907    public void testDeltaCRLs_InvaliddeltaCRLTest6() throws Exception {
2908        String trustAnchor = "TrustAnchorRootCertificate.crt";
2909
2910        String[] certs = {
2911                "InvaliddeltaCRLTest6EE.crt",
2912                "deltaCRLCA1Cert.crt",
2913        };
2914
2915        String[] crls = {
2916                "TrustAnchorRootCRL.crl",
2917                "deltaCRLCA1CRL.crl",
2918                "deltaCRLCA1deltaCRL.crl",
2919        };
2920
2921        assertInvalidPath(trustAnchor, certs, crls);
2922    }
2923
2924    /** NIST PKITS test 4.15.7 */
2925    public void testDeltaCRLs_ValiddeltaCRLTest7() throws Exception {
2926        String trustAnchor = "TrustAnchorRootCertificate.crt";
2927
2928        String[] certs = {
2929                "ValiddeltaCRLTest7EE.crt",
2930                "deltaCRLCA1Cert.crt",
2931        };
2932
2933        String[] crls = {
2934                "TrustAnchorRootCRL.crl",
2935                "deltaCRLCA1CRL.crl",
2936                "deltaCRLCA1deltaCRL.crl",
2937        };
2938
2939        assertValidPath(trustAnchor, certs, crls);
2940    }
2941
2942    /** NIST PKITS test 4.15.8 */
2943    public void testDeltaCRLs_ValiddeltaCRLTest8() throws Exception {
2944        String trustAnchor = "TrustAnchorRootCertificate.crt";
2945
2946        String[] certs = {
2947                "ValiddeltaCRLTest8EE.crt",
2948                "deltaCRLCA2Cert.crt",
2949        };
2950
2951        String[] crls = {
2952                "TrustAnchorRootCRL.crl",
2953                "deltaCRLCA2CRL.crl",
2954                "deltaCRLCA2deltaCRL.crl",
2955        };
2956
2957        assertValidPath(trustAnchor, certs, crls);
2958    }
2959
2960    /** NIST PKITS test 4.15.9 */
2961    public void testDeltaCRLs_InvaliddeltaCRLTest9() throws Exception {
2962        String trustAnchor = "TrustAnchorRootCertificate.crt";
2963
2964        String[] certs = {
2965                "InvaliddeltaCRLTest9EE.crt",
2966                "deltaCRLCA2Cert.crt",
2967        };
2968
2969        String[] crls = {
2970                "TrustAnchorRootCRL.crl",
2971                "deltaCRLCA2CRL.crl",
2972                "deltaCRLCA2deltaCRL.crl",
2973        };
2974
2975        assertInvalidPath(trustAnchor, certs, crls);
2976    }
2977
2978    /** NIST PKITS test 4.15.10 */
2979    public void testDeltaCRLs_InvaliddeltaCRLTest10() throws Exception {
2980        String trustAnchor = "TrustAnchorRootCertificate.crt";
2981
2982        String[] certs = {
2983                "InvaliddeltaCRLTest10EE.crt",
2984                "deltaCRLCA3Cert.crt",
2985        };
2986
2987        String[] crls = {
2988                "TrustAnchorRootCRL.crl",
2989                "deltaCRLCA3CRL.crl",
2990                "deltaCRLCA3deltaCRL.crl",
2991        };
2992
2993        assertInvalidPath(trustAnchor, certs, crls);
2994    }
2995
2996    /** NIST PKITS test 4.16.1 */
2997    public void testPrivateCertificateExtensions_ValidUnknownNotCriticalCertificateExtensionTest1() throws Exception {
2998        String trustAnchor = "TrustAnchorRootCertificate.crt";
2999
3000        String[] certs = {
3001                "ValidUnknownNotCriticalCertificateExtensionTest1EE.crt",
3002        };
3003
3004        String[] crls = {
3005                "TrustAnchorRootCRL.crl",
3006        };
3007
3008        assertValidPath(trustAnchor, certs, crls);
3009    }
3010
3011    /* DO NOT MANUALLY EDIT -- END AUTOMATICALLY GENERATED TESTS */
3012}
3013