OVMS3/OVMS.V3/components/wolfssl/tests/test-chains.conf

# Tests will use complete chain with intermediate CA for testing
# The tests with chains have the CRL checking disabled
# CRL's only load for trusted CA's, for a chain you must load the root and intermediate as trusted
# For these tests we are loading root and sending intermediate and peer certs
# server TLSv1.2 DHE-RSA-AES128-GCM-SHA256 RSA Chain
-v 3
-l DHE-RSA-AES128-GCM-SHA256
-A ./certs/ca-cert.pem
-k ./certs/server-key.pem
-c ./certs/intermediate/server-chain.pem
-V

# client TLSv1.2 DHE-RSA-AES128-GCM-SHA256 RSA Chain
-v 3
-l DHE-RSA-AES128-GCM-SHA256
-A ./certs/ca-cert.pem
-k ./certs/client-key.pem
-c ./certs/intermediate/client-chain.pem
-C

# server TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 RSA Chain
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-A ./certs/ca-cert.pem
-k ./certs/server-key.pem
-c ./certs/intermediate/server-chain.pem
-V

# client TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 RSA Chain
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-A ./certs/ca-cert.pem
-k ./certs/client-key.pem
-c ./certs/intermediate/client-chain.pem
-C

# server TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 ECC Chain
-v 3
-l ECDHE-ECDSA-AES128-GCM-SHA256
-A ./certs/ca-ecc-cert.pem
-k ./certs/ecc-key.pem
-c ./certs/intermediate/server-chain-ecc.pem
-V

# client TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 ECC Chain
-v 3
-l ECDHE-ECDSA-AES128-GCM-SHA256
-A ./certs/ca-ecc-cert.pem
-k ./certs/ecc-client-key.pem
-c ./certs/intermediate/client-chain-ecc.pem
-C

# server TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-k ./certs/test-pathlen/chainA-entity-key.pem
-c ./certs/test-pathlen/chainA-assembled.pem
-V

# client TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-C

# server TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-k ./certs/test-pathlen/chainB-entity-key.pem
-c ./certs/test-pathlen/chainB-assembled.pem
-V

# client TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-C

# server TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-k ./certs/test-pathlen/chainC-entity-key.pem
-c ./certs/test-pathlen/chainC-assembled.pem
-V

# client TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-C

# server TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-k ./certs/test-pathlen/chainD-entity-key.pem
-c ./certs/test-pathlen/chainD-assembled.pem
-V

# client TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-C

# server TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-k ./certs/test-pathlen/chainE-entity-key.pem
-c ./certs/test-pathlen/chainE-assembled.pem
-H exitWithRet
-V

# client TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-H exitWithRet
-C

# server TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-k ./certs/test-pathlen/chainF-entity-key.pem
-c ./certs/test-pathlen/chainF-assembled.pem
-H exitWithRet
-V

# client TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-H exitWithRet
-C

# server TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-k ./certs/test-pathlen/chainG-entity-key.pem
-c ./certs/test-pathlen/chainG-assembled.pem
-V

# client TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-C

# server TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-k ./certs/test-pathlen/chainH-entity-key.pem
-c ./certs/test-pathlen/chainH-assembled.pem
-H exitWithRet
-V

# client TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-H exitWithRet
-C

# server TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-k ./certs/test-pathlen/chainI-entity-key.pem
-c ./certs/test-pathlen/chainI-assembled.pem
-V

# client TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-C

# server TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-k ./certs/test-pathlen/chainJ-entity-key.pem
-c ./certs/test-pathlen/chainJ-assembled.pem
-H exitWithRet
-V

# client TLSv1.2 pathLen constraint test
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-H exitWithRet
-C

# server TLSv1.3 TLS13-AES128-GCM-SHA256 RSA Chain
-v 4
-l TLS13-AES128-GCM-SHA256
-A ./certs/ca-cert.pem
-k ./certs/server-key.pem
-c ./certs/intermediate/server-chain.pem
-V

# client TLSv1.3 TLS13-AES128-GCM-SHA256 RSA Chain
-v 4
-l TLS13-AES128-GCM-SHA256
-A ./certs/ca-cert.pem
-k ./certs/client-key.pem
-c ./certs/intermediate/client-chain.pem
-C

# server TLSv1.3 TLS13-AES128-GCM-SHA256 ECC Chain
-v 4
-l TLS13-AES128-GCM-SHA256
-A ./certs/ca-ecc-cert.pem
-k ./certs/ecc-key.pem
-c ./certs/intermediate/server-chain-ecc.pem
-V

# client TLSv1.3 TLS13-AES128-GCM-SHA256 ECC Chain
-v 4
-l TLS13-AES128-GCM-SHA256
-A ./certs/ca-ecc-cert.pem
-k ./certs/ecc-client-key.pem
-c ./certs/intermediate/client-chain-ecc.pem
-C

# Test will load intermediate CA as trusted and only present the peer cert (partial chain)
# server TLSv1.2 DHE-RSA-AES128-GCM-SHA256 RSA Partial Chain
-v 3
-l DHE-RSA-AES128-GCM-SHA256
-A ./certs/intermediate/ca-int2-cert.pem
-k ./certs/server-key.pem
-c ./certs/intermediate/server-int-cert.pem
-V

# client TLSv1.2 DHE-RSA-AES128-GCM-SHA256 RSA Partial Chain
-v 3
-l DHE-RSA-AES128-GCM-SHA256
-A ./certs/intermediate/ca-int2-cert.pem
-k ./certs/client-key.pem
-c ./certs/intermediate/client-int-cert.pem
-C

# server TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 RSA Partial Chain
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-A ./certs/intermediate/ca-int2-cert.pem
-k ./certs/server-key.pem
-c ./certs/intermediate/server-int-cert.pem
-V

# client TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 RSA Partial Chain
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-A ./certs/intermediate/ca-int2-cert.pem
-k ./certs/client-key.pem
-c ./certs/intermediate/client-int-cert.pem
-C

# server TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 ECC Partial Chain
-v 3
-l ECDHE-ECDSA-AES128-GCM-SHA256
-A ./certs/intermediate/ca-int2-ecc-cert.pem
-k ./certs/ecc-key.pem
-c ./certs/intermediate/server-int-ecc-cert.pem
-V

# client TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 ECC Partial Chain
-v 3
-l ECDHE-ECDSA-AES128-GCM-SHA256
-A ./certs/intermediate/ca-int2-ecc-cert.pem
-k ./certs/ecc-client-key.pem
-c ./certs/intermediate/client-int-ecc-cert.pem
-C

# server TLSv1.3 TLS13-AES128-GCM-SHA256 RSA Partial Chain
-v 4
-l TLS13-AES128-GCM-SHA256
-A ./certs/intermediate/ca-int2-cert.pem
-k ./certs/server-key.pem
-c ./certs/intermediate/server-int-cert.pem
-V

# client TLSv1.3 TLS13-AES128-GCM-SHA256 RSA Partial Chain
-v 4
-l TLS13-AES128-GCM-SHA256
-A ./certs/intermediate/ca-int2-cert.pem
-k ./certs/client-key.pem
-c ./certs/intermediate/client-int-cert.pem
-C

# server TLSv1.3 TLS13-AES128-GCM-SHA256 ECC Partial Chain
-v 4
-l TLS13-AES128-GCM-SHA256
-A ./certs/intermediate/ca-int2-ecc-cert.pem
-k ./certs/ecc-key.pem
-c ./certs/intermediate/server-int-ecc-cert.pem
-V

# client TLSv1.3 TLS13-AES128-GCM-SHA256 ECC Partial Chain
-v 4
-l TLS13-AES128-GCM-SHA256
-A ./certs/intermediate/ca-int2-ecc-cert.pem
-k ./certs/ecc-client-key.pem
-c ./certs/intermediate/client-int-ecc-cert.pem
-C

# Test will use alternate chain where chain contains extra cert
# These tests should fail
# server TLSv1.2 DHE-RSA-AES128-GCM-SHA256 RSA Alt Chain Fail
-v 3
-l DHE-RSA-AES128-GCM-SHA256
-A ./certs/ca-cert.pem
-k ./certs/server-key.pem
-c ./certs/intermediate/server-chain-alt.pem
-H exitWithRet
-V

# client TLSv1.2 DHE-RSA-AES128-GCM-SHA256 RSA Alt Chain Fail
-v 3
-l DHE-RSA-AES128-GCM-SHA256
-A ./certs/ca-cert.pem
-k ./certs/client-key.pem
-c ./certs/intermediate/client-chain-alt.pem
-H exitWithRet
-C

# server TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 RSA Alt Chain Fail
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-A ./certs/ca-cert.pem
-k ./certs/server-key.pem
-c ./certs/intermediate/server-chain-alt.pem
-H exitWithRet
-V

# client TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 RSA Alt Chain Fail
-v 3
-l ECDHE-RSA-AES128-GCM-SHA256
-A ./certs/ca-cert.pem
-k ./certs/client-key.pem
-c ./certs/intermediate/client-chain-alt.pem
-H exitWithRet
-C

# server TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 ECC Alt Chain Fail
-v 3
-l ECDHE-ECDSA-AES128-GCM-SHA256
-A ./certs/ca-ecc-cert.pem
-k ./certs/ecc-key.pem
-c ./certs/intermediate/server-chain-alt-ecc.pem
-H exitWithRet
-V

# client TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 ECC Alt Chain Fail
-v 3
-l ECDHE-ECDSA-AES128-GCM-SHA256
-A ./certs/ca-ecc-cert.pem
-k ./certs/ecc-client-key.pem
-c ./certs/intermediate/client-chain-alt-ecc.pem
-H exitWithRet
-C

# server TLSv1.3 TLS13-AES128-GCM-SHA256 RSA Alt Chain Fail
-v 4
-l TLS13-AES128-GCM-SHA256
-A ./certs/ca-cert.pem
-k ./certs/server-key.pem
-c ./certs/intermediate/server-chain-alt.pem
-H exitWithRet
-V

# client TLSv1.3 TLS13-AES128-GCM-SHA256 RSA Alt Chain Fail
-v 4
-l TLS13-AES128-GCM-SHA256
-A ./certs/ca-cert.pem
-k ./certs/client-key.pem
-c ./certs/intermediate/client-chain-alt.pem
-H exitWithRet
-C

# server TLSv1.3 TLS13-AES128-GCM-SHA256 ECC Alt Chain Fail
-v 4
-l TLS13-AES128-GCM-SHA256
-A ./certs/ca-ecc-cert.pem
-k ./certs/ecc-key.pem
-c ./certs/intermediate/server-chain-alt-ecc.pem
-H exitWithRet
-V

# client TLSv1.3 TLS13-AES128-GCM-SHA256 ECC Alt Chain Fail
-v 4
-l TLS13-AES128-GCM-SHA256
-A ./certs/ca-ecc-cert.pem
-k ./certs/ecc-client-key.pem
-c ./certs/intermediate/client-chain-alt-ecc.pem
-H exitWithRet
-C