More Comprehensive Certificate Testing

[nibanks]

Describe the feature you'd like supported

We support a number of scenarios related to certificates (and will have more coming with client certs in the queue) but we have minimal testing for these. We should add more positive and negative test cases in these areas.

• Accept valid server certificate (chain to trusted root)
• Accept valid client certificate (chain to trusted root)
• Specific invalid certificate failures (expired, wrong EKU, etc.)
  • Expired server certificate
  • Expired client certificate
  • Untrusted server certificate
  • Untrusted client certificate
• Specific look-up mechanisms (hash, principal name, different stores, etc.)
  • Hash (MY store)
  • Hash store (MY store)
  • Context
  • Principal name (Depends on Completely support Principal name for Schannel TLS #1329)
  • OpenSSL file
  • OpenSSL file with password
  • OpenSSL PFX with password
• More coverage of the cert callback mechanism (at QUIC layer). Cover the flag for cert validation.
  • Portable certificates flag
    • Client certificate
      • OpenSSL
      • Schannel
    • Server certificate
      • OpenSSL
      • Schannel
  • Ensure certificates are usable
    • Client certificate
      • OpenSSL
      • Schannel
    • Server certificate
      • OpenSSL
      • Schannel
• Revocation checking
  • Valid certificate
    • CRL Offline
    • Check the whole chain
    • Check only the leaf
    • Check chain excluding root
    • Cache only
    • Cache only with cache expired
  • Revoked certificate
    • CRL Offline
    • Check the whole chain
    • Check only the leaf
    • Check chain excluding root
    • Cache only
    • Cache only with cache expired
• OCSP

How do different error codes get exposed to the app? Might need core work around exposing individual error codes (might be worth a separate task).

[anrossi]

Since the above are not in any particular priority, I'm going to list the top-level bullets in priority order

1. Specific look-up mechanisms (hash, principal name, different stores, etc.)
2. More coverage of the cert callback mechanism (at QUIC layer)
3. Specific invalid certificate failures (expired, wrong EKU, etc.)
4. Revocation checking