src/crypto/tls/boring_test.go

   1 // Copyright 2017 The Go Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style
   3 // license that can be found in the LICENSE file.
   4
   5 package tls
   6
   7 import (
   8         "crypto/ecdsa"
   9         "crypto/elliptic"
  10         "crypto/internal/boring/fipstls"
  11         "crypto/rand"
  12         "crypto/rsa"
  13         "crypto/x509"
  14         "crypto/x509/pkix"
  15         "encoding/pem"
  16         "fmt"
  17         "math/big"
  18         "net"
  19         "runtime"
  20         "strings"
  21         "testing"
  22         "time"
  23 )
  24
  25 func TestBoringServerProtocolVersion(t *testing.T) {
  26         test := func(name string, v uint16, msg string) {
  27                 t.Run(name, func(t *testing.T) {
  28                         serverConfig := testConfig.Clone()
  29                         serverConfig.MinVersion = VersionSSL30
  30                         clientHello := &clientHelloMsg{
  31                                 vers:               v,
  32                                 random:             make([]byte, 32),
  33                                 cipherSuites:       allCipherSuites(),
  34                                 compressionMethods: []uint8{compressionNone},
  35                                 supportedVersions:  []uint16{v},
  36                         }
  37                         testClientHelloFailure(t, serverConfig, clientHello, msg)
  38                 })
  39         }
  40
  41         test("VersionSSL30", VersionSSL30, "")
  42         test("VersionTLS10", VersionTLS10, "")
  43         test("VersionTLS11", VersionTLS11, "")
  44         test("VersionTLS12", VersionTLS12, "")
  45         test("VersionTLS13", VersionTLS13, "")
  46
  47         fipstls.Force()
  48         defer fipstls.Abandon()
  49         test("VersionSSL30", VersionSSL30, "client offered only unsupported versions")
  50         test("VersionTLS10", VersionTLS10, "client offered only unsupported versions")
  51         test("VersionTLS11", VersionTLS11, "client offered only unsupported versions")
  52         test("VersionTLS12", VersionTLS12, "")
  53         test("VersionTLS13", VersionTLS13, "client offered only unsupported versions")
  54 }
  55
  56 func isBoringVersion(v uint16) bool {
  57         return v == VersionTLS12
  58 }
  59
  60 func isBoringCipherSuite(id uint16) bool {
  61         switch id {
  62         case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
  63                 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
  64                 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
  65                 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
  66                 TLS_RSA_WITH_AES_128_GCM_SHA256,
  67                 TLS_RSA_WITH_AES_256_GCM_SHA384:
  68                 return true
  69         }
  70         return false
  71 }
  72
  73 func isBoringCurve(id CurveID) bool {
  74         switch id {
  75         case CurveP256, CurveP384, CurveP521:
  76                 return true
  77         }
  78         return false
  79 }
  80
  81 func isECDSA(id uint16) bool {
  82         for _, suite := range cipherSuites {
  83                 if suite.id == id {
  84                         return suite.flags&suiteECSign == suiteECSign
  85                 }
  86         }
  87         panic(fmt.Sprintf("unknown cipher suite %#x", id))
  88 }
  89
  90 func isBoringSignatureScheme(alg SignatureScheme) bool {
  91         switch alg {
  92         default:
  93                 return false
  94         case PKCS1WithSHA256,
  95                 ECDSAWithP256AndSHA256,
  96                 PKCS1WithSHA384,
  97                 ECDSAWithP384AndSHA384,
  98                 PKCS1WithSHA512,
  99                 ECDSAWithP521AndSHA512,
 100                 PSSWithSHA256,
 101                 PSSWithSHA384,
 102                 PSSWithSHA512:
 103                 // ok
 104         }
 105         return true
 106 }
 107
 108 func TestBoringServerCipherSuites(t *testing.T) {
 109         serverConfig := testConfig.Clone()
 110         serverConfig.CipherSuites = allCipherSuites()
 111         serverConfig.Certificates = make([]Certificate, 1)
 112
 113         for _, id := range allCipherSuites() {
 114                 if isECDSA(id) {
 115                         serverConfig.Certificates[0].Certificate = [][]byte{testECDSACertificate}
 116                         serverConfig.Certificates[0].PrivateKey = testECDSAPrivateKey
 117                 } else {
 118                         serverConfig.Certificates[0].Certificate = [][]byte{testRSACertificate}
 119                         serverConfig.Certificates[0].PrivateKey = testRSAPrivateKey
 120                 }
 121                 serverConfig.BuildNameToCertificate()
 122                 t.Run(fmt.Sprintf("suite=%#x", id), func(t *testing.T) {
 123                         clientHello := &clientHelloMsg{
 124                                 vers:               VersionTLS12,
 125                                 random:             make([]byte, 32),
 126                                 cipherSuites:       []uint16{id},
 127                                 compressionMethods: []uint8{compressionNone},
 128                                 supportedCurves:    defaultCurvePreferences,
 129                                 supportedPoints:    []uint8{pointFormatUncompressed},
 130                         }
 131
 132                         testClientHello(t, serverConfig, clientHello)
 133                         t.Run("fipstls", func(t *testing.T) {
 134                                 fipstls.Force()
 135                                 defer fipstls.Abandon()
 136                                 msg := ""
 137                                 if !isBoringCipherSuite(id) {
 138                                         msg = "no cipher suite supported by both client and server"
 139                                 }
 140                                 testClientHelloFailure(t, serverConfig, clientHello, msg)
 141                         })
 142                 })
 143         }
 144 }
 145
 146 func TestBoringServerCurves(t *testing.T) {
 147         serverConfig := testConfig.Clone()
 148         serverConfig.Certificates = make([]Certificate, 1)
 149         serverConfig.Certificates[0].Certificate = [][]byte{testECDSACertificate}
 150         serverConfig.Certificates[0].PrivateKey = testECDSAPrivateKey
 151         serverConfig.BuildNameToCertificate()
 152
 153         for _, curveid := range defaultCurvePreferences {
 154                 t.Run(fmt.Sprintf("curve=%d", curveid), func(t *testing.T) {
 155                         clientHello := &clientHelloMsg{
 156                                 vers:               VersionTLS12,
 157                                 random:             make([]byte, 32),
 158                                 cipherSuites:       []uint16{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
 159                                 compressionMethods: []uint8{compressionNone},
 160                                 supportedCurves:    []CurveID{curveid},
 161                                 supportedPoints:    []uint8{pointFormatUncompressed},
 162                         }
 163
 164                         testClientHello(t, serverConfig, clientHello)
 165
 166                         // With fipstls forced, bad curves should be rejected.
 167                         t.Run("fipstls", func(t *testing.T) {
 168                                 fipstls.Force()
 169                                 defer fipstls.Abandon()
 170                                 msg := ""
 171                                 if !isBoringCurve(curveid) {
 172                                         msg = "no cipher suite supported by both client and server"
 173                                 }
 174                                 testClientHelloFailure(t, serverConfig, clientHello, msg)
 175                         })
 176                 })
 177         }
 178 }
 179
 180 func boringHandshake(t *testing.T, clientConfig, serverConfig *Config) (clientErr, serverErr error) {
 181         c, s := localPipe(t)
 182         client := Client(c, clientConfig)
 183         server := Server(s, serverConfig)
 184         done := make(chan error, 1)
 185         go func() {
 186                 done <- client.Handshake()
 187                 c.Close()
 188         }()
 189         serverErr = server.Handshake()
 190         s.Close()
 191         clientErr = <-done
 192         return
 193 }
 194
 195 func TestBoringServerSignatureAndHash(t *testing.T) {
 196         serverConfig := testConfig.Clone()
 197         serverConfig.Certificates = make([]Certificate, 1)
 198
 199         defer func() {
 200                 testingOnlyForceClientHelloSignatureAlgorithms = nil
 201         }()
 202
 203         for _, sigHash := range defaultSupportedSignatureAlgorithms {
 204                 testingOnlyForceClientHelloSignatureAlgorithms = []SignatureScheme{sigHash}
 205
 206                 t.Run(fmt.Sprintf("%#x", sigHash), func(t *testing.T) {
 207                         switch sigHash {
 208                         case PKCS1WithSHA1, PKCS1WithSHA256, PKCS1WithSHA384, PKCS1WithSHA512,
 209                                 PSSWithSHA256, PSSWithSHA384, PSSWithSHA512:
 210                                 serverConfig.CipherSuites = []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256}
 211                                 serverConfig.Certificates[0].Certificate = [][]byte{testRSA2048Certificate}
 212                                 serverConfig.Certificates[0].PrivateKey = testRSA2048PrivateKey
 213                         case Ed25519:
 214                                 serverConfig.CipherSuites = []uint16{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256}
 215                                 serverConfig.Certificates[0].Certificate = [][]byte{testEd25519Certificate}
 216                                 serverConfig.Certificates[0].PrivateKey = testEd25519PrivateKey
 217                         default:
 218                                 serverConfig.CipherSuites = []uint16{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256}
 219                                 serverConfig.Certificates[0].Certificate = [][]byte{testECDSACertificate}
 220                                 serverConfig.Certificates[0].PrivateKey = testECDSAPrivateKey
 221                         }
 222                         serverConfig.BuildNameToCertificate()
 223                         // PKCS#1 v1.5 signature algorithms can't be used standalone in TLS
 224                         // 1.3, and the ECDSA ones bind to the curve used.
 225                         serverConfig.MaxVersion = VersionTLS12
 226
 227                         clientErr, serverErr := boringHandshake(t, testConfig, serverConfig)
 228                         if clientErr != nil {
 229                                 t.Fatalf("expected handshake with %#x to succeed; client error: %v; server error: %v", sigHash, clientErr, serverErr)
 230                         }
 231
 232                         // With fipstls forced, bad curves should be rejected.
 233                         t.Run("fipstls", func(t *testing.T) {
 234                                 fipstls.Force()
 235                                 defer fipstls.Abandon()
 236                                 clientErr, _ := boringHandshake(t, testConfig, serverConfig)
 237                                 if isBoringSignatureScheme(sigHash) {
 238                                         if clientErr != nil {
 239                                                 t.Fatalf("expected handshake with %#x to succeed; err=%v", sigHash, clientErr)
 240                                         }
 241                                 } else {
 242                                         if clientErr == nil {
 243                                                 t.Fatalf("expected handshake with %#x to fail, but it succeeded", sigHash)
 244                                         }
 245                                 }
 246                         })
 247                 })
 248         }
 249 }
 250
 251 func TestBoringClientHello(t *testing.T) {
 252         // Test that no matter what we put in the client config,
 253         // the client does not offer non-FIPS configurations.
 254         fipstls.Force()
 255         defer fipstls.Abandon()
 256
 257         c, s := net.Pipe()
 258         defer c.Close()
 259         defer s.Close()
 260
 261         clientConfig := testConfig.Clone()
 262         // All sorts of traps for the client to avoid.
 263         clientConfig.MinVersion = VersionSSL30
 264         clientConfig.MaxVersion = VersionTLS13
 265         clientConfig.CipherSuites = allCipherSuites()
 266         clientConfig.CurvePreferences = defaultCurvePreferences
 267
 268         go Client(c, testConfig).Handshake()
 269         srv := Server(s, testConfig)
 270         msg, err := srv.readHandshake()
 271         if err != nil {
 272                 t.Fatal(err)
 273         }
 274         hello, ok := msg.(*clientHelloMsg)
 275         if !ok {
 276                 t.Fatalf("unexpected message type %T", msg)
 277         }
 278
 279         if !isBoringVersion(hello.vers) {
 280                 t.Errorf("client vers=%#x, want %#x (TLS 1.2)", hello.vers, VersionTLS12)
 281         }
 282         for _, v := range hello.supportedVersions {
 283                 if !isBoringVersion(v) {
 284                         t.Errorf("client offered disallowed version %#x", v)
 285                 }
 286         }
 287         for _, id := range hello.cipherSuites {
 288                 if !isBoringCipherSuite(id) {
 289                         t.Errorf("client offered disallowed suite %#x", id)
 290                 }
 291         }
 292         for _, id := range hello.supportedCurves {
 293                 if !isBoringCurve(id) {
 294                         t.Errorf("client offered disallowed curve %d", id)
 295                 }
 296         }
 297         for _, sigHash := range hello.supportedSignatureAlgorithms {
 298                 if !isBoringSignatureScheme(sigHash) {
 299                         t.Errorf("client offered disallowed signature-and-hash %v", sigHash)
 300                 }
 301         }
 302 }
 303
 304 func TestBoringCertAlgs(t *testing.T) {
 305         // NaCl, arm and wasm time out generating keys. Nothing in this test is architecture-specific, so just don't bother on those.
 306         if runtime.GOOS == "nacl" || runtime.GOARCH == "arm" || runtime.GOOS == "js" {
 307                 t.Skipf("skipping on %s/%s because key generation takes too long", runtime.GOOS, runtime.GOARCH)
 308         }
 309
 310         // Set up some roots, intermediate CAs, and leaf certs with various algorithms.
 311         // X_Y is X signed by Y.
 312         R1 := boringCert(t, "R1", boringRSAKey(t, 2048), nil, boringCertCA|boringCertFIPSOK)
 313         R2 := boringCert(t, "R2", boringRSAKey(t, 4096), nil, boringCertCA)
 314
 315         M1_R1 := boringCert(t, "M1_R1", boringECDSAKey(t, elliptic.P256()), R1, boringCertCA|boringCertFIPSOK)
 316         M2_R1 := boringCert(t, "M2_R1", boringECDSAKey(t, elliptic.P224()), R1, boringCertCA)
 317
 318         I_R1 := boringCert(t, "I_R1", boringRSAKey(t, 3072), R1, boringCertCA|boringCertFIPSOK)
 319         I_R2 := boringCert(t, "I_R2", I_R1.key, R2, boringCertCA|boringCertFIPSOK)
 320         I_M1 := boringCert(t, "I_M1", I_R1.key, M1_R1, boringCertCA|boringCertFIPSOK)
 321         I_M2 := boringCert(t, "I_M2", I_R1.key, M2_R1, boringCertCA|boringCertFIPSOK)
 322
 323         L1_I := boringCert(t, "L1_I", boringECDSAKey(t, elliptic.P384()), I_R1, boringCertLeaf|boringCertFIPSOK)
 324         L2_I := boringCert(t, "L2_I", boringRSAKey(t, 1024), I_R1, boringCertLeaf)
 325
 326         // boringCert checked that isBoringCertificate matches the caller's boringCertFIPSOK bit.
 327         // If not, no point in building bigger end-to-end tests.
 328         if t.Failed() {
 329                 t.Fatalf("isBoringCertificate failures; not continuing")
 330         }
 331
 332         // client verifying server cert
 333         testServerCert := func(t *testing.T, desc string, pool *x509.CertPool, key interface{}, list [][]byte, ok bool) {
 334                 clientConfig := testConfig.Clone()
 335                 clientConfig.RootCAs = pool
 336                 clientConfig.InsecureSkipVerify = false
 337                 clientConfig.ServerName = "example.com"
 338
 339                 serverConfig := testConfig.Clone()
 340                 serverConfig.Certificates = []Certificate{{Certificate: list, PrivateKey: key}}
 341                 serverConfig.BuildNameToCertificate()
 342
 343                 clientErr, _ := boringHandshake(t, clientConfig, serverConfig)
 344
 345                 if (clientErr == nil) == ok {
 346                         if ok {
 347                                 t.Logf("%s: accept", desc)
 348                         } else {
 349                                 t.Logf("%s: reject", desc)
 350                         }
 351                 } else {
 352                         if ok {
 353                                 t.Errorf("%s: BAD reject (%v)", desc, clientErr)
 354                         } else {
 355                                 t.Errorf("%s: BAD accept", desc)
 356                         }
 357                 }
 358         }
 359
 360         // server verifying client cert
 361         testClientCert := func(t *testing.T, desc string, pool *x509.CertPool, key interface{}, list [][]byte, ok bool) {
 362                 clientConfig := testConfig.Clone()
 363                 clientConfig.ServerName = "example.com"
 364                 clientConfig.Certificates = []Certificate{{Certificate: list, PrivateKey: key}}
 365
 366                 serverConfig := testConfig.Clone()
 367                 serverConfig.ClientCAs = pool
 368                 serverConfig.ClientAuth = RequireAndVerifyClientCert
 369
 370                 _, serverErr := boringHandshake(t, clientConfig, serverConfig)
 371
 372                 if (serverErr == nil) == ok {
 373                         if ok {
 374                                 t.Logf("%s: accept", desc)
 375                         } else {
 376                                 t.Logf("%s: reject", desc)
 377                         }
 378                 } else {
 379                         if ok {
 380                                 t.Errorf("%s: BAD reject (%v)", desc, serverErr)
 381                         } else {
 382                                 t.Errorf("%s: BAD accept", desc)
 383                         }
 384                 }
 385         }
 386
 387         // Run simple basic test with known answers before proceeding to
 388         // exhaustive test with computed answers.
 389         r1pool := x509.NewCertPool()
 390         r1pool.AddCert(R1.cert)
 391         testServerCert(t, "basic", r1pool, L2_I.key, [][]byte{L2_I.der, I_R1.der}, true)
 392         testClientCert(t, "basic (client cert)", r1pool, L2_I.key, [][]byte{L2_I.der, I_R1.der}, true)
 393         fipstls.Force()
 394         testServerCert(t, "basic (fips)", r1pool, L2_I.key, [][]byte{L2_I.der, I_R1.der}, false)
 395         testClientCert(t, "basic (fips, client cert)", r1pool, L2_I.key, [][]byte{L2_I.der, I_R1.der}, false)
 396         fipstls.Abandon()
 397
 398         if t.Failed() {
 399                 t.Fatal("basic test failed, skipping exhaustive test")
 400         }
 401
 402         if testing.Short() {
 403                 t.Logf("basic test passed; skipping exhaustive test in -short mode")
 404                 return
 405         }
 406
 407         for l := 1; l <= 2; l++ {
 408                 leaf := L1_I
 409                 if l == 2 {
 410                         leaf = L2_I
 411                 }
 412                 for i := 0; i < 64; i++ {
 413                         reachable := map[string]bool{leaf.parentOrg: true}
 414                         reachableFIPS := map[string]bool{leaf.parentOrg: leaf.fipsOK}
 415                         list := [][]byte{leaf.der}
 416                         listName := leaf.name
 417                         addList := func(cond int, c *boringCertificate) {
 418                                 if cond != 0 {
 419                                         list = append(list, c.der)
 420                                         listName += "," + c.name
 421                                         if reachable[c.org] {
 422                                                 reachable[c.parentOrg] = true
 423                                         }
 424                                         if reachableFIPS[c.org] && c.fipsOK {
 425                                                 reachableFIPS[c.parentOrg] = true
 426                                         }
 427                                 }
 428                         }
 429                         addList(i&1, I_R1)
 430                         addList(i&2, I_R2)
 431                         addList(i&4, I_M1)
 432                         addList(i&8, I_M2)
 433                         addList(i&16, M1_R1)
 434                         addList(i&32, M2_R1)
 435
 436                         for r := 1; r <= 3; r++ {
 437                                 pool := x509.NewCertPool()
 438                                 rootName := ","
 439                                 shouldVerify := false
 440                                 shouldVerifyFIPS := false
 441                                 addRoot := func(cond int, c *boringCertificate) {
 442                                         if cond != 0 {
 443                                                 rootName += "," + c.name
 444                                                 pool.AddCert(c.cert)
 445                                                 if reachable[c.org] {
 446                                                         shouldVerify = true
 447                                                 }
 448                                                 if reachableFIPS[c.org] && c.fipsOK {
 449                                                         shouldVerifyFIPS = true
 450                                                 }
 451                                         }
 452                                 }
 453                                 addRoot(r&1, R1)
 454                                 addRoot(r&2, R2)
 455                                 rootName = rootName[1:] // strip leading comma
 456                                 testServerCert(t, listName+"->"+rootName[1:], pool, leaf.key, list, shouldVerify)
 457                                 testClientCert(t, listName+"->"+rootName[1:]+"(client cert)", pool, leaf.key, list, shouldVerify)
 458                                 fipstls.Force()
 459                                 testServerCert(t, listName+"->"+rootName[1:]+" (fips)", pool, leaf.key, list, shouldVerifyFIPS)
 460                                 testClientCert(t, listName+"->"+rootName[1:]+" (fips, client cert)", pool, leaf.key, list, shouldVerifyFIPS)
 461                                 fipstls.Abandon()
 462                         }
 463                 }
 464         }
 465 }
 466
 467 const (
 468         boringCertCA = iota
 469         boringCertLeaf
 470         boringCertFIPSOK = 0x80
 471 )
 472
 473 func boringRSAKey(t *testing.T, size int) *rsa.PrivateKey {
 474         k, err := rsa.GenerateKey(rand.Reader, size)
 475         if err != nil {
 476                 t.Fatal(err)
 477         }
 478         return k
 479 }
 480
 481 func boringECDSAKey(t *testing.T, curve elliptic.Curve) *ecdsa.PrivateKey {
 482         k, err := ecdsa.GenerateKey(curve, rand.Reader)
 483         if err != nil {
 484                 t.Fatal(err)
 485         }
 486         return k
 487 }
 488
 489 type boringCertificate struct {
 490         name      string
 491         org       string
 492         parentOrg string
 493         der       []byte
 494         cert      *x509.Certificate
 495         key       interface{}
 496         fipsOK    bool
 497 }
 498
 499 func boringCert(t *testing.T, name string, key interface{}, parent *boringCertificate, mode int) *boringCertificate {
 500         org := name
 501         parentOrg := ""
 502         if i := strings.Index(org, "_"); i >= 0 {
 503                 org = org[:i]
 504                 parentOrg = name[i+1:]
 505         }
 506         tmpl := &x509.Certificate{
 507                 SerialNumber: big.NewInt(1),
 508                 Subject: pkix.Name{
 509                         Organization: []string{org},
 510                 },
 511                 NotBefore: time.Unix(0, 0),
 512                 NotAfter:  time.Unix(0, 0),
 513
 514                 KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
 515                 ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
 516                 BasicConstraintsValid: true,
 517         }
 518         if mode&^boringCertFIPSOK == boringCertLeaf {
 519                 tmpl.DNSNames = []string{"example.com"}
 520         } else {
 521                 tmpl.IsCA = true
 522                 tmpl.KeyUsage |= x509.KeyUsageCertSign
 523         }
 524
 525         var pcert *x509.Certificate
 526         var pkey interface{}
 527         if parent != nil {
 528                 pcert = parent.cert
 529                 pkey = parent.key
 530         } else {
 531                 pcert = tmpl
 532                 pkey = key
 533         }
 534
 535         var pub interface{}
 536         var desc string
 537         switch k := key.(type) {
 538         case *rsa.PrivateKey:
 539                 pub = &k.PublicKey
 540                 desc = fmt.Sprintf("RSA-%d", k.N.BitLen())
 541         case *ecdsa.PrivateKey:
 542                 pub = &k.PublicKey
 543                 desc = "ECDSA-" + k.Curve.Params().Name
 544         default:
 545                 t.Fatalf("invalid key %T", key)
 546         }
 547
 548         der, err := x509.CreateCertificate(rand.Reader, tmpl, pcert, pub, pkey)
 549         if err != nil {
 550                 t.Fatal(err)
 551         }
 552         cert, err := x509.ParseCertificate(der)
 553         if err != nil {
 554                 t.Fatal(err)
 555         }
 556
 557         // Tell isBoringCertificate to enforce FIPS restrictions for this check.
 558         fipstls.Force()
 559         defer fipstls.Abandon()
 560
 561         fipsOK := mode&boringCertFIPSOK != 0
 562         if isBoringCertificate(cert) != fipsOK {
 563                 t.Errorf("isBoringCertificate(cert with %s key) = %v, want %v", desc, !fipsOK, fipsOK)
 564         }
 565         return &boringCertificate{name, org, parentOrg, der, cert, key, fipsOK}
 566 }
 567
 568 // A self-signed test certificate with an RSA key of size 2048, for testing
 569 // RSA-PSS with SHA512. SAN of example.golang.
 570 var (
 571         testRSA2048Certificate []byte
 572         testRSA2048PrivateKey  *rsa.PrivateKey
 573 )
 574
 575 func init() {
 576         block, _ := pem.Decode([]byte(`
 577 -----BEGIN CERTIFICATE-----
 578 MIIC/zCCAeegAwIBAgIRALHHX/kh4+4zMU9DarzBEcQwDQYJKoZIhvcNAQELBQAw
 579 EjEQMA4GA1UEChMHQWNtZSBDbzAeFw0xMTAxMDExNTA0MDVaFw0yMDEyMjkxNTA0
 580 MDVaMBIxEDAOBgNVBAoTB0FjbWUgQ28wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
 581 ggEKAoIBAQCf8fk0N6ieCBX4IOVIfKitt4kGcOQLeimCfsjqqHcysMIVGEtFSM6E
 582 4Ay141f/7IqdW0UtIqNb4PXhROID7yDxR284xL6XbCuv/t5hP3UcehYc3hmLiyVd
 583 MkZQiZWtfUUJf/1qOtM+ohNg59LRWp4d+6iX0la1JL3EwCIckkNjJ9hQbF7Pb2CS
 584 +ES9Yo55KAap8KOblpcR8MBSN38bqnwjfQdCXvOEOjam2HUxKzEFX5MA+fA0me4C
 585 ioCcCRLWKl+GoN9F8fABfoZ+T+2eal4DLuO95rXR8SrOIVBh3XFOr/RVhjtXcNVF
 586 ZKcvDt6d68V6jAKAYKm5nlj9GPpd4v+rAgMBAAGjUDBOMA4GA1UdDwEB/wQEAwIF
 587 oDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMBkGA1UdEQQSMBCC
 588 DmV4YW1wbGUuZ29sYW5nMA0GCSqGSIb3DQEBCwUAA4IBAQCOoYsVcFCBhboqe3WH
 589 dC6V7XXXECmnjh01r8h80yv0NR379nSD3cw2M+HKvaXysWqrl5hjGVKw0vtwD81r
 590 V4JzDu7IfIog5m8+QNC+7LqDZsz88vDKOrsoySVOmUCgmCKFXew+LA+eO/iQEJTr
 591 7ensddOeXJEp27Ed5vW+kmWW3Qmglc2Gwy8wFrMDIqnrnOzBA4oCnDEgtXJt0zog
 592 nRwbfEMAWi1aQRy5dT9KA3SP9mo5SeTFSzGGHiE4s4gHUe7jvsAFF2qgtD6+wH6s
 593 z9b6shxnC7g5IlBKhI7SVB/Uqt2ydJ+kH1YbjMcIq6NAM5eNMKgZuJr3+zwsSgwh
 594 GNaE
 595 -----END CERTIFICATE-----`))
 596         testRSA2048Certificate = block.Bytes
 597
 598         block, _ = pem.Decode([]byte(`
 599 -----BEGIN RSA PRIVATE KEY-----
 600 MIIEpAIBAAKCAQEAn/H5NDeonggV+CDlSHyorbeJBnDkC3opgn7I6qh3MrDCFRhL
 601 RUjOhOAMteNX/+yKnVtFLSKjW+D14UTiA+8g8UdvOMS+l2wrr/7eYT91HHoWHN4Z
 602 i4slXTJGUImVrX1FCX/9ajrTPqITYOfS0VqeHfuol9JWtSS9xMAiHJJDYyfYUGxe
 603 z29gkvhEvWKOeSgGqfCjm5aXEfDAUjd/G6p8I30HQl7zhDo2pth1MSsxBV+TAPnw
 604 NJnuAoqAnAkS1ipfhqDfRfHwAX6Gfk/tnmpeAy7jvea10fEqziFQYd1xTq/0VYY7
 605 V3DVRWSnLw7enevFeowCgGCpuZ5Y/Rj6XeL/qwIDAQABAoIBAQCNpMZifd/vg42h
 606 HdCvLuZaYS0R7SunFlpoXEsltGdLFsnp0IfoJZ/ugFQBSAIIfLwMumU6oXA1z7Uv
 607 98aIYV61DePrTCDVDFBsHbNmP8JAo8WtbusEbwd5zyoB7LYG2+clkJklWE73KqUq
 608 rmI+UJeyScl2Gin7ZTxBXz1WPBk9VwcnwkeaXpgASIBW23fhECM9gnYEEwaBez5T
 609 6Me8d1tHtYQv7vsKe7ro9w9/HKrRXejqYKK1LxkhfFriyV+m8LZJZn2nXOa6G3gF
 610 Nb8Qk1Uk5PUBENBmyMFJhT4M/uuSq4YtMrrO2gi8Q+fPhuGzc5SshYKRBp0W4P5r
 611 mtVCtEFRAoGBAMENBIFLrV2+HsGj0xYFasKov/QPe6HSTR1Hh2IZONp+oK4oszWE
 612 jBT4VcnITmpl6tC1Wy4GcrxjNgKIFZAj+1x1LUULdorXkuG8yr0tAhG9zNyfWsSy
 613 PrSovC0UVbzr8Jxxla+kQVxEQQqWQxPlEVuL8kXaIDA6Lyt1Hpua2LvPAoGBANQZ
 614 c6Lq2T7+BxLxNdi2m8kZzej5kgzBp/XdVsbFWRlebIX2KrFHsrHzT9PUk3DE1vZK
 615 M6pzTt94nQhWSkDgCaw1SohElJ3HFIFwcusF1SJAc3pQepd8ug6IYdlpDMLtBj/P
 616 /5P6BVUtgo05E4+I/T3iYatmglQxTtlZ0RkSV2llAoGBALOXkKFX7ahPvf0WksDh
 617 uTfuFOTPoowgQG0EpgW0wRdCxeg/JLic3lSD0gsttQV2WsRecryWcxaelRg10RmO
 618 38BbogmhaF4xvgsSvujOfiZTE8oK1T43M+6NKsIlML3YILbpU/9aJxPWy0s2DqDr
 619 cQJhZrlk+pzjBA7Bnf/URdwxAoGAKR/CNw14D+mrL3YLbbiCXiydqxVwxv5pdZdz
 620 8thi3TNcsWC4iGURdcVqbfUinVPdJiXe/Kac3WGCeRJaFVgbKAOxLti1RB5MkIhg
 621 D8eyupBqk4W1L1gkrxqsdj4TFlxkwMywjl2E2S4YyQ8PBt6V04DoVRZsIKzqz+PF
 622 UionPq0CgYBCYXvqioJhPewkOq/Y5wrDBeZW1FQK5QD9W5M8/5zxd4rdvJtjhbJp
 623 oOrtvMdrl6upy9Hz4BJD3FXwVFiPFE7jqeNqi0F21viLxBPMMD3UODF6LL5EyLiR
 624 9V4xVMS8KXxvg7rxsuqzMPscViaWUL6WNVBhsD2+92dHxSXzz5EJKQ==
 625 -----END RSA PRIVATE KEY-----`))
 626         var err error
 627         testRSA2048PrivateKey, err = x509.ParsePKCS1PrivateKey(block.Bytes)
 628         if err != nil {
 629                 panic(err)
 630         }
 631 }