Testing OpenCA

Michael Bell


Table of Contents

1. Introduction
Implications
Extra Security Part
Contribution
I. Software Aspects
2. Installation and Configuration
Offline-CA
Online-CA
DC-Style
Token
Without SCEP
3. Maintenance
Backup
Recovery
Software-Update
Database structure update
II. Administrative Operations
4. Initialization
- Phase I
- Phase II
- Phase III
5. Dataexchange
CA <--> RA
CA-Certificates
Certificates
CSRs
CRRs
CRLs
Configuration
All
RA <--> pub
CA-Certificates
Certificates
CSRs
CRRs
CRLs
Configuration
All
New Node Manager
With higher level
With lower level
LDAP update
CA-Certificate
Certificate
CRL
6. Access Control
Channel Verification
Authentication
None
Password
X.509
Session management
Cookie
Access Control List
Authentication for Token
7. Logging
Loggers
Syslog
XML
Monitoring
Events
Access Control
Tokens
Command
8. Tokens
Modules
OpenSSL
LunaCA3
Empty
Operational Modes
Standby
Session
Daemon
III. Basic Operations
9. Certificate Signing Requests (correct?)
Mozilla, Netscape Communicator and Opera
Submission
Editing
Approval
Issue Certificate
Enrollment
Microsoft Internet Explorer
Submission
Editing
Approval
Issue Certificate
Enrollment
Serverside generated Keys and Requests
Submission
Editing
Approval
Issue Certificate
Enrollment
Keyhandling
PKCS#10 Request
Submission
Editing
Approval
Issue Certificate
Enrollment
SCEP Requests
Submission
Editing
Approval
Issue Certificate
Enrollment
Renewed Requests
Submission
Editing
Approval
Issue Certificate
Enrollment
Keyhandling
10. Certificate Revocation Requests
11. Certificate Revocation List
IV. Advanced Functionality
12. Batchprocessors
Configuration
Certificate Issuing
requests
Automatic Certificate Generation
Certificate Enrollment
Automatic Revocation
Keyrecovery
Keybackup
Recover only the private key
Recover cert and private key
13. LDAP
Treeconstruction
Server Init
Single Suffix
Several Suffixes
Multivalued Attributes
CA-Certificates
Schemacompliance
Sub-DNs
Errormessages
Insertion
Update
Deletion
Certificates
Schemacompliance
Sub-DNs
Errormessages
Insertion
Update
Deletion
CRLs
Schemacompliance
Sub-DNs
Errormessages
Insertion
Update
Deletion
14. SCEP
GetCACert and GetCACertChain
GetCACert
GetCACertChain
GetCACert and GetCACertChain
PKCSReq
GetCertInitial
GetCert
GetCRL
15. OCSP
V. Security
16.
Keys
Identical Keys
Key Quality
Key Generation
Keybackup
Access Control
Dataexchange
Manipulated configuration
New Node Manager
Objectinjection
Stateinjection
Permissions
etc
var
lib
bin
sbin

Chapter 1. Introduction

Explicit testcases are not very common for Open Source projects. There is only a very small number of projects which perform standardized tests. One example is OpenSSL. Nevertheless it is the only way to test software systematically and this absolutely necessary for security relevant systems.

Testcases are good source of documentation because they also describe how a function should work and a user can understand what a developer wants. So testdocuments itself can produce good feedback from users. They made it much more easier for people to evaluate the software because they can compare their requirements with our checklists.

Implications

This document is not a simple checklist which you can take, make several check marks and then you know that all is working fine. We support several backend databases and you have to perform all checks for every single supported database backend. So if you start verifying OpenCA with this document then please use the database backend which you use in your production environment.

If there is a new upcoming major release and somebody checks the release then please write small document which lists the performed tests and the results to allow fast bugfixing. Please don't fix bugs for yourself and don't publish the patches. In the past there are several users which fix some problems and never report it. The result was that several people independtly fixed the same bug. This is wasted time and results in badder quality because the result of a bugfix which was revisited by several people is much better then dozens of individuals fixes.

Extra Security Part

Why does there be an extra security part? Because we need a central point were we can document security issues like key checking and attack scenarios. It is also a first point were you can start defining the security of the CA.

It is also the place to describe common security problem with PKI software which you found. This avoid that we do the same mistake twice.

Contribution

How does the document be continued? Really simple - if you miss something then write it down and send it to us (openca-users@lists.sf.org). This is the best way to extend such documents. If you are user and you need a feature then write down a testdescription. We integrate into our testcases and if the test fails then it is a bug.

Generally it is a good idea to write down testspecifications for your PKI. If you have trouble with OpenCA then send us the problematical specification and we can think and discuss about the problems. The major goal is to integrate such specifications into our test documents.

Developers should think about tests if the finish a software part and write down at minimum some basic tests. This is much easier then to discuss over design flaws ;-)

Software Aspects

Chapter 2. Installation and Configuration

This chapter should test the installation process for every possible configration. Like usual this is not possible. So if somebody find a configuration which doesn't work then please write a general testconfiguration which creates the error and we add it to this document.

Offline-CA

Online-CA

DC-Style

Token

Without SCEP

Chapter 3. Maintenance

Backup

Recovery

Software-Update

Database structure update

Administrative Operations

Chapter 4. Initialization

- Phase I

This do the core intitialization of the CA. Here we create a database, the private key and perhaps a self-signed cert. If this phase is complete then there is full operational CA.

All other steps are used to made the CA more usable by helping with the steps but phase I is a MUST for every new OpenCA system except of imports from other CAs.

- Phase II

- Phase III

Chapter 5. Dataexchange

CA <--> RA

CA-Certificates

Certificates

CSRs

CRRs

CRLs

Configuration

All

RA <--> pub

CA-Certificates

Certificates

CSRs

CRRs

CRLs

Configuration

All

New Node Manager

With higher level

With lower level

LDAP update

CA-Certificate

Initial

Update

Certificate

Initial

Update

Additional Certificate

Deletion

CRL

Initial

Update

Chapter 6. Access Control

Channel Verification

Authentication

None

Password

X.509

Session management

Cookie

Lifetime

Automatical deletion

Manual deletion

Access Control List

Authentication for Token

Chapter 7. Logging

Loggers

Syslog

Sys

Net

Unix

XML

Monitoring

Events

Access Control

Tokens

Command

Chapter 8. Tokens

Modules

OpenSSL

LunaCA3

Issue certificates

Logging

Keybackup

Empty

Operational Modes

Standby

Session

Daemon

Basic Operations

Chapter 9. Certificate Signing Requests (correct?)

Mozilla, Netscape Communicator and Opera

Submission

Editing

Approval

Without Signing

Signed by Netscape

Signed by IE without patch MS02-48

Signed by IE with patch MS02-48

Issue Certificate

Enrollment

Microsoft Internet Explorer

Submission

Editing

Approval

Without Signing

Signed by Netscape

Signed by IE without patch MS02-48

Signed by IE with patch MS02-48

Issue Certificate

Enrollment

Serverside generated Keys and Requests

Submission

Editing

Approval

Without Signing

Signed by Netscape

Signed by IE without patch MS02-48

Signed by IE with patch MS02-48

Issue Certificate

Enrollment

Install via PKCS#12

Install via PKCS\#8

PEM

DER

Install via OpenSSL/SSLeay

Keyhandling

Encryption

Deletion

Change Passphrase

PKCS#10 Request

Submission

Editing

Approval

Without Signing

Signed by Netscape

Signed by IE without patch MS02-48

Signed by IE with patch MS02-48

Issue Certificate

Enrollment

Download PEM

Download DER

Download CRT

Download CER

Download TXT

SCEP Requests

Submission

This will be tested in the SCEP specific area.

Editing

Approval

Without Signing

Signed by Netscape

Signed by IE without patch MS02-48

Signed by IE with patch MS02-48

Issue Certificate

Enrollment

This will be tested in the SCEP specific area.

Renewed Requests

Submission

Editing

Approval

Without Signing

Signed by Netscape

Signed by IE without patch MS02-48

Signed by IE with patch MS02-48

Issue Certificate

Enrollment

See Serverside KEy- and Requestgeneration.

Keyhandling

See Serverside KEy- and Requestgeneration.

Chapter 10. Certificate Revocation Requests

Chapter 11. Certificate Revocation List

Advanced Functionality

Chapter 12. Batchprocessors

Configuration

Certificate Issuing

requests

Fullautomatic

With Keybackup

User generated Requests

Automatic Certificate Generation

Certificate Enrollment

Automatic Revocation

Keyrecovery

Keybackup

This will be handled in the request area of batchprocessors.

Recover only the private key

Recover cert and private key

PKCS#8

PKCS#12

OpenSSL/SSLeay

Chapter 13. LDAP

Treeconstruction

Server Init

Single Suffix

Several Suffixes

Multivalued Attributes

CA-Certificates

Schemacompliance

Sub-DNs

Errormessages

Insertion

Update

Deletion

Certificates

Schemacompliance

Sub-DNs

Errormessages

Insertion

Update

Deletion

CRLs

Schemacompliance

Sub-DNs

Errormessages

Insertion

Update

Deletion

Chapter 14. SCEP

GetCACert and GetCACertChain

GetCACert

GetCACertChain

GetCACert and GetCACertChain

PKCSReq

GetCertInitial

GetCert

GetCRL

Chapter 15. OCSP

This is definitly not my job.

Security

Chapter 16. 

Keys

Identical Keys

Key Quality

Key Generation

Keybackup

Access Control

Dataexchange

Manipulated configuration

New Node Manager

Objectinjection

Stateinjection

Permissions

etc

var

lib

bin

sbin