From 8bfd0dc6b44438ba6c5d2844ce21fbc2adfe3f1a Mon Sep 17 00:00:00 2001 From: Thomas Vanbesien Date: Wed, 18 Feb 2026 23:09:43 +0100 Subject: Add TOFU certificate bootstrap integration test Make download-cert always use an unsecure client so it can connect to a server's None discovery endpoint without the server certificate in the trust store. Add a cert_bootstrap test that verifies the full Trust On First Use workflow: find-servers succeeds, get-endpoints fails (untrusted cert), download-cert retrieves the certificate via None, then get-endpoints and read-time both succeed. --- tests/cert_bootstrap/certs/Client/cert.der | Bin 0 -> 913 bytes tests/cert_bootstrap/certs/Client/key.der | Bin 0 -> 1217 bytes tests/cert_bootstrap/certs/ServerLDS/cert.der | Bin 0 -> 922 bytes tests/cert_bootstrap/certs/ServerLDS/key.der | Bin 0 -> 1217 bytes tests/cert_bootstrap/certs/ServerRegister/cert.der | Bin 0 -> 937 bytes tests/cert_bootstrap/certs/ServerRegister/key.der | Bin 0 -> 1217 bytes tests/cert_bootstrap/certs/ServerRegisterClient/cert.der | Bin 0 -> 949 bytes tests/cert_bootstrap/certs/ServerRegisterClient/key.der | Bin 0 -> 1219 bytes tests/cert_bootstrap/certs/trust/Client_cert.der | Bin 0 -> 913 bytes tests/cert_bootstrap/certs/trust/ServerLDS_cert.der | Bin 0 -> 922 bytes .../certs/trust/ServerRegisterClient_cert.der | Bin 0 -> 949 bytes tests/cert_bootstrap/certs/trust/ServerRegister_cert.der | Bin 0 -> 937 bytes .../cert_bootstrap/certs/trust_client/ServerLDS_cert.der | Bin 0 -> 922 bytes tests/cert_bootstrap/client.conf | 14 ++++++++++++++ tests/cert_bootstrap/server_lds.conf | 13 +++++++++++++ tests/cert_bootstrap/server_register.conf | 12 ++++++++++++ tests/cert_bootstrap/server_register_client.conf | 13 +++++++++++++ 17 files changed, 52 insertions(+) create mode 100644 tests/cert_bootstrap/certs/Client/cert.der create mode 100644 tests/cert_bootstrap/certs/Client/key.der create mode 100644 tests/cert_bootstrap/certs/ServerLDS/cert.der create mode 100644 tests/cert_bootstrap/certs/ServerLDS/key.der create mode 100644 tests/cert_bootstrap/certs/ServerRegister/cert.der create mode 100644 tests/cert_bootstrap/certs/ServerRegister/key.der create mode 100644 tests/cert_bootstrap/certs/ServerRegisterClient/cert.der create mode 100644 tests/cert_bootstrap/certs/ServerRegisterClient/key.der create mode 100644 tests/cert_bootstrap/certs/trust/Client_cert.der create mode 100644 tests/cert_bootstrap/certs/trust/ServerLDS_cert.der create mode 100644 tests/cert_bootstrap/certs/trust/ServerRegisterClient_cert.der create mode 100644 tests/cert_bootstrap/certs/trust/ServerRegister_cert.der create mode 100644 tests/cert_bootstrap/certs/trust_client/ServerLDS_cert.der create mode 100644 tests/cert_bootstrap/client.conf create mode 100644 tests/cert_bootstrap/server_lds.conf create mode 100644 tests/cert_bootstrap/server_register.conf create mode 100644 tests/cert_bootstrap/server_register_client.conf (limited to 'tests/cert_bootstrap') diff --git a/tests/cert_bootstrap/certs/Client/cert.der b/tests/cert_bootstrap/certs/Client/cert.der new file mode 100644 index 0000000..84724c1 Binary files /dev/null and b/tests/cert_bootstrap/certs/Client/cert.der differ diff --git a/tests/cert_bootstrap/certs/Client/key.der b/tests/cert_bootstrap/certs/Client/key.der new file mode 100644 index 0000000..17403f0 Binary files /dev/null and b/tests/cert_bootstrap/certs/Client/key.der differ diff --git a/tests/cert_bootstrap/certs/ServerLDS/cert.der b/tests/cert_bootstrap/certs/ServerLDS/cert.der new file mode 100644 index 0000000..9983c3b Binary files /dev/null and b/tests/cert_bootstrap/certs/ServerLDS/cert.der differ diff --git a/tests/cert_bootstrap/certs/ServerLDS/key.der b/tests/cert_bootstrap/certs/ServerLDS/key.der new file mode 100644 index 0000000..ca209fc Binary files /dev/null and b/tests/cert_bootstrap/certs/ServerLDS/key.der differ diff --git a/tests/cert_bootstrap/certs/ServerRegister/cert.der b/tests/cert_bootstrap/certs/ServerRegister/cert.der new file mode 100644 index 0000000..9fb39f5 Binary files /dev/null and b/tests/cert_bootstrap/certs/ServerRegister/cert.der differ diff --git a/tests/cert_bootstrap/certs/ServerRegister/key.der b/tests/cert_bootstrap/certs/ServerRegister/key.der new file mode 100644 index 0000000..62eaca2 Binary files /dev/null and b/tests/cert_bootstrap/certs/ServerRegister/key.der differ diff --git a/tests/cert_bootstrap/certs/ServerRegisterClient/cert.der b/tests/cert_bootstrap/certs/ServerRegisterClient/cert.der new file mode 100644 index 0000000..937960e Binary files /dev/null and b/tests/cert_bootstrap/certs/ServerRegisterClient/cert.der differ diff --git a/tests/cert_bootstrap/certs/ServerRegisterClient/key.der b/tests/cert_bootstrap/certs/ServerRegisterClient/key.der new file mode 100644 index 0000000..1bd17d2 Binary files /dev/null and b/tests/cert_bootstrap/certs/ServerRegisterClient/key.der differ diff --git a/tests/cert_bootstrap/certs/trust/Client_cert.der b/tests/cert_bootstrap/certs/trust/Client_cert.der new file mode 100644 index 0000000..84724c1 Binary files /dev/null and b/tests/cert_bootstrap/certs/trust/Client_cert.der differ diff --git a/tests/cert_bootstrap/certs/trust/ServerLDS_cert.der b/tests/cert_bootstrap/certs/trust/ServerLDS_cert.der new file mode 100644 index 0000000..9983c3b Binary files /dev/null and b/tests/cert_bootstrap/certs/trust/ServerLDS_cert.der differ diff --git a/tests/cert_bootstrap/certs/trust/ServerRegisterClient_cert.der b/tests/cert_bootstrap/certs/trust/ServerRegisterClient_cert.der new file mode 100644 index 0000000..937960e Binary files /dev/null and b/tests/cert_bootstrap/certs/trust/ServerRegisterClient_cert.der differ diff --git a/tests/cert_bootstrap/certs/trust/ServerRegister_cert.der b/tests/cert_bootstrap/certs/trust/ServerRegister_cert.der new file mode 100644 index 0000000..9fb39f5 Binary files /dev/null and b/tests/cert_bootstrap/certs/trust/ServerRegister_cert.der differ diff --git a/tests/cert_bootstrap/certs/trust_client/ServerLDS_cert.der b/tests/cert_bootstrap/certs/trust_client/ServerLDS_cert.der new file mode 100644 index 0000000..9983c3b Binary files /dev/null and b/tests/cert_bootstrap/certs/trust_client/ServerLDS_cert.der differ diff --git a/tests/cert_bootstrap/client.conf b/tests/cert_bootstrap/client.conf new file mode 100644 index 0000000..8c54f04 --- /dev/null +++ b/tests/cert_bootstrap/client.conf @@ -0,0 +1,14 @@ +# Client — test: cert_bootstrap +# Uses a restricted trust store with only the LDS certificate. +# The ServerRegister certificate is NOT initially trusted. + +applicationUri = urn:localhost:bobink:Client + +certificate = tests/cert_bootstrap/certs/Client/cert.der +privateKey = tests/cert_bootstrap/certs/Client/key.der +trustStore = tests/cert_bootstrap/certs/trust_client + +securityMode = SignAndEncrypt +securityPolicy = Aes256_Sha256_RsaPss + +authMode = anonymous diff --git a/tests/cert_bootstrap/server_lds.conf b/tests/cert_bootstrap/server_lds.conf new file mode 100644 index 0000000..6cbfdcf --- /dev/null +++ b/tests/cert_bootstrap/server_lds.conf @@ -0,0 +1,13 @@ +# ServerLDS — test: cert_bootstrap +# Secured LDS with discovery-only None endpoint. + +port = 14840 +applicationUri = urn:localhost:bobink:ServerLDS + +certificate = tests/cert_bootstrap/certs/ServerLDS/cert.der +privateKey = tests/cert_bootstrap/certs/ServerLDS/key.der +trustStore = tests/cert_bootstrap/certs/trust + +authMode = anonymous + +cleanupTimeout = 60 diff --git a/tests/cert_bootstrap/server_register.conf b/tests/cert_bootstrap/server_register.conf new file mode 100644 index 0000000..b065f66 --- /dev/null +++ b/tests/cert_bootstrap/server_register.conf @@ -0,0 +1,12 @@ +# ServerRegister server config — test: cert_bootstrap + +port = 14841 +applicationUri = urn:localhost:bobink:ServerRegister + +certificate = tests/cert_bootstrap/certs/ServerRegister/cert.der +privateKey = tests/cert_bootstrap/certs/ServerRegister/key.der +trustStore = tests/cert_bootstrap/certs/trust + +authMode = anonymous + +registerInterval = 10 diff --git a/tests/cert_bootstrap/server_register_client.conf b/tests/cert_bootstrap/server_register_client.conf new file mode 100644 index 0000000..e1cff06 --- /dev/null +++ b/tests/cert_bootstrap/server_register_client.conf @@ -0,0 +1,13 @@ +# ServerRegister client config — test: cert_bootstrap +# Registers with the secured LDS over an encrypted channel. + +applicationUri = urn:localhost:bobink:ServerRegister + +certificate = tests/cert_bootstrap/certs/ServerRegisterClient/cert.der +privateKey = tests/cert_bootstrap/certs/ServerRegisterClient/key.der +trustStore = tests/cert_bootstrap/certs/trust + +securityMode = SignAndEncrypt +securityPolicy = Aes256_Sha256_RsaPss + +authMode = anonymous -- cgit v1.2.3