commit 97856712470c744eea4539675c3901f6ba7211c9
Author: Stanislav Král <stanislav.kral3@gmail.com>
Date:   Thu Apr 22 00:49:05 2021 +0200

    Re #8585 - Edited certificate_service_test.py tests asserting that various extension field flags are set when certain usages are selected

diff --git a/tests/integration_tests/services/certificate_service_test.py b/tests/integration_tests/services/certificate_service_test.py
index 97d9135..5550066 100644
--- a/tests/integration_tests/services/certificate_service_test.py
+++ b/tests/integration_tests/services/certificate_service_test.py
@@ -29,10 +29,17 @@ def test_create_and_get_root_ca(private_key_service, certificate_service):
 
     cert_loaded = certificate_service.get_certificate(cert.certificate_id)
 
-    # verify that the loaded certificate is a CA
+    # verify that the loaded certificate is a CA and contains SSL usage extension flags
     cert_loaded_printed = export_crt(cert_loaded.pem_data)
-    expected = """            X509v3 Basic Constraints: critical
-                CA:TRUE""".replace("\r", "").replace("\n", "")
+    expected = """
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment, Key Agreement, Certificate Sign, CRL Sign
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+    """.replace("\r", "").replace("\n", "")
     assert expected in cert_loaded_printed.replace("\n", "").replace("\r", "")
 
     assert cert.certificate_id == cert_loaded.certificate_id
@@ -54,21 +61,29 @@ def test_create_and_get_inter_cert(private_key_service, certificate_service):
                                                  Subject(common_name="RootFoo", organization_unit="Department of Foo"))
 
     inter_cert = certificate_service.create_ca(inter_ca_private_key, Subject(common_name="Intermediate CA"), root_ca,
-                                               root_ca_private_key, usages={SSL_ID: True})
+                                               root_ca_private_key, usages={AUTHENTICATION_ID: True})
 
     assert INTERMEDIATE_CA_ID == inter_cert.type_id
 
     assert inter_cert.usages[CA_ID]
-    assert inter_cert.usages[SSL_ID]
-    assert inter_cert.usages[AUTHENTICATION_ID] is False
+    assert inter_cert.usages[SSL_ID] is False
+    assert inter_cert.usages[AUTHENTICATION_ID] is True
     assert inter_cert.usages[SIGNATURE_ID] is False
 
     inter_cert_loaded = certificate_service.get_certificate(inter_cert.certificate_id)
 
-    # verify that the loaded certificate is a CA
+    # verify that the loaded certificate is a CA and contains AUTHENTICATION usage extension flags
     cert_loaded_printed = export_crt(inter_cert_loaded.pem_data)
-    expected = """            X509v3 Basic Constraints: critical
-                CA:TRUE""".replace("\n", "").replace("\r", "")
+    expected = """
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+    """.replace("\r", "").replace("\n", "")
+
     assert expected in cert_loaded_printed.replace("\n", "").replace("\r", "")
 
     assert inter_cert.certificate_id == inter_cert_loaded.certificate_id
@@ -98,16 +113,29 @@ def test_create_and_get_cert(private_key_service, certificate_service):
 
     cert = certificate_service.create_end_cert(end_cert_private_key,
                                                Subject("Foo Child", email_address="foo@bar.cz"), inter_ca_cert,
-                                               inter_ca_private_key, usages={AUTHENTICATION_ID: True})
+                                               inter_ca_private_key, usages={SIGNATURE_ID: True})
     assert CERTIFICATE_ID == cert.type_id
 
-    assert cert.usages[AUTHENTICATION_ID]
+    assert cert.usages[AUTHENTICATION_ID] is False
     assert cert.usages[SSL_ID] is False
-    assert cert.usages[SIGNATURE_ID] is False
+    assert cert.usages[SIGNATURE_ID]
     assert cert.usages[CA_ID] is False
 
     cert_loaded = certificate_service.get_certificate(cert.certificate_id)
 
+    # verify that the loaded certificate is a CA and contains AUTHENTICATION usage extension flags
+    cert_loaded_printed = export_crt(cert_loaded.pem_data)
+    print(cert_loaded_printed)
+    expected = """
+        X509v3 extensions:
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation
+            X509v3 Extended Key Usage: 
+                Time Stamping
+    """.replace("\r", "").replace("\n", "")
+
+    assert expected in cert_loaded_printed.replace("\n", "").replace("\r", "")
+
     assert cert.certificate_id == cert_loaded.certificate_id
     assert cert.common_name == cert_loaded.common_name
     assert cert.valid_from == cert_loaded.valid_from
@@ -314,7 +342,6 @@ def test_set_certificate_revoked_errors(certificate_service_unique, private_key_
                                                              Subject(common_name="RootFoo",
                                                                      organization_unit="Department of Foo"))
 
-
     with pytest.raises(RevocationReasonInvalidException) as e:
         certificate_service_unique.set_certificate_revocation_status(root_ca_cert.certificate_id, "revoked", "foo")
 
@@ -329,4 +356,3 @@ def test_set_certificate_revoked_errors(certificate_service_unique, private_key_
     with pytest.raises(CertificateAlreadyRevokedException) as e:
         certificate_service_unique.set_certificate_revocation_status(root_ca_cert.certificate_id, "revoked",
                                                                      "unspecified")
-
