Revize 97856712

Re #8585 - Edited certificate_service_test.py tests asserting that various extension field flags are set when certain usages are selected

tests/integration_tests/services/certificate_service_test.py

@@ -29 +29 @@
 
     cert_loaded = certificate_service.get_certificate(cert.certificate_id)
 
-    # verify that the loaded certificate is a CA
+    # verify that the loaded certificate is a CA and contains SSL usage extension flags
     cert_loaded_printed = export_crt(cert_loaded.pem_data)
-    expected = """            X509v3 Basic Constraints: critical
-                CA:TRUE""".replace("\r", "").replace("\n", "")
+    expected = """
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment, Key Agreement, Certificate Sign, CRL Sign
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+    """.replace("\r", "").replace("\n", "")
     assert expected in cert_loaded_printed.replace("\n", "").replace("\r", "")
 
     assert cert.certificate_id == cert_loaded.certificate_id
@@ -54 +61 @@
                                                  Subject(common_name="RootFoo", organization_unit="Department of Foo"))
 
     inter_cert = certificate_service.create_ca(inter_ca_private_key, Subject(common_name="Intermediate CA"), root_ca,
-                                               root_ca_private_key, usages={SSL_ID: True})
+                                               root_ca_private_key, usages={AUTHENTICATION_ID: True})
 
     assert INTERMEDIATE_CA_ID == inter_cert.type_id
 
     assert inter_cert.usages[CA_ID]
-    assert inter_cert.usages[SSL_ID]
-    assert inter_cert.usages[AUTHENTICATION_ID] is False
+    assert inter_cert.usages[SSL_ID] is False
+    assert inter_cert.usages[AUTHENTICATION_ID] is True
     assert inter_cert.usages[SIGNATURE_ID] is False
 
     inter_cert_loaded = certificate_service.get_certificate(inter_cert.certificate_id)
 
-    # verify that the loaded certificate is a CA
+    # verify that the loaded certificate is a CA and contains AUTHENTICATION usage extension flags
     cert_loaded_printed = export_crt(inter_cert_loaded.pem_data)
-    expected = """            X509v3 Basic Constraints: critical
-                CA:TRUE""".replace("\n", "").replace("\r", "")
+    expected = """
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+    """.replace("\r", "").replace("\n", "")
+
     assert expected in cert_loaded_printed.replace("\n", "").replace("\r", "")
 
     assert inter_cert.certificate_id == inter_cert_loaded.certificate_id
@@ -98 +113 @@
 
     cert = certificate_service.create_end_cert(end_cert_private_key,
                                                Subject("Foo Child", email_address="[e-mail]"), inter_ca_cert,
-                                               inter_ca_private_key, usages={AUTHENTICATION_ID: True})
+                                               inter_ca_private_key, usages={SIGNATURE_ID: True})
     assert CERTIFICATE_ID == cert.type_id
 
-    assert cert.usages[AUTHENTICATION_ID]
+    assert cert.usages[AUTHENTICATION_ID] is False
     assert cert.usages[SSL_ID] is False
-    assert cert.usages[SIGNATURE_ID] is False
+    assert cert.usages[SIGNATURE_ID]
     assert cert.usages[CA_ID] is False
 
     cert_loaded = certificate_service.get_certificate(cert.certificate_id)
 
+    # verify that the loaded certificate is a CA and contains AUTHENTICATION usage extension flags
+    cert_loaded_printed = export_crt(cert_loaded.pem_data)
+    print(cert_loaded_printed)
+    expected = """
+        X509v3 extensions:
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation
+            X509v3 Extended Key Usage: 
+                Time Stamping
+    """.replace("\r", "").replace("\n", "")
+
+    assert expected in cert_loaded_printed.replace("\n", "").replace("\r", "")
+
     assert cert.certificate_id == cert_loaded.certificate_id
     assert cert.common_name == cert_loaded.common_name
     assert cert.valid_from == cert_loaded.valid_from
@@ -314 +342 @@
                                                              Subject(common_name="RootFoo",
                                                                      organization_unit="Department of Foo"))
 
-
     with pytest.raises(RevocationReasonInvalidException) as e:
         certificate_service_unique.set_certificate_revocation_status(root_ca_cert.certificate_id, "revoked", "foo")
 
@@ -329 +356 @@
     with pytest.raises(CertificateAlreadyRevokedException) as e:
         certificate_service_unique.set_certificate_revocation_status(root_ca_cert.certificate_id, "revoked",
                                                                      "unspecified")
-