1 files changed, 203 insertions, 0 deletions
diff --git a/tests/keys/README b/tests/keys/README
new file mode 100644
index 00000000..14515024
--- /dev/null
+++ b/tests/keys/README
@@ -0,0 +1,203 @@
+README
+
+0. Passwords
+ For all files the password is "secret".
+
+1. Files list
+
+ cakey.pem	Root CA private key
+ cacert.pem  	Root CA for cakey.pem
+ ca2key.pem	RSA private key
+ ca2cert.pem 	Second-level RSA cert for ca2key.pem
+ dsakey.pem	DSA private key
+ dsacert.pem 	Third level DSA cert for dsakey.pem
+ rsakey.pem	RSA private key
+ rsacert.pem 	Third level RSA cert for rsacert.pem
+ hmackey.bin	HMAC key ('secret')
+ expired.key	key for expired cert 
+ expired.crt	expired certificate 
+ rsa2key.pem	RSA private key
+ rsa2cert.pem 	Self signed RSA certificate with negative serial number
+
+2. How certificates were generated:
+
+ A. Create new CA 
+    - Change DAYS and CADAYS in CA.pl to 3650 (10 years)
+    > export SSLEAY_CONFIG="-config ./openssl.cnf"
+    > CA.pl -newca
+    > cp ./demoCA/cacert.pem .
+    > cp ./demoCA/private/cakey.pem .
+    > openssl x509 -text -in cacert.pem
+
+ B. Generate RSA key and second level CA
+    > openssl genrsa -out ca2key.pem
+    > openssl req -config ./openssl.cnf -new -key ca2key.pem -out ca2req.pem
+    > openssl ca -config ./openssl.cnf -cert cacert.pem -keyfile cakey.pem \
+	    -out ca2cert.pem -infiles ca2req.pem
+    > openssl verify -CAfile cacert.pem ca2cert.pem
+
+ C. Generate and sign DSA key with second level CA
+    > openssl dsaparam -out dsakey.pem -genkey 512
+    > openssl req -config ./openssl.cnf -new -key dsakey.pem -out dsareq.pem
+    > openssl ca -config ./openssl.cnf -cert ca2cert.pem -keyfile ca2key.pem \
+	    -out dsacert.pem -infiles dsareq.pem
+    > openssl verify -CAfile cacert.pem -untrusted ca2cert.pem dsacert.pem
+
+ D. Generate and sign RSA key with second level CA
+    > openssl genrsa -out rsakey.pem
+    > openssl req -config ./openssl.cnf -new -key rsakey.pem -out rsareq.pem
+    > openssl ca -config ./openssl.cnf -cert ca2cert.pem -keyfile ca2key.pem \
+	    -out rsacert.pem -infiles rsareq.pem
+    > openssl verify -CAfile cacert.pem -untrusted ca2cert.pem rsacert.pem
+
+ E. Generate and sign large RSA key with second level CA
+    > openssl genrsa -out largersakey.pem 4096
+    > openssl req -config ./openssl.cnf -new -key largersakey.pem -out largersareq.pem
+    > openssl ca -config ./openssl.cnf -cert ca2cert.pem -keyfile ca2key.pem \
+	    -out largersacert.pem -infiles largersareq.pem
+    > openssl verify -CAfile cacert.pem -untrusted ca2cert.pem largersacert.pem
+
+ F. Generate and sign short-live RSA cert for "expired cert" test
+    > openssl genrsa -out expiredkey.pem
+    > openssl req -config ./openssl.cnf -new -days 1 -key expiredkey.pem \
+	    -out expiredreq.pem
+    > openssl ca -config ./openssl.cnf -days 1 -cert ca2cert.pem \
+	    -keyfile ca2key.pem -out expiredcert.pem -infiles expiredreq.pem
+    > openssl verify -CAfile cacert.pem -untrusted ca2cert.pem expiredcert.pem
+ 
+3. Converting key and certs between PEM and DER formats
+
+  - Convert PEM private key file to DER file
+  RSA key:
+    > openssl rsa -inform PEM -outform DER -in rsakey.pem -out rsakey.der
+    > openssl rsa -inform PEM -outform DER -in largersakey.pem -out largersakey.der
+    > openssl rsa -inform PEM -outform DER -in expiredkey.pem -out expiredkey.der
+  DSA key:
+    > openssl dsa -inform PEM -outform DER -in dsakey.pem -out dsakey.der
+
+  - Convert PEM cert file to DER file
+    > openssl x509 -outform DER -in cacert.pem -out cacert.der 
+    > openssl x509 -outform DER -in ca2cert.pem -out ca2cert.der 
+    > openssl x509 -outform DER -in dsacert.pem -out dsacert.der 
+    > openssl x509 -outform DER -in rsacert.pem -out rsacert.der 
+    > openssl x509 -outform DER -in largersacert.pem -out largersacert.der 
+    > openssl x509 -outform DER -in expiredcert.pem -out expiredcert.der 
+  
+  - (optional) Convert PEM public key file to DER file
+  RSA key:
+    > openssl rsa -inform PEM -outform DER -pubin -pubout -in lugh.key -out lugh.der
+  DSA key:
+    > openssl dsa -inform PEM -outform DER -pubin -pubout -in lugh.key -out lugh.der
+   
+  If you aren't sure if the public key is RSA or DSA, just run one of
+  the above commands, and the error messaging will make it clear :)
+   
+  - (optional) Convert DER cert file to PEM file
+    > openssl x509 -inform DER -outform PEM -in ca2cert.der -out ca2cert.pem
+
+4. Converting an unencrypted PEM or DER file containing a private key
+   to an encrypted PEM or DER file containing the same private key but
+   encrypted
+     > openssl pkcs8 -in dsakey.pem -inform pem -out dsakey.p8-pem -outform pem -topk8
+     > openssl pkcs8 -in dsakey.der -inform der -out dsakey.p8-der -outform der -topk8
+     > openssl pkcs8 -in rsakey.pem -inform pem -out rsakey.p8-pem -outform pem -topk8
+     > openssl pkcs8 -in rsakey.der -inform der -out rsakey.p8-der -outform der -topk8
+     > openssl pkcs8 -in largersakey.pem -inform pem -out largersakey.p8-pem \
+        -outform pem -topk8
+     > openssl pkcs8 -in largersakey.der -inform der -out largersakey.p8-der \
+        -outform der -topk8
+     
+5. NSS is unfriendly towards standalone private keys.
+   This procedure helps convert raw private keys into PKCS12 form that is 
+   suitable for not only NSS but all crypto engines.
+
+    > cat dsakey.pem dsacert.pem ca2cert.pem cacert.pem > alldsa.pem
+    > openssl pkcs12 -export -in alldsa.pem -name TestDsaKey -out dsakey.p12
+
+    > cat rsakey.pem rsacert.pem ca2cert.pem cacert.pem > allrsa.pem
+    > openssl pkcs12 -export -in allrsa.pem -name TestRsaKey -out rsakey.p12
+
+    > cat largersakey.pem largersacert.pem ca2cert.pem cacert.pem > alllargersa.pem
+    > openssl pkcs12 -export -in alllargersa.pem -name TestLargeRsaKey -out largersakey.p12
+
+    > cat expiredkey.pem expiredcert.pem ca2cert.pem cacert.pem > allexpired.pem
+    > openssl pkcs12 -export -in allexpired.pem -name TestExpiredRsaKey \
+      -out expiredkey.p12
+
+
+   5a.
+       Input: DSA/RSA private key in PEM or DER format
+       Output: A PKCS12 file containing the private key, and a self-signed 
+               certificate with the corresponding public key
+    
+       # first convert key file to PEM format, if not already in that format
+       > openssl <dsa|rsa> -inform der -outform pem -in key.der -out key.pem
+    
+       # answer questions at the prompt
+       # Note: use a unique subject (=issuer) for each self-signed cert you 
+       # create (since there is no way to specify serial # using the command 
+       # below)
+       > openssl req -new -keyform <der|pem> -key key.<der|pem> -x509 -sha1 -days 999999 -outform pem -out cert.pem
+    
+       # now using the cert and key in PEM format, conver them to a PKCS12 file
+       # enter some password on prompt
+       > openssl pkcs12 -export -in cert.pem -inkey key.pem -name <nickname> -out keycert.p12
+    
+       # This pkcs12 file can be used directly on the xmlsec command line, or
+       # can be pre-loaded into the crypto engine database (if any).
+    
+       # In the case of NSS, you can pre-load the key using pk12util.
+       # The key and cert will have the nickname "nickname" (used in above step)
+       > pk12util -d <nss_config_dir> -i keycert.p12
+    
+   5b.
+       Input: DSA/RSA private key in PEM or DER format
+              KeyCert containing corresponding public key
+              Other certs in the chain leading from KeyCert to the root
+       Output: A PKCS12 file containing the private key, the KeyCert and the
+               certs in the chain
+    
+       # first convert key file to PEM format, if not already in that format
+       > openssl <dsa|rsa> -inform der -outform pem -in key.der -out key.pem
+
+       # convert all cert files to PEM format, if not already in that format    
+       > openssl x509 -inform der -outform pem -in cert.der -out cert.pem
+
+       # concatenate all cert.pem files created above to 1 file - allcerts.pem
+       > cat keycert.pem cert1.pem cert2.pem  .... > allcerts.pem
+
+       # now using the certs and key in PEM format, conver them to a PKCS12 file
+       # enter some password on prompt
+       > openssl pkcs12 -export -in allcerts.pem -inkey key.pem \
+         -name <nickname of key & keycert> 
+	 [-caname <nickname of cert1> -caname <nickname of cert2>.... ] 
+	 -out keycert.p12
+    
+       # This pkcs12 file can be used directly on the xmlsec command line, or
+       # can be pre-loaded into the crypto engine database (if any).
+    
+       # In the case of NSS, you can pre-load the key using pk12util.
+       # The key and certs will have the nickname "nickname" 
+       # (used in above step)
+       > pk12util -d <nss_config_dir> -i keycert.p12
+    
+6. On Windows, one needs to specify Crypto Service Provider (CSP) in the 
+pkcs12 file to ensure it is loaded correctly to be used with SHA2 algorithms. 
+Worse, the CSP is different for XP and older versions
+
+
+   Input: DSA/RSA private key in PEM or DER format
+   Output: A PKCS12 file containing the private key, and a self-signed 
+           certificate with the corresponding public key. Plus the CSP 
+           name to be used for this key/cert.
+
+
+    > cat rsakey.pem rsacert.pem ca2cert.pem cacert.pem > allrsa.pem
+    > openssl pkcs12 -export -in allrsa.pem -name TestRsaKey -out rsakey-winxp.p12 -CSP "Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)"
+    > openssl pkcs12 -export -in allrsa.pem -name TestRsaKey -out rsakey-win.p12 -CSP "Microsoft Enhanced RSA and AES Cryptographic Provider"
+
+
+    > cat largersakey.pem largersacert.pem ca2cert.pem cacert.pem > alllargersa.pem
+    > openssl pkcs12 -export -in alllargersa.pem -name TestLargeRsaKey -out largersakey-winxp.p12 -CSP "Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)"
+    > openssl pkcs12 -export -in alllargersa.pem -name TestLargeRsaKey -out largersakey-win.p12 -CSP "Microsoft Enhanced RSA and AES Cryptographic Provider"
+