package revoking import ( "crypto/rand" "crypto/rsa" "crypto/x509" "crypto/x509/pkix" "math/big" rand2 "math/rand" "testing" "time" "github.com/stretchr/testify/assert" ) type testRepo struct { revoked []big.Int } func (t *testRepo) RevokedCertificates() ([]pkix.RevokedCertificate, error) { result := make([]pkix.RevokedCertificate, len(t.revoked)) for i, s := range t.revoked { result[i] = pkix.RevokedCertificate{ SerialNumber: &s, RevocationTime: time.Now(), } } return result, nil } func (t *testRepo) StoreRevocation(revoked *pkix.RevokedCertificate) error { t.revoked = append(t.revoked, *revoked.SerialNumber) return nil } func TestRevoking(t *testing.T) { testRepository := testRepo{revoked: make([]big.Int, 0)} caKey, err := rsa.GenerateKey(rand.Reader, 3072) if err != nil { t.Fatalf("could not generate key pair: %v", err) } caTemplate := &x509.Certificate{Subject: pkix.Name{CommonName: "Test CA"}, SerialNumber: big.NewInt(rand2.Int63())} certificateBytes, err := x509.CreateCertificate(rand.Reader, caTemplate, caTemplate, caKey.Public(), caKey) if err != nil { t.Fatalf("could not self-sign CA certificate: %v", err) } caCertificate, err := x509.ParseCertificate(certificateBytes) if err != nil { t.Fatalf("could not create test CA certificate: %v", err) } r := NewX509Revoking(&testRepository, x509.ECDSAWithSHA256, caCertificate, caKey) serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128)) if err != nil { t.Errorf("could not create random serial: %v", err) } revoke, err := r.Revoke(&RevokeCertificate{serialNumber: serial, reason: CRLReasonKeyCompromise}) assert.NoError(t, err) assert.Equal(t, CRLReasonKeyCompromise.BuildExtension(), revoke.Extensions[0]) assert.Equal(t, serial, revoke.SerialNumber) assert.Contains(t, testRepository.revoked, *serial) }