diff options
Diffstat (limited to 'security/manager')
| -rw-r--r-- | security/manager/ssl/tests/unit/test_cert_trust.js | 28 |
1 files changed, 25 insertions, 3 deletions
diff --git a/security/manager/ssl/tests/unit/test_cert_trust.js b/security/manager/ssl/tests/unit/test_cert_trust.js index 622678c7a..bf081f1bd 100644 --- a/security/manager/ssl/tests/unit/test_cert_trust.js +++ b/security/manager/ssl/tests/unit/test_cert_trust.js @@ -208,9 +208,31 @@ function run_test() { setCertTrust(ca_cert, ",,"); setCertTrust(int_cert, ",,"); - // It turns out that if an end-entity certificate is manually trusted, it can - // be the root of its own verified chain. This will be removed in bug 1294580. - setCertTrust(ee_cert, "C,,"); + // If an end-entity certificate is manually trusted, it may not be the root of + // its own verified chain. In general this will cause "unknown issuer" errors + // unless a CA trust anchor can be found. + setCertTrust(ee_cert, "CTu,CTu,CTu"); + checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER, + certificateUsageSSLServer); + checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER, + certificateUsageSSLClient); + checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER, + certificateUsageEmailSigner); + checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER, + certificateUsageEmailRecipient); + checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER, + certificateUsageObjectSigner); + + // Now make a CA trust anchor available. + setCertTrust(ca_cert, "CTu,CTu,CTu"); checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess, certificateUsageSSLServer); + checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess, + certificateUsageSSLClient); + checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess, + certificateUsageEmailSigner); + checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess, + certificateUsageEmailRecipient); + checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess, + certificateUsageObjectSigner); } |