[java-metadata-aggregator] branch master updated: MDA-199 - add an X509ROCAValidator
Ian Young
ian at iay.org.uk
Tue Jan 30 07:31:58 EST 2018
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch master
in repository java-metadata-aggregator.
View the commit online:
http://git.shibboleth.net/view/?p=java-metadata-aggregator.git;a=commit;h=9d4696771b9ecc1f3740cb4e996832c3ec8144f2
The following commit(s) were added to refs/heads/master by this push:
new 9d46967 MDA-199 - add an X509ROCAValidator
9d46967 is described below
commit 9d4696771b9ecc1f3740cb4e996832c3ec8144f2
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Tue Jan 30 12:31:23 2018 +0000
MDA-199 - add an X509ROCAValidator
---
.../metadata/validate/x509/X509ROCAValidator.java | 131 +++++++++++++++++++++
.../resources/net/shibboleth/metadata/beans.xml | 3 +
.../validate/x509/X509ROCAValidatorTest.java | 40 +++++++
.../validate/x509/X509ROCAValidator-cert01.pem | 27 +++++
.../validate/x509/X509ROCAValidator-cert02.pem | 30 +++++
.../validate/x509/X509ROCAValidator-cert03.pem | 24 ++++
.../validate/x509/X509ROCAValidator-cert04.pem | 17 +++
.../validate/x509/X509ROCAValidator-cert05.pem | 17 +++
.../validate/x509/X509ROCAValidator-cert06.pem | 17 +++
9 files changed, 306 insertions(+)
diff --git a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/validate/x509/X509ROCAValidator.java b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/validate/x509/X509ROCAValidator.java
new file mode 100644
index 0000000..4118281
--- /dev/null
+++ b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/validate/x509/X509ROCAValidator.java
@@ -0,0 +1,131 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.metadata.validate.x509;
+
+import java.math.BigInteger;
+import java.security.PublicKey;
+import java.security.cert.X509Certificate;
+import java.security.interfaces.RSAPublicKey;
+
+import javax.annotation.Nonnull;
+import javax.annotation.concurrent.ThreadSafe;
+
+import net.shibboleth.metadata.Item;
+
+/**
+ * Validator class to check that X.509 certificate public keys are not
+ * affected by the Return of Coppersmith Attack (ROCA, CVE-2017-15361).
+ *
+ * @see <a href="https://crocs.fi.muni.cz/public/papers/rsa_ccs17">ROCA paper</a>
+ */
+ at ThreadSafe
+public class X509ROCAValidator extends AbstractX509Validator {
+
+ /**
+ * Checks to see whether a given modulus represents a key affected by the attack.
+ *
+ * @see <a href="https://github.com/crocs-muni/roca/blob/master/java/BrokenKey.java">original source code
+ * (dual MIT and Apache 2 licensed)</a>
+ */
+ private static class BrokenKey {
+
+ // Checkstyle: JavadocVariable|JavadocMethod|ConstantName OFF
+
+ private static final int[] prims = new int[] {
+ 3, 5, 7, 11, 13, 17, 19, 23, 29, 31,
+ 37, 41, 43, 47, 53, 59, 61, 67, 71, 73,
+ 79, 83, 89, 97, 101, 103, 107, 109, 113, 127,
+ 131, 137, 139, 149, 151, 157, 163, 167,
+ };
+
+ private static final BigInteger[] primes = new BigInteger[prims.length];
+
+ static {
+ for (int i = 0; i < prims.length; i++) {
+ primes[i] = BigInteger.valueOf(prims[i]);
+ }
+ }
+
+ private static final BigInteger[] markers = new BigInteger[] {
+ new BigInteger("6"),
+ new BigInteger("30"),
+ new BigInteger("126"),
+ new BigInteger("1026"),
+ new BigInteger("5658"),
+ new BigInteger("107286"),
+ new BigInteger("199410"),
+ new BigInteger("8388606"),
+ new BigInteger("536870910"),
+ new BigInteger("2147483646"),
+ new BigInteger("67109890"),
+ new BigInteger("2199023255550"),
+ new BigInteger("8796093022206"),
+ new BigInteger("140737488355326"),
+ new BigInteger("5310023542746834"),
+ new BigInteger("576460752303423486"),
+ new BigInteger("1455791217086302986"),
+ new BigInteger("147573952589676412926"),
+ new BigInteger("20052041432995567486"),
+ new BigInteger("6041388139249378920330"),
+ new BigInteger("207530445072488465666"),
+ new BigInteger("9671406556917033397649406"),
+ new BigInteger("618970019642690137449562110"),
+ new BigInteger("79228162521181866724264247298"),
+ new BigInteger("2535301200456458802993406410750"),
+ new BigInteger("1760368345969468176824550810518"),
+ new BigInteger("50079290986288516948354744811034"),
+ new BigInteger("473022961816146413042658758988474"),
+ new BigInteger("10384593717069655257060992658440190"),
+ new BigInteger("144390480366845522447407333004847678774"),
+ new BigInteger("2722258935367507707706996859454145691646"),
+ new BigInteger("174224571863520493293247799005065324265470"),
+ new BigInteger("696898287454081973172991196020261297061886"),
+ new BigInteger("713623846352979940529142984724747568191373310"),
+ new BigInteger("1800793591454480341970779146165214289059119882"),
+ new BigInteger("126304807362733370595828809000324029340048915994"),
+ new BigInteger("11692013098647223345629478661730264157247460343806"),
+ new BigInteger("187072209578355573530071658587684226515959365500926"),
+ };
+
+ public static boolean isAffected(@Nonnull final BigInteger modulus) {
+ for (int i = 0; i < primes.length; i++) {
+ if (BigInteger.ONE.shiftLeft(modulus.remainder(primes[i]).intValue()).and(markers[i]).
+ equals(BigInteger.ZERO)) {
+ return false;
+ }
+ }
+ return true;
+ }
+
+ // Checkstyle: JavadocVariable|JavadocMethod|ConstantName ON
+
+ }
+
+ @Override
+ public void doValidate(@Nonnull final X509Certificate cert, @Nonnull final Item<?> item,
+ @Nonnull final String stageId) {
+ final PublicKey key = cert.getPublicKey();
+ if ("RSA".equals(key.getAlgorithm())) {
+ final RSAPublicKey rsaKey = (RSAPublicKey) key;
+ if (BrokenKey.isAffected(rsaKey.getModulus())) {
+ addError("RSA public key is vulnerable to ROCA", item, stageId);
+ }
+ }
+ }
+
+}
diff --git a/aggregator-pipeline/src/main/resources/net/shibboleth/metadata/beans.xml b/aggregator-pipeline/src/main/resources/net/shibboleth/metadata/beans.xml
index fe457f6..8fe1cee 100644
--- a/aggregator-pipeline/src/main/resources/net/shibboleth/metadata/beans.xml
+++ b/aggregator-pipeline/src/main/resources/net/shibboleth/metadata/beans.xml
@@ -269,6 +269,9 @@
net.shibboleth.metadata.validate.x509
-->
+ <bean id="mda.X509ROCAValidator" abstract="true" parent="mda.validator_parent"
+ class="net.shibboleth.metadata.validate.x509.X509ROCAValidator"/>
+
<bean id="mda.X509RSAExponentValidator" abstract="true" parent="mda.validator_parent"
class="net.shibboleth.metadata.validate.x509.X509RSAExponentValidator"/>
diff --git a/aggregator-pipeline/src/test/java/net/shibboleth/metadata/validate/x509/X509ROCAValidatorTest.java b/aggregator-pipeline/src/test/java/net/shibboleth/metadata/validate/x509/X509ROCAValidatorTest.java
new file mode 100644
index 0000000..776ad93
--- /dev/null
+++ b/aggregator-pipeline/src/test/java/net/shibboleth/metadata/validate/x509/X509ROCAValidatorTest.java
@@ -0,0 +1,40 @@
+
+package net.shibboleth.metadata.validate.x509;
+
+import java.security.cert.X509Certificate;
+
+import net.shibboleth.metadata.Item;
+import net.shibboleth.metadata.MockItem;
+import net.shibboleth.metadata.validate.Validator;
+
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+public class X509ROCAValidatorTest extends BaseX509ValidatorTest {
+
+ /** Constructor sets class under test. */
+ public X509ROCAValidatorTest() throws Exception {
+ super(X509ROCAValidator.class);
+ }
+
+ private void testCert(final String certName,
+ final Validator<X509Certificate> val,
+ final int expectedErrors, final int expectedWarnings) throws Exception {
+ final Item<String> item = new MockItem("foo");
+ final X509Certificate cert = getCertificate(certName);
+ Assert.assertEquals(val.validate(cert, item, "stage"), Validator.Action.CONTINUE);
+ errorsAndWarnings(item, expectedErrors, expectedWarnings);
+ }
+
+ @Test
+ public void test() throws Exception {
+ final X509ROCAValidator val = new X509ROCAValidator();
+ testCert("cert01.pem", val, 0, 0);
+ testCert("cert02.pem", val, 0, 0);
+ testCert("cert03.pem", val, 0, 0);
+ testCert("cert04.pem", val, 1, 0);
+ testCert("cert05.pem", val, 1, 0);
+ testCert("cert06.pem", val, 0, 0);
+ }
+
+}
diff --git a/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert01.pem b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert01.pem
new file mode 100644
index 0000000..0002462
--- /dev/null
+++ b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert01.pem
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/
+MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
+DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow
+SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT
+GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC
+AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF
+q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8
+SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0
+Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA
+a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj
+/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T
+AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG
+CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv
+bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k
+c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw
+VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC
+ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz
+MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu
+Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF
+AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo
+uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/
+wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu
+X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG
+PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6
+KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
+-----END CERTIFICATE-----
diff --git a/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert02.pem b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert02.pem
new file mode 100644
index 0000000..71b67da
--- /dev/null
+++ b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert02.pem
@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFETCCA/mgAwIBAgISBLwGPC99RzpJIpGR5fe085h1MA0GCSqGSIb3DQEBCwUA
+MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
+ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xNzA4MTEwODUwMDBaFw0x
+NzExMDkwODUwMDBaMCIxIDAeBgNVBAMTF2FuY2hvci5lbmlnbWFicmlkZ2UuY29t
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr2WWdhl/HbBtp6wRGgoO
+wXW4t+8HGS/80fa4VMMneF8af9PbfaRc1KMbKy5c4Ngjpo4oyK3xdHMWvszh/ldo
+BkA5rSBiJgyNGjTgWG3Om8EwkPzJ+4uLLAjtOujWGymBimaWiafZwdqwU7VX+40/
+nET6rT4YxV5zmwDTyRJlWLyOmAzSrzdxJu9bE3QTZ3S4vTcOPBwUnbOVyPmWlrYo
+sQWUb+ogEG/iTRA6wGJmGpJI6MP2KOALMI0zlTqr5VUTLiGOdO9LV4cWtP5880Do
+5gSjGb9umVHhlCYB00KRAy21SZnQnl0Dbd41RK01JWu7l9Xj//04Fmwh6ukZlUiF
+OwIDAQABo4ICFzCCAhMwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUF
+BwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBT/+523mWwe9kcK
+b8pG25FsYAK+lDAfBgNVHSMEGDAWgBSoSmpjBH3duubRObemRWXv86jsoTBvBggr
+BgEFBQcBAQRjMGEwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwLmludC14My5sZXRz
+ZW5jcnlwdC5vcmcwLwYIKwYBBQUHMAKGI2h0dHA6Ly9jZXJ0LmludC14My5sZXRz
+ZW5jcnlwdC5vcmcvMCIGA1UdEQQbMBmCF2FuY2hvci5lbmlnbWFicmlkZ2UuY29t
+MIH+BgNVHSAEgfYwgfMwCAYGZ4EMAQIBMIHmBgsrBgEEAYLfEwEBATCB1jAmBggr
+BgEFBQcCARYaaHR0cDovL2Nwcy5sZXRzZW5jcnlwdC5vcmcwgasGCCsGAQUFBwIC
+MIGeDIGbVGhpcyBDZXJ0aWZpY2F0ZSBtYXkgb25seSBiZSByZWxpZWQgdXBvbiBi
+eSBSZWx5aW5nIFBhcnRpZXMgYW5kIG9ubHkgaW4gYWNjb3JkYW5jZSB3aXRoIHRo
+ZSBDZXJ0aWZpY2F0ZSBQb2xpY3kgZm91bmQgYXQgaHR0cHM6Ly9sZXRzZW5jcnlw
+dC5vcmcvcmVwb3NpdG9yeS8wDQYJKoZIhvcNAQELBQADggEBAEjEX7Orx4EWqDA+
+e5+a4nErwO6wVzH7gk6w6xdFGhYqvsYD4LSQzlWg+ETLXcvWIQMoTx5/rYtDxpG9
+43qfZbdHjspVze2pfhR71sq76SZzthJw0tUeLFdo9NpFQziCe3fWP7eifX28oFbV
+He82hLWfgGFdJgJTPpLhwRYps6BLb8Le58YuVLChWqRw/JV5zSN3eHVQIejnpaf9
+Pwo3+WT/2BjyYLBUsbFBigZmy9/SHlfrQCBI2jxWYU2g4DNIZCekGOQqaJGKTBOz
+kgSivyzb4B8du0gaIq93rsLurueD/gJFSapDWWkX+OjXdL/kH1uyx+l+dUcSPc4t
+E0lRHOM=
+-----END CERTIFICATE-----
diff --git a/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert03.pem b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert03.pem
new file mode 100644
index 0000000..78909f4
--- /dev/null
+++ b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert03.pem
@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIIEEzCCAvugAwIBAgIJAJ07mZHF8IutMA0GCSqGSIb3DQEBCwUAMIGfMQswCQYD
+VQQGEwJVSzESMBAGA1UECAwJQ2FtYnJpZGdlMRIwEAYDVQQHDAlDYW1icmlkZ2Ux
+GjAYBgNVBAoMEUVuaWdtYWJyaWRnZSBMdGQuMQswCQYDVQQLDAJJVDEZMBcGA1UE
+AwwQZW5pZ21hYnJpZGdlLmNvbTEkMCIGCSqGSIb3DQEJARYVaW5mb0BlbmlnbWFi
+cmlkZ2UuY29tMB4XDTE3MDkxNDEyNDgyNVoXDTQ0MDIxNTEyNDgyNVowgZ8xCzAJ
+BgNVBAYTAlVLMRIwEAYDVQQIDAlDYW1icmlkZ2UxEjAQBgNVBAcMCUNhbWJyaWRn
+ZTEaMBgGA1UECgwRRW5pZ21hYnJpZGdlIEx0ZC4xCzAJBgNVBAsMAklUMRkwFwYD
+VQQDDBBlbmlnbWFicmlkZ2UuY29tMSQwIgYJKoZIhvcNAQkBFhVpbmZvQGVuaWdt
+YWJyaWRnZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6aPxf
+u2BsTUKKuYs1XWYhTbT35HW19//dw0nHP31lmWUSGrFqQBTmxGXBEdhQIFhT0RP3
+EhJ+SiMKqX9IHu1kEPbDRfSOJfuBxC7GgV3DXN2Dng3pH7K+yEjQkQ+nfiwx+Z7J
+vMftFngSvXJDGLCt9JLWtHxc4FAYTod+pkBF+VAb9wVpz/0QLbcpn0npwAIir5EV
+0Kraln3+dZt+RXboXDpP9ZQDkjG5C0SLkMMjYIO8+Bm8MY1TogGOybQB8QK6nuE9
+3lkqQrAy3xNmidnFYZ21XVGYU6Qi0xAGJNLZ5Hghg3X0YMJpMO2ozQ2Uflj/6be+
+JEU1bertmIIj4+0dAgMBAAGjUDBOMB0GA1UdDgQWBBR7Uga0wsLRKMtxpKw6wYCU
+V3w1rTAfBgNVHSMEGDAWgBR7Uga0wsLRKMtxpKw6wYCUV3w1rTAMBgNVHRMEBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAIX5GIGYilxT0YwbW98aCTZO+0/cacX/Ej
+Wx4hBxAI9k48KqqeebdbmexxscXPlEoPSD+tx++xmc7rDhDjwosCTa2YOaPsHUyV
+83zUfP9i3j3+N6T42+R7XOLvCq7YyIKZj0WZr33JTFCrbuYFkZxKRFuvS1LPiUaI
+8TbDHQ+1wG4S2PgClZpo2wXR9zfGKqNMbSb2qRgLI5f1Yz7So2euJDgbYAouPOlL
+uFE17TxjVsMmuNhFKTS+G+i/L1T4aa5w4IB459jXiSug64SF59m2HA7WsjXLnBQ+
+QWmzZ9YctSkvSC5nZkjEt6KjyZjJrofatjsy31fF3T/niayJj+0b
+-----END CERTIFICATE-----
diff --git a/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert04.pem b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert04.pem
new file mode 100644
index 0000000..1d23abf
--- /dev/null
+++ b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert04.pem
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICpTCCAYwCCQC2u0PIfFaGMjANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls
+b2NhbGhvc3QwHhcNMTcxMDE2MTkzODIxWhcNMTgxMDE2MTkzODIxWjAUMRIwEAYD
+VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQJZ
+J7UrpeaMjJJou5IY83ZzYUymVBj0dFsUPNTuU/lJHJoOHC8jqVFjBq/784ZnuHG8
+DMguYPW7Gp+hWlZxp2XJ8huVh9gBFZZDcqODyIOw3L9sd1cGsx6v8+P9SIVZoIze
+og+al8TFm2uKjuykV9SoINSVCfdZM2MCvKGjaQsICRgR+Fjy6M6lpiNVrW4EHRk1
+7aWSibWXaDtz4mV650v/x2Dk1RPMh9uTVZGOqgjTmLvl9oNdyHElIRubNrOgvHC5
+k6bLP30stAYd5z25cslCrfmVW2/kzZDwDQiK7ASvH17/kfIa9e1EYXx9uAk/lTZt
+smWAxK85neuU+bFBMFvhAgMBAAEwDQYJKoZIhvcNAQELBQADggECAAG7W49CYRUk
+YAFRGXu3M85MKOISyc/kkJ8nbHdV6GxJ05FkoDKbcbZ7nncJiIp2VMAMEIP4bRTJ
+5U4g4vSZlmCs8BDmV3Ts/tbDCM6eqK+2hwjhUnCnmmsLt4xVUeAAsWUHl9AVtjzd
+oYlm1Kk20QBzNpsvM/gFS5B+duHvTSfELfoq9Pdfvmn2gEXJHe9scO8bfT3fm15z
+R6AUYsSsxAhup2Rix6jgJ14KGsh6uVm6jhz9aBTBcgx7iMuuP8zUbUE6nryHYXnR
+cSvuYSesTCoFfnL7elrZDak/n0jLfwUD80aWnReJfu9QQGdqdDnSG8lSQ1XPOC7O
+/hFW9l0TCzOE
+-----END CERTIFICATE-----
diff --git a/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert05.pem b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert05.pem
new file mode 100644
index 0000000..325a4d1
--- /dev/null
+++ b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert05.pem
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICpTCCAYwCCQCEcnuDiu6k0DANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls
+b2NhbGhvc3QwHhcNMTcxMDE2MTk0NjEwWhcNMTgxMDE2MTk0NjEwWjAUMRIwEAYD
+VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQGp
+xaaH24+yow+C3/jdoVTCke8nsEsl4YW4qyDExqX2BIWf5Z7eVKCvfA5yiIAK1xk7
+tzGlvx4RcNehxmkw1B6j6yHe33uK9dQqkcNPcgRblu/VfLGCMB3cwmln5VCOmriJ
+mG1X6Dff5w+Z/DfEmPQ8F8O5sGTPcERD16Az4DqCFpeqvzD7Ke59M7N2eWWokFjj
+s5dUvTocAH0oojsM+nn51xGsbkxLT3ewY0sezWhZGvA8fVO2Kl8tkRY9TvT48mgx
+rkYe2F7F94jFEj/8Esh0IP3P6h0bSlLDUhgk+zmYNIc5tiqYbY52siibwuuLwG0T
+gUeFG4OgcYPSEFWfkGMhAgMBAAEwDQYJKoZIhvcNAQELBQADggECAAGZiTHt6Hgd
+yDjR9aH9O5oNvtmTPf6tJtKhIu1VEnWjxpXK35Dzmw5AvSSL4EVB/nAYx63eonfI
+4BLM3YOPLFzrIJn6LE37LMug90vCz8zPOChWR7HTgroLyh3O2nPjvJL/SuoBya6g
+OwKg6gqF4Kmc4Q3BAY8QiDnQP3pIxF46WKq+r6/QqILuZRE9W7SwjTBP1jKmVztM
+3tyL9kVl7RbRA9/ovXHlEfkN7lJqqYKMZvJZPsxm6VJQRsW1rl55bI8Vqys2DOnx
+Nm01jtxuMVukAWEj4J8ExCKnd5EhRO/fbOfbwUVythhIsevkdXUC3PiZhDcK+Cge
+PbJmeM8KehS3
+-----END CERTIFICATE-----
diff --git a/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert06.pem b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert06.pem
new file mode 100644
index 0000000..138e5c6
--- /dev/null
+++ b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509ROCAValidator-cert06.pem
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICpDCCAYwCCQCvX1dxp53lPjANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls
+b2NhbGhvc3QwHhcNMTcxMDE2MTk0NjI4WhcNMTgxMDE2MTk0NjI4WjAUMRIwEAYD
+VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCb
+GJ1aMyQCCo8CnKN8qpjwTQiCtojYL8amNVXx9vOePer92imKYXJ4Ng/hVVV82pCa
+XF84VgvcrezH9Wwy9qAIbQmAfp081SbrAj0TZvWah2rJlVlnaeWZwRlRxzV8qaOr
++6A1prucdQQef19maTBCQNA2Pji9kWvfrli+ClwM2DgASv9F2iC0fjAZagM98htX
+Q0apdqP/klQSD67BXVCgJFt1a/5j4/o6vB1tCV2fUat1rXW2En5RC/3jdL9ErWSk
+bT4tbHIk4m+EtB/Peugt9jTFT6eZ4kKwP+0mANJGC9iwZpyWd38gBpFNSIaLAccf
++EeNpIs+c21uke9kpq3fAgMBAAEwDQYJKoZIhvcNAQELBQADggEBADZBh7oh7Wed
+PcbKIKqDZpk1GGV/Z9BYywft+kyutGhNYpX00gJBV7sYiCaLqpJMR+POGuLV4Fcu
+SiVzlPXvYKme4nL8JemGrmLd9JnCddMETiAdZ9Z4RizHj0jyle94ceWIhtletyt1
+tg7AfkRP6vUV69Mb0e1ieyOWPvAScAFMmlQ+QNG8bNL9+iVGtfsbEOX/ptuB/Enx
+tO/37ACqf0UeKczWC9rpRB7CtRzOLOmFS8aANGrd+lAp0TBkteOBhlmW6066qDL6
+cZBiL14ytOcU5LhfmcX6lrwUefOlLH/J8pLFb1g5NJxTooC17CFP/55Tab0Z1JER
+7FpVsNDAPGM=
+-----END CERTIFICATE-----
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list