| 1 | /** |
| 2 | * Checked-in test fixtures for IAM Roles Anywhere. |
| 3 | * |
| 4 | * Generated ONCE with LibreSSL and committed — never regenerated at test |
| 5 | * time. Both CAs are self-signed EC P-256 / SHA-256 certificates with |
| 6 | * `basicConstraints=critical,CA:TRUE` and `keyUsage=keyCertSign,cRLSign` |
| 7 | * (the requirements for a CERTIFICATE_BUNDLE trust anchor), valid until |
| 8 | * 2036. The CRLs are issued by Test CA 1 (CRL numbers 1 and 2), also valid |
| 9 | * until 2036. |
| 10 | * |
| 11 | * ```sh |
| 12 | * openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -sha256 \ |
| 13 | * -keyout ca.key -out ca.crt -days 3650 -nodes \ |
| 14 | * -subj "/CN=Alchemy RolesAnywhere Test CA 1" \ |
| 15 | * -addext "basicConstraints=critical,CA:TRUE" \ |
| 16 | * -addext "keyUsage=critical,keyCertSign,cRLSign" |
| 17 | * openssl ca -config ca.cnf -gencrl -out crl.pem # crldays 3650 |
| 18 | * ``` |
| 19 | */ |
| 20 | |
| 21 | export const CA1_CERTIFICATE_PEM = `-----BEGIN CERTIFICATE----- |
| 22 | MIIBbjCCARSgAwIBAgIJAK9nK+oFd6lqMAoGCCqGSM49BAMCMCoxKDAmBgNVBAMM |
| 23 | H0FsY2hlbXkgUm9sZXNBbnl3aGVyZSBUZXN0IENBIDEwHhcNMjYwNzEwMjI1MjU2 |
| 24 | WhcNMzYwNzA3MjI1MjU2WjAqMSgwJgYDVQQDDB9BbGNoZW15IFJvbGVzQW55d2hl |
| 25 | cmUgVGVzdCBDQSAxMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEcdbMumw7SDrB |
| 26 | CLM2meygNjDjzuHOpr8lOdd7OOdfXe7t3pLmm+SqU9jfy80WZyhC9J5GhbwKnJuh |
| 27 | 5bp4/GWS1KMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwCgYI |
| 28 | KoZIzj0EAwIDSAAwRQIgQ2QgLO89swCMp5UZoUvLq+VoRIfexB+iSk92m1DaBWsC |
| 29 | IQDuogiep3r3olS/8UmzimHiCH167d0vGB5CFRnkKSSj0Q== |
| 30 | -----END CERTIFICATE-----`; |
| 31 | |
| 32 | export const CA2_CERTIFICATE_PEM = `-----BEGIN CERTIFICATE----- |
| 33 | MIIBbTCCARSgAwIBAgIJAIgBUdSkfA0AMAoGCCqGSM49BAMCMCoxKDAmBgNVBAMM |
| 34 | H0FsY2hlbXkgUm9sZXNBbnl3aGVyZSBUZXN0IENBIDIwHhcNMjYwNzEwMjI1MjU2 |
| 35 | WhcNMzYwNzA3MjI1MjU2WjAqMSgwJgYDVQQDDB9BbGNoZW15IFJvbGVzQW55d2hl |
| 36 | cmUgVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEtT8ZNO2J3Igt |
| 37 | 4tIpIYwKQZ9RSYty5FHE96egbgRWWpI/iErOGJXk+Xdp+AabFUMB/Qi41P11ocJO |
| 38 | mJIn2ULHMqMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwCgYI |
| 39 | KoZIzj0EAwIDRwAwRAIgZbkvQhO65WNfctjY9csDIdO8Vw9peumgKbwzjs9DPGsC |
| 40 | IHRWVLwLqB3bukO3ifYaDXqUjv66105QNBlztMf/Z2rp |
| 41 | -----END CERTIFICATE-----`; |
| 42 | |
| 43 | /** |
| 44 | * CRL number 1, issued by Test CA 1, containing one revoked leaf |
| 45 | * certificate (IAM Roles Anywhere rejects CRLs with no revoked entries). |
| 46 | */ |
| 47 | export const CRL1_PEM = `-----BEGIN X509 CRL----- |
| 48 | MIHaMIGAAgEBMAoGCCqGSM49BAMCMCoxKDAmBgNVBAMMH0FsY2hlbXkgUm9sZXNB |
| 49 | bnl3aGVyZSBUZXN0IENBIDEXDTI2MDcxMDIyNTM1N1oXDTM2MDcwNzIyNTM1N1ow |
| 50 | FTATAgIQABcNMjYwNzEwMjI1MzU3WqAOMAwwCgYDVR0UBAMCAQEwCgYIKoZIzj0E |
| 51 | AwIDSQAwRgIhAPt5nysnFXx4GserJT6r8VHNzUBfj+dYwEJDMd8CfraJAiEAsaqe |
| 52 | GRjgUIb+wtNWbLW+JDrX9lg+KARuCWT2xtxQy+Q= |
| 53 | -----END X509 CRL-----`; |
| 54 | |
| 55 | /** |
| 56 | * CRL number 2, issued by Test CA 1, containing two revoked leaf |
| 57 | * certificates — a rotation of {@link CRL1_PEM}. |
| 58 | */ |
| 59 | export const CRL2_PEM = `-----BEGIN X509 CRL----- |
| 60 | MIHvMIGVAgEBMAoGCCqGSM49BAMCMCoxKDAmBgNVBAMMH0FsY2hlbXkgUm9sZXNB |
| 61 | bnl3aGVyZSBUZXN0IENBIDEXDTI2MDcxMDIyNTM1N1oXDTM2MDcwNzIyNTM1N1ow |
| 62 | KjATAgIQABcNMjYwNzEwMjI1MzU3WjATAgIQARcNMjYwNzEwMjI1MzU3WqAOMAww |
| 63 | CgYDVR0UBAMCAQIwCgYIKoZIzj0EAwIDSQAwRgIhAOYO6BuWRt/bziGOGXUg7LCZ |
| 64 | vDU25rt0DrPR9EMw0gBIAiEAy3PnEQZmn0tecbVpKnMgWEvgfLoRU9XqBTPL6jL7 |
| 65 | rFY= |
| 66 | -----END X509 CRL-----`; |