CertificateBuilderTest Class — netty Architecture

Source Code

pkitesting/src/test/java/io/netty/pkitesting/CertificateBuilderTest.java lines 65–490

class CertificateBuilderTest {
    private static final Instant NOW = Instant.now();
    private static final String SUBJECT = "CN=netty.io, O=Netty";
    private static final CertificateBuilder BASE = new CertificateBuilder()
            .notBefore(NOW.minus(1, DAYS))
            .notAfter(NOW.plus(1, DAYS))
            .subject(SUBJECT);
    private static final SecureRandom RNG = new SecureRandom();

    @ParameterizedTest
    @EnumSource
    void createCertOfEveryKeyType(Algorithm algorithm) throws Exception {
        // Assume that RSA 4096 and RSA 8192 work if the other RSA bit-widths work.
        // These big keys just take too long to test with.
        assumeTrue(algorithm != Algorithm.rsa4096 && algorithm != Algorithm.rsa8192);
        assumeTrue(algorithm.isSupported());
        assumeTrue(algorithm.supportSigning());

        X509Bundle bundle = BASE.copy()
                .algorithm(algorithm)
                .setIsCertificateAuthority(true)
                .buildSelfSigned();
        X509Certificate cert = bundle.getCertificate();
        assertTrue(bundle.isCertificateAuthority());
        assertTrue(bundle.isSelfSigned());
        assertThat(cert.getSubjectX500Principal()).isEqualTo(new X500Principal(SUBJECT));
    }

    @ParameterizedTest
    @EnumSource
    void createKeyPairOfEveryKeyType(Algorithm algorithm) throws Exception {
        // Assume that RSA 4096 and RSA 8192 work if the other RSA bit-widths work.
        // These big keys just take too long to test with.
        assumeTrue(algorithm != Algorithm.rsa4096 && algorithm != Algorithm.rsa8192);
        assumeTrue(algorithm.isSupported());

        KeyPair keyPair = algorithm.generateKeyPair(RNG, null);
        assertNotNull(keyPair);
        assertNotNull(keyPair.getPrivate());
        assertNotNull(keyPair.getPublic());
    }

    @ParameterizedTest
    @EnumSource(names = {"ecp256", "ecp384", "rsa2048", "rsa3072"})
    void createKeyPairWithProvider(Algorithm algorithm) throws Exception {
        assumeTrue(algorithm.isSupported());

        KeyPair keyPair = algorithm.generateKeyPair(RNG, new BouncyCastleProvider());
        assertNotNull(keyPair);
        assertNotNull(keyPair.getPrivate());
        assertNotNull(keyPair.getPublic());
    }

    @EnabledForJreRange(
            min = JRE.JAVA_24,
            disabledReason = "ML-KEM is only supported in Java 24 onwards")
    @ParameterizedTest
    @EnumSource(names = {"mlKem512", "mlKem768", "mlKem1024"})
    void createMlKemCerts(Algorithm algorithm) throws Exception {
        CertificateBuilder mlKemBuilder = BASE.copy()
                .algorithm(algorithm);

        // ML-KEM cannot be used to sign itself
        assertThrows(IllegalStateException.class, () -> {
            mlKemBuilder.copy().setIsCertificateAuthority(true).buildSelfSigned();
        });

        CertificateBuilder mlDsaBuilder = BASE.copy()
                .algorithm(Algorithm.mlDsa44);
        X509Bundle issuer = mlDsaBuilder
                .subject("CN=issuer.netty.io, O=Netty")
                .setIsCertificateAuthority(true)
                .buildSelfSigned();

        // ML-KEM can be signed by others
        X509Bundle mlKemBundle = mlKemBuilder.buildIssuedBy(issuer);

        X509Certificate cert = mlKemBundle.getCertificate();
        assertFalse(mlKemBundle.isCertificateAuthority());
        assertFalse(mlKemBundle.isSelfSigned());
        assertThat(cert.getSubjectX500Principal()).isEqualTo(new X500Principal(SUBJECT));