[tests]
action = "Sequence"
# "..\\tls_server"
test = msz:"..\\initial_req", \
  "..\\tls_client", \
  "..\\encode_req", \
  "..\\sign_req", \
  "..\\decode_req", \
  "..\\verify_req", \
  "..\\process_req", \
  "..\\decode_rep", \
  "..\\verify_rep", \
  "..\\install_cert", \
  "..\\encode_cann", \
  "..\\decode_cann", \
  "..\\rev_req", \
  "..\\crl", \
  "..\\rev_ann_add", \
  "..\\rev_ann_decode", \
  "..\\cross", \
  "..\\error_msg_info", \
  "..\\base64", \
  "..\\update_client", \
  "..\\change_client_passwd", \
  "..\\genm", \
  "..\\long_name"

[all]
action = "Sequence"
test = msz: "..\\clean", \
  "..\\gen_a", \
  "..\\tests", \
  "..\\cku", \
  "..\\set_na", \
  "..\\passwd_a", \
  "..\\tests", \
  "..\\long_chain", \
  "..\\clean"

[gen_a]
action = "Sequence"
test = msz:"GenRoot", \
  "InstRoot", \
  "GenCrl", \
  "InstCrl" \

[gen_a\GenRoot]
action = "GenerateRoot"
ProvType="gost2001"
cacontainer="\\\\.\\hdimage\\"
subject="E=gostroot@cryptopro.ru,C=RU,L=Moscow,O=OOO Crypto-Pro,OU=Development,CN=GostRoot"
cacert="cacert.der"
rse_path="\\pkica"
cdp="http://www.standartcc.ru/certs/cacert(1).crl"
#period="0/0/5 0:0:0"
period = "00050000000000"
caname="standartcc"
extensions = msz:"2.5.29.17:<GeneralNames>"\
	    "<rfc822Name>chudov@cryptopro.ru</rfc822Name>"\
	    "<directoryName><rdnSequence>"\
	    "<RelativeDistinguishedName><AttributeTypeAndValue><type>2.5.4.3</type><value><CHOICE><printableString>Chudov</printableString></CHOICE></value></AttributeTypeAndValue></RelativeDistinguishedName>"\
	    "</rdnSequence></directoryName>"\
	    "</GeneralNames>",\
	    "1.3.6.1.5.5.7.1.11:"\
	    "<SubjectInfoAccessSyntax><AccessDescription>"\
	    "<accessMethod>1.3.6.1.5.5.7.48.5</accessMethod>"\
	    "<accessLocation><uniformResourceIdentifier>"\
	    "http://localhost/certs/cacert.cer"\
	    "</uniformResourceIdentifier></accessLocation>"\
	    "</AccessDescription></SubjectInfoAccessSyntax>"

WndProvType = "silent"
#WndProvType = "exclude"
#WndProvType = "console"

[gen_a\InstRoot]
action = "CertStoreAdd"
input = "cacert.der"
store = "system.Root"

[gen_a\GenCrl]
action = "GenerateCrl"
output="out/cacrl.der"
CrlSignatureAlgorithm="1.2.643.2.2.4"
rse_path="\\pkica"

[gen_a\InstCrl]
action = "CrlStoreAdd"
input = "out/cacrl.der"
store = "system.CA"

[passwd_a]
action = "PasswdRootChange"
rse_path = "\\pkica"
WndProvType = "silent"

[inst_a]
action = "Sequence"
test = msz:"Cert", \
  "InstCrl"

[inst_a\Cert]
action="InstallRoot"
cacert="cacert.der"

[p10_cross]
action = "PKCS10_CrossReq"
rse_path="\\pkica"
output="out/pkcs10_cross.der"
WndProvType = "console"

[cku]
action = "Sequence"
test = msz:"GenRoot"

[cku\GenRoot]
action = "UpdateRoot"
output="out/pkiann.der"
cacert="cacertnew.der"
ProvType="gost2001"
WndProvType = "silent"
cacontainer="\\\\.\\hdimage\\"
RecipientGeneralName="dn:E=gostroot@cryptopro.ru,C=RU,L=Moscow,O=OOO Crypto-Pro,OU=Development,CN=GostRoot"
WndProvType = "silent"

[set_na]
action = "Sequence"
test = msz:"set", \
  "ClearCacheItem", \
  "InstRoot", \
  "GenCrl", \
  "InstCrl"

[set_na\set]
action = "IniSetFile"
src = "cacertnew.der"
dest = "\\pkica"
param = "cert"

[set_na\ClearCacheItem]
action = "ClearCacheItem"
src = msz:"\\pkica"

[set_na\GenCrl]
action = "GenerateCrl"
output="out/cacrl.der"
CrlSignatureAlgorithm="1.2.643.2.2.4"
rse_path="\\pkica"

[set_na\InstRoot]
action="InstallRoot"
cacert="cacertnew.der"

[set_na\InstCrl]
action = "CrlStoreAdd"
input = "out/cacrl.der"
store = "system.CA"

[inst_na]
action = "Sequence"
test = msz:"..\\set_na\\InstRoot", \
  "..\\set_na\\InstCrl"

[initial_req]
action = "Sequence"
test = msz:"encode", \
  "decode_req", \
  "process_req", \
  "decode_rep", \
  "verify_rep", \
  "install_cert", \
  "install_ra"

[initial_req\encode]
action = "CertReqMessage_EncodeAndSign"
RequestType="InitialRequest"
ProvType="gost2001"
keyspec=1
pse_path = "\\pkipse\\arm"
container = "\\\\.\\hdimage\\"
RecipientGeneralName="dn:E=gostroot@cryptopro.ru,C=RU,L=Moscow,O=OOO Crypto-Pro,OU=Development,CN=GostRoot"
Subject_Country="RU"
Subject_Organization="OOO Crypto-Pro"
Subject_OrgUnit="Development"
Subject_CommonName="GostRoot"
Subject_Locality="Moscow"
Subject_EMail="gostroot@cryptopro.ru"
Subject_Pseudonym="Ïñåâäîíèì"
extensions = msz:"2.5.29.37:<SEQUENCE_OF><KeyPurposeId>1.3.6.1.5.5.7.3.2</KeyPurposeId></SEQUENCE_OF>"
output="out/pkireq_arminit.der"

[initial_req\decode_req]
action = "CertReqMessage_Decode"
input="out/pkireq_arminit.der"
output=false

[initial_req\process_req]
action = "CertReqMessage_Process"
input="out/pkireq_arminit.der"
output="out/pkirep_arminit.der"
rse_path="\\pkica"
extensions = msz:"2.5.29.31:<CRLDistPointsSyntax><DistributionPoint><distributionPoint><fullName><uniformResourceIdentifier>"\
	    "http://www.standartcc.ru/certs/cacert(1).crl"\
	    "</uniformResourceIdentifier></fullName></distributionPoint></DistributionPoint></CRLDistPointsSyntax>"

[initial_req\decode_rep]
action = "CertRepMessage_Decode"
input="out/pkirep_arminit.der"
output_cert="out/arminit.cer"
output=false

[initial_req\verify_rep]
action = "CertRepMessage_Verify"
input_req="out/pkireq_arminit.der"
input_rep="out/pkirep_arminit.der"

[initial_req\install_cert]
action = "CertRepMessage_Install"
input_cert ="out/arminit.cer"
pse_path = "\\pkipse\\arm"

[initial_req\install_ra]
action = "CertStoreAdd"
store = "system.RA"
input = "out/arminit.cer"

[tls_server]
action = "Sequence"
test = msz:"encode_req", \
  "sign_req", \
  "process_req", \
  "decode_rep", \
  "verify_rep", \
  "decode_cert", \
  "install_cert"

[tls_server\encode_req]
action = "PKCS10_EncodeAndSign"
ProvType="gost2001"
keyspec=1
pse_path = "\\pkipse\\tls_server"
container = "\\\\.\\hdimage\\"
Subject_Country="RU"
Subject_Organization="CP"
Subject_OrgUnit=""
Subject_CommonName="atlix"
Subject_Locality="Internet"
Subject_State=""
Subject_Title=""
Subject_GivenName=""
Subject_Initials=""
Subject_SurName=""
Subject_DomainComponent=""
Subject_EMail="EMail@cryptopro.ru"
Subject_StreetAddress="StreetAddress"
Subject_UnstructuredName="UnstructuredName"
Subject_UnstructuredAddress="UnstructuredAddress"
extensions = msz:"2.5.29.37:<SEQUENCE_OF><KeyPurposeId>1.3.6.1.5.5.7.3.1</KeyPurposeId></SEQUENCE_OF>"
output="out/pkcs10_server.der"

[tls_server\sign_req]
action = "CertReqMessage_Sign"
RequestID=12
input = "out/pkcs10_server.der"
output="out/pkireq_server.der"
RequestType="GetCertificate"
pse_path = "\\pkipse\\arm"
RecipientGeneralName="dn:E=gostroot@cryptopro.ru,C=RU,L=Moscow,O=OOO Crypto-Pro,OU=Development,CN=GostRoot"

[tls_server\process_req]
action = "CertReqMessage_Process"
input="out/pkireq_server.der"
output="out/pkirep_server.der"

[tls_server\decode_rep]
action = "CertRepMessage_Decode"
input="out/pkirep_server.der"
output_cert="out/pki_server.cer"
output=false

[tls_server\verify_rep]
action = "CertRepMessage_Verify"
input_req="out/pkireq_server.der"
input_rep="out/pkirep_server.der"

[tls_server\decode_cert]
action = "Cert_Decode"
input="out/pki_server.cer"
output=false

[tls_server\install_cert]
action = "CertRepMessage_Install"
input_cert="out/pki_server.cer"
pse_path = "\\pkipse\\tls_server"

[tls_client]
action = "Sequence"
test = msz:"encode_req", \
  "sign_req", \
  "process_req", \
  "decode_rep", \
  "verify_rep", \
  "decode_cert", \
  "install_cert"

[tls_client\encode_req]
action = "PKCS10_EncodeAndSign"
ProvType="gost2001"
keyspec=1
pse_path = "\\pkipse\\tls_client"
container = "\\\\.\\hdimage\\"
Subject_Country="RU"
Subject_Organization="CP"
Subject_OrgUnit=""
Subject_CommonName="client"
Subject_Locality="Internet"
Subject_State=""
Subject_Title=""
Subject_GivenName=""
Subject_Initials=""
Subject_SurName=""
Subject_DomainComponent=""
Subject_EMail="EMail@cryptopro.ru"
Subject_StreetAddress=""
Subject_UnstructuredName=""
Subject_UnstructuredAddress=""
extensions = msz:"2.5.29.37:<SEQUENCE_OF><KeyPurposeId>1.3.6.1.5.5.7.3.2</KeyPurposeId></SEQUENCE_OF>"
output="out/pkcs10_client.der"

[tls_client\sign_req]
action = "CertReqMessage_Sign"
RecipientGeneralName="dn:E=gostroot@cryptopro.ru,C=RU,L=Moscow,O=OOO Crypto-Pro,OU=Development,CN=GostRoot"
#SenderGeneralName="dn:E=ca_arm@test.cryptopro.ru,C=RU,L=Internet,O=ÊðèïòîÏðî,OU=CA,CN=ARM"
pse_path = "\\pkipse\\arm"
RequestType="GetCertificate"
RequestID=12
output="out/pkireq_client.der"
input="out/pkcs10_client.der"

[tls_client\process_req]
action = "CertReqMessage_Process"
input="out/pkireq_client.der"
output="out/pkirep_client.der"

[tls_client\decode_rep]
action = "CertRepMessage_Decode"
input="out/pkirep_client.der"
output_cert="out/pki_client.cer"
output=false

[tls_client\verify_rep]
action = "CertRepMessage_Verify"
input_req="out/pkireq_client.der"
input_rep="out/pkirep_client.der"

[tls_client\decode_cert]
action = "Cert_Decode"
input="out/pki_client.cer"
output=false

[tls_client\install_cert]
action = "CertRepMessage_Install"
input_cert="out/pki_client.cer"
pse_path = "\\pkipse\\tls_client"

[encode_req]
action = "PKCS10_EncodeAndSign"
ProvType="gost2001"
keyspec=2
pse_path = "\\pkipse\\client1"
container = "\\\\.\\hdimage\\"
Subject_Country="RU"
Subject_Organization="ÊðèïòîÏðî"
Subject_OrgUnit="Ñêëàä"
Subject_CommonName="Pupkin"
Subject_Locality="Internet"
Subject_State="Øòàò"
Subject_Title=""
Subject_GivenName=""
Subject_Initials="È.È."
Subject_SurName=""
Subject_DomainComponent="DomainComponent"
Subject_EMail="pupkin@cryptopro.ru"
Subject_StreetAddress="StreetAddress"
Subject_UnstructuredName="UnstructuredName"
Subject_UnstructuredAddress="UnstructuredAddress"
extensions = msz:"2.5.29.37:<SEQUENCE_OF><KeyPurposeId>1.3.6.1.5.5.7.3.4</KeyPurposeId></SEQUENCE_OF>", \
  "2.5.29.15:<KeyUsage>   <digitalSignature/><nonRepudiation/>"\
    "<keyEncipherment/><keyEncipherment/><dataEncipherment/><keyAgreement/>"\
    "<keyCertSign/><cRLSign/><encipherOnly/><decipherOnly/></KeyUsage>"
output= "out/pkcs10.der"

[sign_req]
action = "CertReqMessage_Sign"
RequestType="GetCertificate"
#SenderGeneralName="dn:E=ca_arm@test.cryptopro.ru,C=RU,L=Internet,O=ÊðèïòîÏðî,OU=CA,CN=ARM"
RecipientGeneralName="dn:C=RU,CN=RecipientGeneralName"
input = "out/pkcs10.der"
output = "out/pkireq.der"
RequestID=12
pse_path = "\\pkipse\\arm"

[decode_req]
action = "CertReqMessage_Decode"
input="out/pkireq.der"
output=false

[verify_req]
action = "CertReqMessage_Verify"
input="out/pkireq.der"

[process_req]
action = "CertReqMessage_Process"
input="out/pkireq.der"
output="out/pkirep.der"
rse_path="\\pkica"
extensions = msz:"2.5.29.31:<CRLDistPointsSyntax><DistributionPoint><distributionPoint><fullName><uniformResourceIdentifier>"\
	    "http://www.standartcc.ru/certs/cacert(1).crl"\
	    "</uniformResourceIdentifier></fullName></distributionPoint></DistributionPoint></CRLDistPointsSyntax>"

[decode_rep]
action = "CertRepMessage_Decode"
input="out/pkirep.der"
output_cert="out/pki.cer"
output=false

[verify_rep]
action = "CertRepMessage_Verify"
input_req="out/pkireq.der"
input_rep="out/pkirep.der"

[decode_cert]
action = "Cert_Decode"
input="out/pki.cer"
output=false

[install_cert]
action = "CertRepMessage_Install"
input_cert="out/pki.cer"
pse_path = "\\pkipse\\client1"

[encode_cann]
action = "CertAnnContent_EncodeAndSign"
RecipientGeneralName = "dn:C=RU,CN=RecipientGeneralName"
input = "out/pki.cer"
output = "out/cann.der"
rse_path="\\pkica"

[decode_cann]
action = "CertAnnContent_DecodeAndVerify"
pse_path = "\\pkipse\\client1"
input = "out/cann.der"
output = "out/pki.cer"

[rev_req]
action = "Sequence"
test = msz:"encode", \
  "decode", \
  "verify"

[rev_req\encode]
action = "CertReqMessage_EncodeAndSign"
RequestType="RevokeCertificate"
RequestID=12
RecipientGeneralName="dn:C=RU,CN=RecipientGeneralName"
#SenderGeneralName="dn:E=ca_arm@test.cryptopro.ru,C=RU,L=Internet,O=ÊðèïòîÏðî,OU=CA,CN=ARM"
pse_path = "\\pkipse\\arm"
Subject_Country="RU"
Subject_Organization="ÊðèïòîÏðî"
Subject_OrgUnit="Ñêëàä"
Subject_CommonName="Pupkin"
Subject_Locality="Internet"
Subject_State="Øòàò"
Subject_Title=""
Subject_GivenName=""
Subject_Initials="È.È."
Subject_SurName=""
Subject_DomainComponent="DomainComponent"
Subject_EMail="pupkin@cryptopro.ru"
Subject_StreetAddress="StreetAddress"
Subject_UnstructuredName="UnstructuredName"
Subject_UnstructuredAddress="UnstructuredAddress"
output="out/pkirevreq.der"
ReasonFlags = "keyCompromise|caCompromise|affiliationChanged|superseded|"\
    "cessationOfOperation|certificateHold"

[rev_req\decode]
action = "CertReqMessage_Decode"
input="out/pkirevreq.der"
output=false

[rev_req\verify]
action = "CertReqMessage_Verify"
input="out/pkirevreq.der"

[crl]
action = "Sequence"
test = msz:"special", \
  "add_gen", \
  "add_decode", \
  "add_verify", \
  "add_store", \
  "del_gen", \
  "del_decode", \
  "del_prev", \
  "del_store"

[crl\special]
action = "GenerateCrl"
output="out/speccrl.der"
CrlSignatureAlgorithm="1.2.643.2.2.4"
rse_path="\\pkica"
extensions = msz:"2.5.29.28:<IssuingDistPointSyntax>" \ 
	"<onlyContainsCACerts><true/></onlyContainsCACerts>" \ 
	"<onlySomeReasons>1111</onlySomeReasons>" \
	"</IssuingDistPointSyntax>"

[crl\add_gen]
action = "GenerateCrl"
input="out/cacrl.der"
output="out/cacrladd.der"
addcertcert1="out/pki.cer"
addcertdate1="951230235959Z"
# "addcertext1.2.5.29.21"="<CRLReason><superseded/></CRLReason>"
addcertreason1 = "superseded"
# - unspecified
# 1.2.840.10040.2.1 - none
# 1.2.840.10040.2.2 - callissuer
# 1.2.840.10040.2.3 - reject
# "addcertext1.2.5.29.23"="<HoldInstruction>1.2.840.10040.2.2</HoldInstruction>"
addcerthold1 = "callissuer"
# "addcertext1.2.5.29.24"="<InvalidityDate>19951230235959Z</InvalidityDate>"
# addcertinvalidity1 = "30/12/1995 23:59:59"
addcertinvalidity1 = "19951230235959Z"
rse_path="\\pkica"

[crl\add_decode]
action = "DecodeCrl"
input="out/cacrladd.der"
output=false

[crl\add_verify]
action = "VerifyCrl"
input="out/cacrladd.der"

[crl\add_store]
action = "CrlStoreAdd"
input = "out/cacrladd.der"
store = "system.CA"

[crl\del_gen]
action = "GenerateCrl"
input="out/cacrladd.der"
output="out/cacrldel.der"
delcert=msz:"out/pki.cer"
rse_path="\\pkica"

[crl\del_decode]
action = "DecodeCrl"
input="out/cacrldel.der"
output=false

[crl\del_prev]
action = "CrlStoreDel"
issuer = "E=gostroot@cryptopro.ru, C=RU, L=Moscow, O=OOO Crypto-Pro, OU=Development, CN=GostRoot"

[crl\del_store]
action = "CrlStoreAdd"
input = "out/cacrldel.der"
store = "system.CA"

[rev_ann_add]
action = "RevAnnContent_Process"
input="out/pki.cer"
output="out/annadd.der"
PKIStatus="revocationNotification"
willBeRevokedAt="051230235959Z"
rse_path="\\pkica"

[rev_ann_decode]
action = "RevAnnContent_Decode"
input="out/annadd.der"
output=false

# Issuer-Subject
# Root1-Root1, Root1-Sub1, Root1-Sub1(Validity), Root1-Sub1(CRL)
# Root2-Root2, Root2Si-Root2Si, Root2-Root2Si, Root2Si-Root2, 
# Sub1-Root2Si, Root2Si-Sub1, Root2Si-Node1
# 

[long_chain]
action = "Sequence"
test = msz:"prepare", \
  "verify_chain"

[long_chain\prepare]
action = "Sequence"
test = msz:"..\\root1", \
  "..\\root1_sub1", \
  "..\\root1_sub1_val", \
  "..\\root1_sub1_crl", \
  "..\\root2", \
  "..\\sub1_root2", \
  "..\\root2_sub1", \
  "..\\root2_node1", \
  "..\\root2si", \
  "..\\root2_root2si", \
  "..\\root2si_root2", \
  "..\\root2si_node1", \
  "..\\verify_root", \
  "..\\remove_root2"

[long_chain\root1]
action = "Sequence"
test = msz:"gen", \
  "inst", \
  "crl0", \
  "crl0inst"

[long_chain\root1\gen]
action = "GenerateRoot"
ProvType="gost2001"
cacontainer="\\\\.\\hdimage\\"
subject="E=root1@cryptopro.ru,C=RU,O=Root1,CN=Root1"
cacert="out/r1r1.cer"
rse_path="\\pkica\\root1"
cdp="http://www.root1.ru/certs/cacert(1).crl"
crl_period="00400000000000"
period = "00400000000000"
caname="root1"
extensions = msz:"1.3.6.1.5.5.7.1.11:"\
	    "<SubjectInfoAccessSyntax><AccessDescription>"\
	    "<accessMethod>1.3.6.1.5.5.7.48.5</accessMethod>"\
	    "<accessLocation><uniformResourceIdentifier>"\
	    "http://localhost/certs/r1r1.cer"\
	    "</uniformResourceIdentifier></accessLocation>"\
	    "</AccessDescription></SubjectInfoAccessSyntax>"

[long_chain\root1\inst]
action = "CertStoreAdd"
input="out/r1r1.cer"
store = "system.Root"

[long_chain\root1\crl0]
action = "GenerateCrl"
output="out/cacrlroot1.crl"
rse_path="\\pkica\\root1"
CrlSignatureAlgorithm="1.2.643.2.2.3"

[long_chain\root1\crl0inst]
action = "CrlStoreAdd"
input="out/cacrlroot1.crl"

[long_chain\root1_sub1]
action = "Sequence"
test = msz:"encode", \
  "process", \
  "decode", \
  "install", \
  "sub1_asroot2", \
  "crl0", \
  "crl0inst"

[long_chain\root1_sub1\encode]
action = "CertReqMessage_EncodeAndSign"
RequestType="InitialRequest"
ProvType="gost2001"
RequestID=14
RecipientGeneralName="dn:C=RU,O=Root1,OU=Sub1,CN=Sub1"
pse_path = "\\pkipse\\sub1"
Subject_Country="RU"
Subject_Organization="Root1"
Subject_OrgUnit="Sub1"
Subject_CommonName="Sub1"
output="out/pr1s1q.der"
container = "\\\\.\\hdimage\\"
WndProvType = "nopin"

[long_chain\root1_sub1\process]
action = "CertReqMessage_Process"
input="out/pr1s1q.der"
output="out/pr1s1p.der"
rse_path="\\pkica\\root1"
extensions = msz:"crit.2.5.29.19:<BasicConstraintsSyntax><cA><true/>" \
	"</cA></BasicConstraintsSyntax>",\
	    "1.3.6.1.5.5.7.1.11:"\
	    "<SubjectInfoAccessSyntax><AccessDescription>"\
	    "<accessMethod>1.3.6.1.5.5.7.48.5</accessMethod>"\
	    "<accessLocation><uniformResourceIdentifier>"\
	    "http://localhost/certs/r1s1.cer"\
	    "</uniformResourceIdentifier></accessLocation>"\
	    "</AccessDescription></SubjectInfoAccessSyntax>"
NotAfter = "20440101000000Z"

[long_chain\root1_sub1\decode]
action = "CertRepMessage_Decode"
input="out/pr1s1p.der"
output_cert="out/r1s1.cer"
output=false

[long_chain\root1_sub1\install]
action = "CertRepMessage_Install"
input_cert="out/r1s1.cer"
pse_path="\\pkipse\\sub1"
WndProvType = "nopin"

[long_chain\root1_sub1\sub1_asroot]
action = "SetAsRoot"
rse_path="\\pkica\\sub1"
pse_path="\\pkipse\\sub1"
cert="out/r1s1.cer"
cdp="http://www.root1.ru/certs/cacert(1).crl"
period = "00400000000000"
caname="sub1"

[long_chain\root1_sub1\sub1_asroot2]
action = "Sequence"
test = msz:"cert", \
  "cdp", \
  "period", \
  "caname"

[long_chain\root1_sub1\sub1_asroot2\cert]
action = "IniSetFile"
src = "out/r1s1.cer"
dest = "\\pkica\\sub1"
param = "cert"

[long_chain\root1_sub1\sub1_asroot2\cdp]
action = "IniSet"
src = "http://www.root1.ru/certs/cacert(1).crl"
dest = "\\pkica\\sub1"
param = "cdp"

[long_chain\root1_sub1\sub1_asroot2\period]
action = "IniSet"
#src = "0/0/5 0:0:0"
src = "00400000000000"
dest = "\\pkica\\sub1"
param = "crl_update"

[long_chain\root1_sub1\sub1_asroot2\caname]
action = "IniSet"
src = "sub1"
dest = "\\pkica\\sub1"
param = "caname"

[long_chain\root1_sub1\crl0]
action = "GenerateCrl"
output="out/cacrlsub1.crl"
rse_path="\\pkica\\sub1"
CrlSignatureAlgorithm="1.2.643.2.2.3"

[long_chain\root1_sub1\crl0inst]
action = "CrlStoreAdd"
input="out/cacrlsub1.crl"

[long_chain\root1_sub1_val]
action = "Sequence"
test = msz:"encode", \
  "process", \
  "decode"

[long_chain\root1_sub1_val\encode]
action = "CertReqMessage_EncodeAndSign"
RequestType="InitialRequest"
ProvType="gost2001"
RequestID=14
RecipientGeneralName="dn:C=RU,O=Root1,OU=Sub1,CN=Sub1"
pse_path = "\\pkipse\\sub1"
Subject_Country="RU"
Subject_Organization="Root1"
Subject_OrgUnit="Sub1"
Subject_CommonName="Sub1"
output="out/pr1s1qv.der"
use_existing=true
WndProvType = "nopin"

[long_chain\root1_sub1_val\process]
action = "CertReqMessage_Process"
input="out/pr1s1qv.der"
output="out/pr1s1pv.der"
rse_path="\\pkica\\root1"
extensions = msz:"crit.2.5.29.19:<BasicConstraintsSyntax><cA><true/>" \
	"</cA></BasicConstraintsSyntax>"
#NotBefore= "31/12/1995 23:59:59"
#NotAfter= "31/12/1996 23:59:59"
NotBefore= "19951231235959Z"
NotAfter= "19951231235959Z"

[long_chain\root1_sub1_val\decode]
action = "CertRepMessage_Decode"
input="out/pr1s1pv.der"
output_cert="out/r1s1v.cer"
output=false

[long_chain\root1_sub1_crl]
action = "Sequence"
test = msz:"encode", \
  "process", \
  "decode", \
  "crl", \
  "install_crl", \
  "crl_old", \
  "crl_user", \
  "crl_dp"

[long_chain\root1_sub1_crl\encode]
action = "CertReqMessage_EncodeAndSign"
RequestType="InitialRequest"
ProvType="gost2001"
RequestID=14
RecipientGeneralName="dn:C=RU,O=Root1,OU=Sub1,CN=Sub1"
pse_path = "\\pkipse\\sub1"
Subject_Country="RU"
Subject_Organization="Root1"
Subject_OrgUnit="Sub1"
Subject_CommonName="Sub1"
extensions = msz:"2.5.29.37:<SEQUENCE_OF><KeyPurposeId>1.3.6.1.5.5.7.3.4</KeyPurposeId></SEQUENCE_OF>"
output="out/pr1s1qc.der"
use_existing=true
WndProvType = "nopin"

[long_chain\root1_sub1_crl\process]
action = "CertReqMessage_Process"
input="out/pr1s1qc.der"
output="out/pr1s1pc.der"
rse_path="\\pkica\\root1"
extensions = msz:"crit.2.5.29.19:<BasicConstraintsSyntax><cA><true/>" \
	"</cA></BasicConstraintsSyntax>", \
  "2.5.29.17:<GeneralNames>"\
	    "<rfc822Name>root2si@cryptopro.ru</rfc822Name>"\
	    "<directoryName><rdnSequence>"\
	    "<RelativeDistinguishedName><AttributeTypeAndValue><type>2.5.4.3</type><value><CHOICE><printableString>CRL</printableString></CHOICE></value></AttributeTypeAndValue></RelativeDistinguishedName>"\
	    "</rdnSequence></directoryName>"\
	    "</GeneralNames>"
NotAfter = "20440101000000Z"

[long_chain\root1_sub1_crl\decode]
action = "CertRepMessage_Decode"
input="out/pr1s1pc.der"
output_cert="out/r1s1c.cer"
output=false

[long_chain\root1_sub1_crl\crl]
action = "GenerateCrl"
output="out/cacrlroot1.crl"
addcertcert1="out/r1s1c.cer"
addcertdate1="951230235959Z"
rse_path="\\pkica\\root1"
CrlSignatureAlgorithm="1.2.643.2.2.3"

[long_chain\root1_sub1_crl\install_crl]
action = "CrlStoreAdd"
input="out/cacrlroot1.crl"

[long_chain\root1_sub1_crl\crl_old]
action = "GenerateCrl"
output="out/cacrlroot1old.crl"
rse_path="\\pkica\\root1"
#ThisUpdate="1/1/2002 0:0:0"
#NextUpdate="1/1/2003 0:0:0"
ThisUpdate="20020101000000Z"
NextUpdate="20030101000000Z"
CrlSignatureAlgorithm="1.2.643.2.2.3"
addcertcert1="out/r1s1.cer"
addcertdate1="031230235959Z"

[long_chain\root1_sub1_crl\crl_user]
action = "GenerateCrl"
output="out/cacrlroot1user.crl"
rse_path="\\pkica\\root1"
CrlSignatureAlgorithm="1.2.643.2.2.3"
addcertcert1="out/r1s1.cer"
addcertdate1="031230235959Z"
extensions = msz:"crit.2.5.29.28:<IssuingDistPointSyntax>" \ 
	"<onlyContainsUserCerts><true/></onlyContainsUserCerts>" \ 
	"</IssuingDistPointSyntax>"

[long_chain\root1_sub1_crl\crl_dp]
action = "GenerateCrl"
output="out/cacrlroot1dp.crl"
rse_path="\\pkica\\root1"
CrlSignatureAlgorithm="1.2.643.2.2.3"
addcertcert1="out/r1s1.cer"
addcertdate1="031230235959Z"
extensions = msz:"crit.2.5.29.28:<IssuingDistPointSyntax>" \ 
	"<distributionPoint><fullName>" \
	"<uniformResourceIdentifier>" \
	"http://www.invalid.ru/certs/cacert(1).crl" \
	"</uniformResourceIdentifier>" \
	"</fullName></distributionPoint>" \ 
	"</IssuingDistPointSyntax>"

[long_chain\root2]
action = "Sequence"
test = msz:"gen", \
  "inst", \
  "crl0", \
  "crl0inst"

[long_chain\root2\gen]
action = "GenerateRoot"
ProvType="gost2001"
cacontainer="\\\\.\\hdimage\\"
subject="E=root2@cryptopro.ru,C=RU,O=Root2,CN=Root2"
cacert="out/r2r2.cer"
rse_path="\\pkica\\root2"
cdp="http://www.root2.ru/certs/cacert(1).crl"
crl_period="00400000000000"
period = "00400000000000"
caname="root2"
extensions = msz:"2.5.29.17:<GeneralNames>"\
	    "<rfc822Name>root2@cryptopro.ru</rfc822Name>"\
	    "<directoryName><rdnSequence>"\
	    "<RelativeDistinguishedName><AttributeTypeAndValue><type>2.5.4.3</type><value><CHOICE><printableString>root2</printableString></CHOICE></value></AttributeTypeAndValue></RelativeDistinguishedName>"\
	    "</rdnSequence></directoryName>"\
	    "</GeneralNames>",\
	    "1.3.6.1.5.5.7.1.11:"\
	    "<SubjectInfoAccessSyntax><AccessDescription>"\
	    "<accessMethod>1.3.6.1.5.5.7.48.5</accessMethod>"\
	    "<accessLocation><uniformResourceIdentifier>"\
	    "http://localhost/certs/r2r2.cer"\
	    "</uniformResourceIdentifier></accessLocation>"\
	    "</AccessDescription></SubjectInfoAccessSyntax>"

[long_chain\root2\inst]
action = "CertStoreAdd"
input="out/r2r2.cer"
store = "system.Root"

[long_chain\root2\crl0]
action = "GenerateCrl"
output="out/cacrlroot2.crl"
rse_path="\\pkica\\root2"
CrlSignatureAlgorithm="1.2.643.2.2.3"
extensions = msz:"crit.2.5.29.28:<IssuingDistPointSyntax>" \ 
	"<distributionPoint><fullName>" \
	"<uniformResourceIdentifier>" \
	"http://www.root2.ru/certs/cacert(1).crl" \
	"</uniformResourceIdentifier>" \
	"</fullName></distributionPoint>" \ 
	"</IssuingDistPointSyntax>"

[long_chain\root2\crl0inst]
action = "CrlStoreAdd"
input="out/cacrlroot2.crl"

[long_chain\sub1_root2]
action = "Sequence"
test = msz:"encode", \
  "process", \
  "verify_rep", \
  "decode"

[long_chain\sub1_root2\encode]
action = "CrossReqMessage_EncodeAndSign"
rse_path="\\pkica\\root2"
RecipientGeneralName = "dn:E=sub1@cryptopro.ru,C=RU,O=Root1,OU=Sub1,CN=Sub1"
output="out/ps1r2q.der"

[long_chain\sub1_root2\process]
action = "CertReqMessage_Process"
input="out/ps1r2q.der"
output="out/ps1r2p.der"
rse_path="\\pkica\\sub1"
extensions = msz:"crit.2.5.29.19:<BasicConstraintsSyntax><cA><true/>" \
	"</cA></BasicConstraintsSyntax>"
NotAfter = "20440101000000Z"
addpath=true

[long_chain\sub1_root2\verify_rep]
action = "CertRepMessage_Verify"
input_req="out/ps1r2q.der"
input_rep="out/ps1r2p.der"

[long_chain\sub1_root2\decode]
action = "CertRepMessage_Decode"
input="out/ps1r2p.der"
output_cert="out/s1r2.cer"
output=false

[long_chain\root2_sub1]
action = "Sequence"
test = msz:"encode", \
  "process", \
  "decode"

[long_chain\root2_sub1\encode]
action = "CrossReqMessage_EncodeAndSign"
rse_path="\\pkica\\sub1"
RecipientGeneralName = "dn:E=root2@cryptopro.ru,C=RU,O=Root2,CN=Root2"
output="out/pr2s1q.der"
addpath=true

[long_chain\root2_sub1\process]
action = "CertReqMessage_Process"
input="out/pr2s1q.der"
output="out/pr2s1p.der"
rse_path="\\pkica\\root2"
NotAfter = "20440101000000Z"

[long_chain\root2_sub1\decode]
action = "CertRepMessage_Decode"
input="out/pr2s1p.der"
output_cert="out/r2s1.cer"
output=false

[long_chain\root2_node1]
action = "Sequence"
test = msz:"encode", \
  "process", \
  "decode"

[long_chain\root2_node1\encode]
action = "CertReqMessage_EncodeAndSign"
RequestType="InitialRequest"
ProvType="gost2001"
RequestID=15
RecipientGeneralName="dn:C=RU,O=Root2,CN=Root2"
pse_path = "\\pkipse\\node1"
Subject_Country="RU"
Subject_Organization="Root2"
Subject_CommonName="Node1"
extensions = msz:"2.5.29.37:<SEQUENCE_OF><KeyPurposeId>1.3.6.1.5.5.7.3.4</KeyPurposeId></SEQUENCE_OF>"
# this is a simplest way
output="out/pr2n1q.der"
container="\\\\.\\hdimage\\"

[long_chain\root2_node1\process]
action = "CertReqMessage_Process"
input="out/pr2n1q.der"
output="out/pr2n1p.der"
rse_path="\\pkica\\root2"
NotAfter = "20440101000000Z"

[long_chain\root2_node1\decode]
action = "CertRepMessage_Decode"
input="out/pr2n1p.der"
output_cert="out/r2n1.cer"
output=false

[long_chain\root2si]
action = "Sequence"
test = msz:"gen"

[long_chain\root2si\gen]
action = "GenerateRoot"
ProvType="gost2001"
cacontainer="\\\\.\\hdimage\\"
subject="E=root2@cryptopro.ru,C=RU,O=Root2,CN=Root2"
cacert="out/r2sir2si.cer"
rse_path="\\pkica\\root2si"
cdp="http://www.root2.ru/certs/cacert(1).crl"
crl_period="00400000000000"
period = "00400000000000"
caname="root2si"
extensions = msz:"2.5.29.17:<GeneralNames>"\
	    "<rfc822Name>root2si@cryptopro.ru</rfc822Name>"\
	    "<directoryName><rdnSequence>"\
	    "<RelativeDistinguishedName><AttributeTypeAndValue><type>2.5.4.3</type><value><CHOICE><printableString>root2si</printableString></CHOICE></value></AttributeTypeAndValue></RelativeDistinguishedName>"\
	    "</rdnSequence></directoryName>"\
	    "</GeneralNames>",\
	    "1.3.6.1.5.5.7.1.11:"\
	    "<SubjectInfoAccessSyntax><AccessDescription>"\
	    "<accessMethod>1.3.6.1.5.5.7.48.5</accessMethod>"\
	    "<accessLocation><uniformResourceIdentifier>"\
	    "http://localhost/certs/r2sir2si.cer"\
	    "</uniformResourceIdentifier></accessLocation>"\
	    "</AccessDescription></SubjectInfoAccessSyntax>"

[long_chain\root2_root2si]
action = "Sequence"
test = msz:"process", \
  "decode"

[long_chain\root2_root2si\process]
action = "CertReqMessage_Process"
input_cert="out/r2sir2si.cer"
output="out/pr2r2sip.der"
rse_path="\\pkica\\root2"
extensions = msz:"crit.2.5.29.19:<BasicConstraintsSyntax><cA><true/>" \
	"</cA></BasicConstraintsSyntax>"
NotAfter = "20440101000000Z"
addpath=true

[long_chain\root2_root2si\decode]
action = "CertRepMessage_Decode"
input="out/pr2r2sip.der"
output_cert="out/r2r2si.cer"
output=false

[long_chain\root2si_root2]
action = "Sequence"
test = msz:"process", \
  "decode", \
  "crl0"

[long_chain\root2si_root2\process]
action = "CertReqMessage_Process"
input_cert="out/r2r2.cer"
output="out/pr2sir2p.der"
rse_path="\\pkica\\root2si"
extensions = msz:"crit.2.5.29.19:<BasicConstraintsSyntax><cA><true/>" \
	"</cA></BasicConstraintsSyntax>", \
  "2.5.29.31:<CRLDistPointsSyntax><DistributionPoint><distributionPoint><fullName><uniformResourceIdentifier>"\
	    "http://www.qwqwqwqwq.ru/certs/cacert(1).crl"\
	    "</uniformResourceIdentifier></fullName></distributionPoint>"\
	    "</DistributionPoint></CRLDistPointsSyntax>"
NotAfter = "20440101000000Z"
addpath=true

[long_chain\root2si_root2\decode]
action = "CertRepMessage_Decode"
input="out/pr2sir2p.der"
output_cert="out/r2sir2.cer"
output=false

[long_chain\root2si_root2\crl0]
action = "GenerateCrl"
output="out/cacrlroot2si.crl"
rse_path="\\pkica\\root2si"
CrlSignatureAlgorithm="1.2.643.2.2.3"

[long_chain\root2si_node1]
action = "Sequence"
test = msz:"encode", \
  "process", \
  "decode"

[long_chain\root2si_node1\encode]
action = "CertReqMessage_EncodeAndSign"
RequestType="InitialRequest"
ProvType="gost2001"
RequestID=15
RecipientGeneralName="dn:C=RU,O=Root2,CN=Root2"
pse_path = "\\pkipse\\node1si"
Subject_Country="RU"
Subject_Organization="Root2"
Subject_CommonName="Node1"
extensions = msz:"2.5.29.37:<SEQUENCE_OF><KeyPurposeId>1.3.6.1.5.5.7.3.4</KeyPurposeId></SEQUENCE_OF>"
# this is a simplest way
output="out/pr2sin1q.der"
container="\\\\.\\hdimage\\"

[long_chain\root2si_node1\process]
action = "CertReqMessage_Process"
input="out/pr2sin1q.der"
output="out/pr2sin1p.der"
rse_path="\\pkica\\root2si"
NotAfter = "20440101000000Z"

[long_chain\root2si_node1\decode]
action = "CertRepMessage_Decode"
input="out/pr2sin1p.der"
output_cert="out/r2sin1.cer"
output=false

[long_chain\verify_root]
action = "CertChain_Verify"
input = "out/r1r1.cer"

#it remove root2si
[long_chain\remove_root2]
action = "CertStoreDel"
store = "system.Root"
issuer = "Root2"

[long_chain\verify_chain]
action = "Sequence"
test = msz:"ok", \
  "ok2", \
  "err2", \
  "err3", \
  "err4", \
  "err5"

[long_chain\verify_chain\ok]
action = "CertChain_Verify"
# r2sin1 <- r2r2si <- s1r2 <- r1s1
input="out/r2sin1.cer" 
disable_predefined_store = true
disable_predefined_crl_store = true
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r1s1c.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/r1s1.cer", \
  "out/s1r2.cer", \
  "out/r2r2si.cer"
addcrl = msz:"out/cacrlroot1.crl", \
  "out/cacrlsub1.crl", \
  "out/cacrlroot1old.crl", \
  "out/cacrlroot1user.crl", \
  "out/cacrlroot1dp.crl", \
  "out/cacrlroot2.crl"

[long_chain\verify_chain\ok2]
action = "CertChain_Verify"
# r2sin1 <- r2r2si <- r2r2
input="out/r2sin1.cer" 
disable_predefined_stores = true
disable_predefined_crl_stores = true
disable_root = true
addcert = msz:"out/r2r2si.cer"
addcrl = msz:"out/cacrlroot2si.crl"
addtrust = msz:"out/r2r2.cer"

[long_chain\verify_chain\err2]
action = "CertChain_Verify"
status = "IS_UNTRUSTED_ROOT"
disable_predefined_store = true
disable_predefined_crl_store = true
# r2sin1 <- ???
input="out/r2sin1.cer" 
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r1s1c.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/r1s1.cer", \
  "out/s1r2.cer"

[long_chain\verify_chain\err3]
action = "CertChain_Verify"
status = "IS_UNTRUSTED_ROOT"
disable_predefined_store = true
disable_predefined_crl_store = true
# r2sin1 <- r2r2si <- ???
input="out/r2sin1.cer" 
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r1s1c.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/r1s1.cer", \
  "out/r2r2si.cer"

[long_chain\verify_chain\err4]
action = "CertChain_Verify"
status = "IS_REVOKED"
disable_predefined_store = true
disable_predefined_crl_store = true
# r2sin1 <- r2r2si <- s1r2 <- r1s1c
input="out/r2sin1.cer" 
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r1s1c.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/s1r2.cer", \
  "out/r2r2si.cer"
addcrl = msz:"out/cacrlroot1.crl", \
  "out/cacrlsub1.crl", \
  "out/cacrlroot1old.crl", \
  "out/cacrlroot1user.crl", \
  "out/cacrlroot1dp.crl", \
  "out/cacrlroot2.crl"

[long_chain\verify_chain\err5]
action = "CertChain_Verify"
status = "IS_NOT_TIME_VALID"
disable_predefined_store = true
disable_predefined_crl_store = true
# r2sin1 <- r2r2si <- s1r2 <- r1s1v
input="out/r2sin1.cer" 
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/s1r2.cer", \
  "out/r2r2si.cer"

#verify_chain ç¥à¥§ CAPI ¤«ï Windows
[verify_chain_win]
action = "Sequence"
test = msz:"..\\long_chain\\prepare", \
	"..\\clean", \
	"instroot", \
	"ok", \
	"err2", \
	"err3", \
	"err4", \
	"err5", \
	"delroot"

[verify_chain_win\instroot]
action = "CertStoreAdd"
input="out/r1r1.cer"
store = "system.Root"

[verify_chain_win\delroot]
action = "CertStoreDel"
store = "system.Root"
issuer = "E=root1@cryptopro.ru, C=RU, O=Root1, CN=Root1"

[verify_chain_win\ok]
action = "Sequence"
test = msz:"verify"

[verify_chain_win\ok\verify]
action = "CertChain_Verify_CAPI"
# r2sin1 <- r2r2si <- s1r2 <- r1s1
input="out/r2sin1.cer" 
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r1s1c.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/r1s1.cer", \
  "out/s1r2.cer", \
  "out/r2r2si.cer"
addcrl = msz:"out/cacrlroot1.crl", \
  "out/cacrlsub1.crl", \
  "out/cacrlroot1old.crl", \
  "out/cacrlroot1user.crl", \
  "out/cacrlroot1dp.crl", \
  "out/cacrlroot2.crl"

[verify_chain_win\err2]
action = "Sequence"
test = msz:"verify"

[verify_chain_win\err2\verify]
action = "CertChain_Verify_CAPI"
status = "IS_UNTRUSTED_ROOT"
# r2sin1 <- ???
input="out/r2sin1.cer" 
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r1s1c.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/r1s1.cer", \
  "out/s1r2.cer"

[verify_chain_win\err3]
action = "Sequence"
test = msz:"verify"

[verify_chain_win\err3\verify]
action = "CertChain_Verify_CAPI"
status = "IS_UNTRUSTED_ROOT"
# r2sin1 <- r2r2si <- ???
input="out/r2sin1.cer" 
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r1s1c.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/r1s1.cer", \
  "out/r2r2si.cer"

[verify_chain_win\err4]
action = "Sequence"
test = msz:"verify"

[verify_chain_win\err4\verify]
action = "CertChain_Verify_CAPI"
status = "IS_REVOKED"
# r2sin1 <- r2r2si <- s1r2 <- r1s1c
input="out/r2sin1.cer" 
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r1s1c.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/s1r2.cer", \
  "out/r2r2si.cer"
addcrl = msz:"out/cacrlroot1.crl", \
  "out/cacrlsub1.crl", \
  "out/cacrlroot1old.crl", \
  "out/cacrlroot1user.crl", \
  "out/cacrlroot1dp.crl", \
  "out/cacrlroot2.crl"


[verify_chain_win\err5]
action = "Sequence"
test = msz:"verify"

[verify_chain_win\err5\verify]
action = "CertChain_Verify_CAPI"
status = "IS_NOT_TIME_VALID"
# r2sin1 <- r2r2si <- s1r2 <- r1s1v
input="out/r2sin1.cer" 
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/s1r2.cer", \
  "out/r2r2si.cer"

#verify_chain ç¥à¥§ CAPI ¤«ï Unix
[verify_chain_unix]
action = "Sequence"
test = msz:"ok", \
  "err2", \
  "err3", \
  "err4", \
  "err5"

[verify_chain_unix\ok]
action = "CertChain_Verify_CAPI"
# r2sin1 <- r2r2si <- s1r2 <- r1s1
input="out/r2sin1.cer" 
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r1s1c.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/r1s1.cer", \
  "out/s1r2.cer", \
  "out/r2r2si.cer"

[verify_chain_unix\err2]
action = "CertChain_Verify_CAPI"
status = "IS_UNTRUSTED_ROOT"
# r2sin1 <- ???
input="out/r2sin1.cer" 
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r1s1c.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/r1s1.cer", \
  "out/s1r2.cer"

[verify_chain_unix\err3]
action = "CertChain_Verify_CAPI"
status = "IS_UNTRUSTED_ROOT"
# r2sin1 <- r2r2si <- ???
input="out/r2sin1.cer" 
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r1s1c.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/r1s1.cer", \
  "out/r2r2si.cer"

[verify_chain_unix\err4]
action = "CertChain_Verify_CAPI"
status = "IS_REVOKED"
# r2sin1 <- r2r2si <- s1r2 <- r1s1c
input="out/r2sin1.cer" 
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r1s1c.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/s1r2.cer", \
  "out/r2r2si.cer"

[verify_chain_unix\err5]
action = "CertChain_Verify_CAPI"
status = "IS_NOT_TIME_VALID"
# r2sin1 <- r2r2si <- s1r2 <- r1s1v
input="out/r2sin1.cer" 
addcert = msz:"out/r2s1.cer", \
  "out/r1s1v.cer", \
  "out/r2sir2si.cer", \
  "out/r2sir2.cer", \
  "out/r2r2.cer", \
  "out/s1r2.cer", \
  "out/r2r2si.cer"

[store_cert_list]
action = "CertStoreList"
store = "system.CA"
# issuer = "GostRoot"
# serial = "0x2f5af8cf7d70f990e9352842975dfdfc"

[store_crl_list]
action = "CrlStoreList"
store = "system.CA"

[store_crl_extract_all]
action = "CrlStoreExtract"
output = "out/"
issuer = "GostRoot"
store = "system.CA"

[store_cert_del]
action = "CertStoreDel"
store = "system.CA"
issuer = "GostRoot"
serial = "0x2f5af8cf7d70f990e9352842975dfdfc"

[cross]
action = "Sequence"
test = msz:"another", \
  "encode_req", \
  "decode_req", \
  "verify_req", \
  "process_req", \
  "decode_rep", \
  "verify_rep", \
  "install"

[cross\another]
action = "Sequence"
test = msz:"gen", \
  "InstRoot", \
  "GenCrl", \
  "InstCrl"

[cross\another\gen]
action = "GenerateRoot"
ProvType="gost94"
cacontainer="\\\\.\\hdimage\\"
subject="E=gostroot@another.ca.ru,C=RU,L=Moscow,O=Another CA,OU=Development,CN=GostRoot"
cacert="out/anotherca.der"
rse_path="\\pkica\\another"
cdp="http://www.another.ca.ru/certs/cacert(1).crl"
#period="0/0/5 0:0:0"
period = "00050000000000"
caname="another ca"

[cross\another\InstRoot]
action = "CertStoreAdd"
input = "out/anotherca.der"
store = "system.Root"

[cross\another\GenCrl]
action = "GenerateCrl"
output="out/anothercacrl.der"
CrlSignatureAlgorithm="1.2.643.2.2.4"
rse_path="\\pkica\\another"

[cross\another\InstCrl]
action = "CrlStoreAdd"
input = "out/anothercacrl.der"
store = "system.CA"

[cross\inst_another]
action = "Sequence"
test = msz:"cert", \
  "..\\another\\InstCrl"

[cross\inst_another\cert]
action="InstallRoot"
cacert="out/anotherca.der"

[cross\encode_req]
action = "CrossReqMessage_EncodeAndSign"
rse_path="\\pkica\\another"
RecipientGeneralName = "dn:E=gostroot@cryptopro.ru,C=RU,L=Moscow,O=OOO Crypto-Pro,OU=Development,CN=GostRoot"
output="out/apkireq.der"

[cross\decode_req]
action = "CertReqMessage_Decode"
input="out/apkireq.der"
output=false

[cross\verify_req]
action = "CertReqMessage_Verify"
input="out/apkireq.der"
rse_path="\\pkica"

[cross\process_req]
action = "CertReqMessage_Process"
input="out/apkireq.der"
output="out/apkirep.der"
rse_path="\\pkica"

[cross\decode_rep]
action = "CertRepMessage_Decode"
input="out/apkirep.der"
output_cert="out/apki.cer"
output=false

[cross\verify_rep]
action = "CertRepMessage_Verify"
input_req="out/apkireq.der"
input_rep="out/apkirep.der"

[cross\install]
action = "CertStoreAdd"
store = "system.Trust"
input = "out/apki.cer"

[error_msg_info]
action = "Sequence"
test = msz:"encode", \
  "decode", \
  "verify"

[error_msg_info\encode]
action = "ErrorMsgInfoEncode"
rse_path = "\\pkica"
PKIstatus = "rejection"
error_code = 17
StatusString=msz:"*:Unknown", \
  "ru-ru:Ðóññêèé òåêñò of StatusString", \
  "en-us:US line of StatusString", \
  "Cy-az-AZ:Azeri (Cyrillic) - Azerbaijan line of StatusString"
ErrorDetails=msz:"ru-ru:Ðóññêèé òåêñò of ErrorDetails", \
  "en-us:Azeri (Cyrillic) line of ErrorDetails", \
  "Cy-az-AZ:Azeri (Cyrillic) - Azerbaijan line of ErrorDetails"
FailureInfo = "badAlg|badMessageCheck|badRequest|badTime|badCertId|"\
    "badDataFormat|wrongAuthority|incorrectData|missingTimeStamp|badPOP"
output = "out/emi.der"
RecipientGeneralName = "dn:C=RU,CN=RecipientGeneralName"

[error_msg_info\decode]
action = "ErrorMsgInfoDecode"
input = "out/emi.der"
output = false

[error_msg_info\verify]
action = "ErrorMsgInfoVerify"
input = "out/emi.der"
pse_path = "\\pkipse\\client1"

[base64]
action = "Sequence"
test = msz:"cert", \
  "crl"

[base64\cert]
action = "Sequence"
test = msz:"encode", \
  "decode"

[base64\cert\encode]
action = "ToBase64"
input = "out/pki.cer"
output = "out/pki.der"
header = "-----BEGIN CERTIFICATE-----"
footer = "-----END CERTIFICATE-----"

[base64\cert\decode]
action = "FromBase64"
input = "out/pki.der"
output = "out/pki.cer.bak"
header = "-----BEGIN CERTIFICATE-----"
footer = "-----END CERTIFICATE-----"

[base64\crl]
action = "Sequence"
test = msz:"encode", \
  "decode"

[base64\crl\encode]
action = "ToBase64"
input = "out/cacrladd.der"
output = "out/cacrl64.crl"
header = "-----BEGIN X509 CRL-----"
footer = "-----END X509 CRL-----"

[base64\crl\decode]
action = "FromBase64"
input = "out/cacrl64.crl"
output = "out/cacrladd.der.bak"
header = "-----BEGIN X509 CRL-----"
footer = "-----END X509 CRL-----"

[update_client]
action = "Sequence"
test = msz:"encode_req", \
  "decode_req", \
  "verify_req", \
  "process_req", \
  "decode_rep", \
  "verify_rep", \
  "decode_cert", \
  "install_cert"

[update_client\encode_req]
action = "CertReqMessage_EncodeAndSign"
RequestType="UpdateKey"
ProvType="gost2001"
input = "out/pki.cer"
output="out/upreq.der"
container="\\\\.\\hdimage\\"
pse_path = "\\pkipse\\client1"
new_pse_path = "\\pkipse\\client1\\update1"
addpath = true

[update_client\decode_req]
action = "CertReqMessage_Decode"
input="out/upreq.der"
output=false

[update_client\verify_req]
action = "CertReqMessage_Verify"
input="out/upreq.der"

[update_client\process_req]
action = "CertReqMessage_Process"
input="out/upreq.der"
output="out/uprep.der"
rse_path="\\pkica"
extensions = msz:"2.5.29.31:<CRLDistPointsSyntax><DistributionPoint><distributionPoint><fullName><uniformResourceIdentifier>"\
	    "http://www.standartcc.ru/certs/cacert(1).crl"\
	    "</uniformResourceIdentifier></fullName></distributionPoint></DistributionPoint></CRLDistPointsSyntax>"

[update_client\decode_rep]
action = "CertRepMessage_Decode"
input="out/uprep.der"
output_cert="out/up.cer"
output=false

[update_client\verify_rep]
action = "CertRepMessage_Verify"
input_req="out/upreq.der"
input_rep="out/uprep.der"

[update_client\decode_cert]
action = "Cert_Decode"
input="out/up.cer"
output=false

[update_client\install_cert]
action = "CertRepMessage_Install"
input_cert="out/up.cer"
pse_path = "\\pkipse\\client1\\update1"

[change_client_passwd]
action = "PasswdClientChange"
pse_path = "\\pkipse\\client1"

[genm]
action = "Sequence"
test = msz:"encode", \
  "verify", \
  "decode"

[genm\encode]
action = "GenMsgContent_EncodeAndSign"
RecipientGeneralName="dn:C=RU,CN=RecipientGeneralName"
output = "out/genm.der"
rse_path = "\\pkica"
sender_nonce=hex:73,65,6e,64,65,72,5f,6e,6f,6e,63,65,00
transactionID=hex:74,72,61,6e,73,61,63,74,69,6f,6e,49,44,00
session=123456
event_counter=654321
msgtype="StartSession"
free=msz:"en-us:English US text", \
  "ru-ru:Ðóññêèé òåêñò", \
  "Cy-az-AZ:Azeri (Cyrillic) - Azerbaijan text", \
  "*:Unspecified code page"

[genm\verify]
action = "CertReqMessage_Verify"
input="out/genm.der"

[genm\decode]
action = "CertReqMessage_Decode"
input="out/genm.der"
output=false

[long_name]
action = "Sequence"
test = msz:"encode", \
  "process_req", \
  "decode_rep"

[long_name\encode]
action = "CertReqMessage_EncodeAndSign"
RequestType="InitialRequest"
ProvType="gost2001"
keyspec=1
pse_path = "\\pkipse\\longname"
container = "\\\\.\\hdimage\\"
RecipientGeneralName="dn:E=gostroot@cryptopro.ru,C=RU,L=Moscow,O=OOO Crypto-Pro,OU=Development,CN=GostRoot"
Subject_EMail="00aaaaaaaa10aaaaaaaa20aaaaaaaa30aaaaaaaa40aaaaaaaa"\
	"50aaaaaaaa60aaaaaaaa70aaaaaaaa80aaaaaaaa90aaaaaaaa"\
	"100aaaaaaa110aaaaaaa120aa128"
Subject_Country="RU"
Subject_Locality="aaaaaaaaaa10aaaaaaaa20aaaaaaaa30aaaaaaaa40aaaaaaaa"\
	"50aaaaaaaa60aaaaaaaa70aaaaaaaa80aaaaaaaa90aaaaaaaa"\
	"100aaaaaaa110aaaaaaa120aa128"
Subject_Organization="aaaaaaaaaa10aaaaaaaa20aaaaaaaa30aaaaaaaa40aaaaaaaa"\
	"50aaaaaaaa6064"
Subject_OrgUnit="aaaaaaaaaa10aaaaaaaa20aaaaaaaa30aaaaaaaa40aaaaaaaa"\
	"50aaaaaaaa6064"
Subject_Title="aaaaaaaaaa10aaaaaaaa20aaaaaaaa30aaaaaaaa40aaaaaaaa"\
	"50aaaaaaaa6064"
Subject_GivenName="00aaaaaaaa10aa16"
Subject_Initials="aaaa5"
Subject_Surname="aaaaaaaaaa10aaaaaaaa20aaaaaaaa30aaaaaa40"
Subject_Pseudonym="aaaaaaaaaa10aaaaaaaa20aaaaaaaa30aaaaaaaa40aaaaaaaa"\
	"50aaaaaaaa60aaaaaaaa70aaaaaaaa80aaaaaaaa90aaaaaaaa"\
	"100aaaaaaa110aaaaaaa120aa128"
Subject_CommonName="aaaaaaaaaa10aaaaaaaa20aaaaaaaa30aaaaaaaa40aaaaaaaa"\
	"50aaaaaaaa6064"
output="out/long_req.der"

[long_name\process_req]
action = "CertReqMessage_Process"
input="out/long_req.der"
output="out/long_rep.der"
rse_path="\\pkica"

[long_name\decode_rep]
action = "CertRepMessage_Decode"
input="out/long_rep.der"
output_cert="out/long.cer"
output=false

[clean]
action = "Sequence"
test = msz:"root", \
  "another", \
  "root1", \
  "root2", \
  "sub1", \
  "node1"

[clean\root]
action = "Sequence"
test = msz:"root", \
  "my", \
  "ra", \
  "trust", \
  "crl"

[clean\root\root]
action = "CertStoreDel"
store = "system.Root"
issuer = "E=gostroot@cryptopro.ru, C=RU, L=Moscow, O=OOO Crypto-Pro, OU=Development, CN=GostRoot"

[clean\root\my]
action = "CertStoreDel"
store = "user.My"
issuer = "E=gostroot@cryptopro.ru, C=RU, L=Moscow, O=OOO Crypto-Pro, OU=Development, CN=GostRoot"

[clean\root\ra]
action = "CertStoreDel"
store = "system.RA"
issuer = "E=gostroot@cryptopro.ru, C=RU, L=Moscow, O=OOO Crypto-Pro, OU=Development, CN=GostRoot"

[clean\root\trust]
action = "CertStoreDel"
store = "system.Trust"
issuer = "E=gostroot@cryptopro.ru, C=RU, L=Moscow, O=OOO Crypto-Pro, OU=Development, CN=GostRoot"

[clean\root\crl]
action = "CrlStoreDel"
store = "system.CA"
issuer = "E=gostroot@cryptopro.ru, C=RU, L=Moscow, O=OOO Crypto-Pro, OU=Development, CN=GostRoot"

[clean\another]
action = "Sequence"
test = msz:"root", \
  "my", \
  "Trust", \
  "crl"

[clean\another\root]
action = "CertStoreDel"
store = "system.Root"
issuer = "E=gostroot@another.ca.ru, C=RU, L=Moscow, O=Another CA, OU=Development, CN=GostRoot"

[clean\another\my]
action = "CertStoreDel"
store = "user.My"
issuer = "E=gostroot@another.ca.ru, C=RU, L=Moscow, O=Another CA, OU=Development, CN=GostRoot"

[clean\another\Trust]
action = "CertStoreDel"
store = "system.Trust"
issuer = "E=gostroot@another.ca.ru, C=RU, L=Moscow, O=Another CA, OU=Development, CN=GostRoot"

[clean\another\crl]
action = "CrlStoreDel"
store = "system.CA"
issuer = "E=gostroot@another.ca.ru, C=RU, L=Moscow, O=Another CA, OU=Development, CN=GostRoot"

[clean\root1]
action = "Sequence"
test = msz:"root", \
  "my", \
  "crl", \
  "ca"

[clean\root1\root]
action = "CertStoreDel"
store = "system.Root"
issuer = "E=root1@cryptopro.ru, C=RU, O=Root1, CN=Root1"

[clean\root1\my]
action = "CertStoreDel"
store = "user.My"
issuer = "E=root1@cryptopro.ru, C=RU, O=Root1, CN=Root1"

[clean\root1\crl]
action = "CrlStoreDel"
store = "system.CA"
issuer = "E=root1@cryptopro.ru, C=RU, O=Root1, CN=Root1"

[clean\root1\ca]
action = "CertStoreDel"
store = "system.CA"
issuer = "E=root1@cryptopro.ru, C=RU, O=Root1, CN=Root1"

[clean\root2]
action = "Sequence"
test = msz:"root", \
  "my", \
  "ca", \
  "crl"

[clean\root2\root]
action = "CertStoreDel"
store = "system.Root"
issuer = "E=root2@cryptopro.ru, C=RU, O=Root2, CN=Root2"

[clean\root2\my]
action = "CertStoreDel"
store = "user.My"
issuer = "E=root2@cryptopro.ru, C=RU, O=Root2, CN=Root2"

[clean\root2\ca]
action = "CertStoreDel"
store = "system.CA"
issuer = "E=root2@cryptopro.ru, C=RU, O=Root2, CN=Root2"

[clean\root2\crl]
action = "CrlStoreDel"
issuer = "E=root2@cryptopro.ru, C=RU, O=Root2, CN=Root2"

[clean\sub1]
action = "Sequence"
test = msz:"ca", \
  "request", \
  "crl"

[clean\sub1\ca]
action = "CertStoreDel"
store = "system.CA"
issuer = "C=RU, O=Root1, OU=Sub1, CN=Sub1"

[clean\sub1\request]
action = "CertStoreDel"
store = "user.Request"
issuer = "C=RU, O=Root1, OU=Sub1, CN=Sub1"

[clean\sub1\crl]
action = "CrlStoreDel"
issuer = "C=RU, O=Root1, OU=Sub1, CN=Sub1"

[clean\node1]
action = "Sequence"
test = msz:"request"

[clean\node1\request]
action = "CertStoreDel"
store = "user.Request"
subject = "C=RU, O=Root2, CN=Node1"


