Expand TrustLab certificate failure scenarios

2026-08-16 16:27:20 +04:00
1 parent 9830f444ac
commit f1fcef9b85
@@ -22,6 +22,12 @@ export const unknownLocalAuthority = {
  port: 443,
  validation: "failure",
  errors: ["unknown-issuer"],
+  failure: {
+    code: "unknown-issuer",
+    certificateSha256: "ca-village-services",
+    check: "trust-anchor",
+    summary: "The candidate authority is not trusted by the current Firefox policy.",
+  },
  presentedChain: [
    { subject: "CN=library.village", sha256: "leaf-village-library" },
    { subject: "CN=Village Services CA", sha256: "ca-village-services" },
@@ -33,3 +39,97 @@ export const unknownLocalAuthority = {
  tls: { version: "TLSv1.3", alpn: "h2" },
 };

+export const expiredLeafCertificate = {
+  connectionId: "connection-expired-leaf",
+  hostname: "archive.village",
+  port: 443,
+  validation: "failure",
+  errors: ["expired"],
+  failure: {
+    code: "expired",
+    certificateSha256: "leaf-expired-archive",
+    check: "validity",
+    summary: "The server certificate expired 46 days ago.",
+  },
+  presentedChain: [
+    {
+      subject: "CN=archive.village",
+      sha256: "leaf-expired-archive",
+      validFrom: "2025-06-01T00:00:00Z",
+      validUntil: "2026-07-01T00:00:00Z",
+    },
+    { subject: "CN=Village Public Services CA", sha256: "ca-village-public" },
+  ],
+  constructedChain: [
+    {
+      subject: "CN=archive.village",
+      sha256: "leaf-expired-archive",
+      validFrom: "2025-06-01T00:00:00Z",
+      validUntil: "2026-07-01T00:00:00Z",
+    },
+    { subject: "CN=Village Public Services CA", sha256: "ca-village-public" },
+    { subject: "CN=Regional Root CA", sha256: "root-regional" },
+  ],
+  tls: { version: "TLSv1.3", alpn: "h2" },
+};
+
+export const hostnameMismatch = {
+  connectionId: "connection-hostname-mismatch",
+  hostname: "records.village",
+  port: 443,
+  validation: "failure",
+  errors: ["hostname-mismatch"],
+  failure: {
+    code: "hostname-mismatch",
+    certificateSha256: "leaf-wrong-host",
+    check: "identity",
+    summary: "The certificate identifies files.village, not records.village.",
+  },
+  presentedChain: [
+    {
+      subject: "CN=files.village",
+      sha256: "leaf-wrong-host",
+      dnsNames: ["files.village"],
+    },
+    { subject: "CN=Village Public Services CA", sha256: "ca-village-public" },
+  ],
+  constructedChain: [
+    {
+      subject: "CN=files.village",
+      sha256: "leaf-wrong-host",
+      dnsNames: ["files.village"],
+    },
+    { subject: "CN=Village Public Services CA", sha256: "ca-village-public" },
+    { subject: "CN=Regional Root CA", sha256: "root-regional" },
+  ],
+  tls: { version: "TLSv1.3", alpn: "h2" },
+};
+
+export const explicitlyDistrustedAuthority = {
+  connectionId: "connection-distrusted-authority",
+  hostname: "registry.example",
+  port: 443,
+  validation: "failure",
+  errors: ["explicitly-distrusted-authority"],
+  failure: {
+    code: "explicitly-distrusted-authority",
+    certificateSha256: "root-distrusted",
+    check: "local-policy",
+    summary: "A local Browsec rule explicitly distrusts this root authority.",
+  },
+  presentedChain: [
+    { subject: "CN=registry.example", sha256: "leaf-registry" },
+    { subject: "CN=Commercial Issuing CA", sha256: "ca-commercial-issuing" },
+  ],
+  constructedChain: [
+    { subject: "CN=registry.example", sha256: "leaf-registry" },
+    { subject: "CN=Commercial Issuing CA", sha256: "ca-commercial-issuing" },
+    { subject: "CN=Globally Trusted but Locally Rejected Root", sha256: "root-distrusted" },
+  ],
+  tls: { version: "TLSv1.3", alpn: "h2" },
+};
+
+export const conflictingCommunityAdvice = {
+  ...unknownLocalAuthority,
+  connectionId: "connection-conflicting-community-advice",
+};