browsec/trustlab/fixtures/tls.js

export const validPublicCertificate = {
  connectionId: "connection-valid-public",
  hostname: "example.test",
  port: 443,
  validation: "success",
  errors: [],
  presentedChain: [
    leaf("CN=example.test", "leaf-valid-public"),
    ca("CN=Example Intermediate", "intermediate-public"),
  ],
  constructedChain: [
    leaf("CN=example.test", "leaf-valid-public"),
    ca("CN=Example Intermediate", "intermediate-public"),
    ca("CN=Example Root", "root-public", { selfSigned: true }),
  ],
  tls: { version: "TLSv1.3", alpn: "h2" },
};

export const unknownLocalAuthority = {
  connectionId: "connection-unknown-local",
  hostname: "library.village",
  port: 443,
  validation: "failure",
  errors: ["unknown-issuer"],
  failure: {
    code: "unknown-issuer",
    certificateSha256: "ca-village-services",
    check: "trust-anchor",
    summary: "The candidate authority is not trusted by the current Firefox policy.",
  },
  presentedChain: [
    leaf("CN=library.village", "leaf-village-library"),
    ca("CN=Village Services CA", "ca-village-services", { selfSigned: true }),
  ],
  constructedChain: [
    leaf("CN=library.village", "leaf-village-library"),
    ca("CN=Village Services CA", "ca-village-services", { selfSigned: true }),
  ],
  tls: { version: "TLSv1.3", alpn: "h2" },
};

export const expiredLeafCertificate = {
  connectionId: "connection-expired-leaf",
  hostname: "archive.village",
  port: 443,
  validation: "failure",
  errors: ["expired"],
  failure: {
    code: "expired",
    certificateSha256: "leaf-expired-archive",
    check: "validity",
    summary: "The server certificate expired 46 days ago.",
  },
  presentedChain: [
    leaf("CN=archive.village", "leaf-expired-archive", {
      validFrom: "2025-06-01T00:00:00Z",
      validUntil: "2026-07-01T00:00:00Z",
    }),
    ca("CN=Village Public Services CA", "ca-village-public"),
  ],
  constructedChain: [
    leaf("CN=archive.village", "leaf-expired-archive", {
      validFrom: "2025-06-01T00:00:00Z",
      validUntil: "2026-07-01T00:00:00Z",
    }),
    ca("CN=Village Public Services CA", "ca-village-public"),
    ca("CN=Regional Root CA", "root-regional", { selfSigned: true }),
  ],
  tls: { version: "TLSv1.3", alpn: "h2" },
};

export const hostnameMismatch = {
  connectionId: "connection-hostname-mismatch",
  hostname: "records.village",
  port: 443,
  validation: "failure",
  errors: ["hostname-mismatch"],
  failure: {
    code: "hostname-mismatch",
    certificateSha256: "leaf-wrong-host",
    check: "identity",
    summary: "The certificate identifies files.village, not records.village.",
  },
  presentedChain: [
    leaf("CN=files.village", "leaf-wrong-host", {
      dnsNames: ["files.village"],
    }),
    ca("CN=Village Public Services CA", "ca-village-public"),
  ],
  constructedChain: [
    leaf("CN=files.village", "leaf-wrong-host", {
      dnsNames: ["files.village"],
    }),
    ca("CN=Village Public Services CA", "ca-village-public"),
    ca("CN=Regional Root CA", "root-regional", { selfSigned: true }),
  ],
  tls: { version: "TLSv1.3", alpn: "h2" },
};

export const explicitlyDistrustedAuthority = {
  connectionId: "connection-distrusted-authority",
  hostname: "registry.example",
  port: 443,
  validation: "failure",
  errors: ["explicitly-distrusted-authority"],
  failure: {
    code: "explicitly-distrusted-authority",
    certificateSha256: "root-distrusted",
    check: "local-policy",
    summary: "A local Browsec rule explicitly distrusts this root authority.",
  },
  presentedChain: [
    leaf("CN=registry.example", "leaf-registry"),
    ca("CN=Commercial Issuing CA", "ca-commercial-issuing"),
  ],
  constructedChain: [
    leaf("CN=registry.example", "leaf-registry"),
    ca("CN=Commercial Issuing CA", "ca-commercial-issuing"),
    ca("CN=Globally Trusted but Locally Rejected Root", "root-distrusted", {
      selfSigned: true,
    }),
  ],
  tls: { version: "TLSv1.3", alpn: "h2" },
};

export const conflictingCommunityAdvice = {
  ...unknownLocalAuthority,
  connectionId: "connection-conflicting-community-advice",
};

function leaf(subject, sha256, extra = {}) {
  return {
    subject,
    sha256,
    isCa: false,
    keyUsages: ["digitalSignature", "keyEncipherment"],
    selfSigned: false,
    ...extra,
  };
}

function ca(subject, sha256, extra = {}) {
  return {
    subject,
    sha256,
    isCa: true,
    keyUsages: ["keyCertSign", "crlSign"],
    selfSigned: false,
    ...extra,
  };
}