test for SHA1 CAs

sha1-validation/Program.cs

@@ -0,0 +1,47 @@
+using System.Net.Security;
+using System.Security.Cryptography.X509Certificates;
+
+bool sha1RsaSignatureOnLastElementInChain = false;
+
+HttpClientHandler handler = new HttpClientHandler { 
+    CheckCertificateRevocationList = true,
+    ServerCertificateCustomValidationCallback = ServerCertificateCustomValidation, 
+};
+
+using HttpClient client = new HttpClient(handler);
+
+try
+{
+    HttpResponseMessage response = await client.GetAsync("https://redhat.com");
+
+    string responseBody = await response.Content.ReadAsStringAsync();
+    Console.WriteLine($"{sha1RsaSignatureOnLastElementInChain}");
+    Console.WriteLine("PASS");
+    return 0;
+}
+catch (Exception e)
+{
+    Console.WriteLine("\nException Caught!");
+    Console.WriteLine(e);
+}
+
+Console.WriteLine("FAIL");
+return 1;
+
+bool ServerCertificateCustomValidation(HttpRequestMessage requestMessage, X509Certificate2? certificate, X509Chain? chain, SslPolicyErrors sslErrors)
+{
+    foreach (var element in chain!.ChainElements)
+    {
+        var cert = element.Certificate;
+        Console.WriteLine($"{cert.SubjectName.Name} {cert.SignatureAlgorithm.FriendlyName}");
+    }
+    if ( chain.ChainElements.Last().Certificate.SignatureAlgorithm.FriendlyName != "sha1RSA" )
+    {
+        sha1RsaSignatureOnLastElementInChain = true;
+        Console.WriteLine("The certificate chain that is validated is no longer using an RSA1 signature.");
+        Console.WriteLine("The test must be updated to use a different host.");
+    }
+
+    Console.WriteLine($"Errors: {sslErrors}");
+    return sslErrors == SslPolicyErrors.None;
+}

sha1-validation/test.json

@@ -0,0 +1,15 @@
+{
+    "name": "sha1-validation",
+    "enabled": true,
+    "requiresSdk": true,
+    "version": "6.0",
+    "versionSpecific": false,
+    "type": "bash",
+    "cleanup": true,
+    "skipWhen": [
+      "os=rhel.9,version=7", // Test fails on RHEL9 with .NET 7: https://issues.redhat.com/browse/RHEL-25254
+      "os=centos.9,version=7", // Test fails on RHEL9 with .NET 7: https://issues.redhat.com/browse/RHEL-25254
+    ],
+    "ignoredRIDs":[
+    ]
+}

sha1-validation/test.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+IFS=$'\n\t'
+
+dotnet run

sha1-validation/tests.csproj

@@ -0,0 +1,10 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>$(TestTargetFramework)</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+
+</Project>