Certificate Management Test

Manage KeyStore left navigation menu item availability

• Login to AdminGUI and click on Certificate Management from left navigation panel

• Manage KeyStore menu item should appear under Certificate Management

Verify Manage KeyStore page displays with list of all the available KeyStores from the CONNECT configuration

• Select Certificate Management → Manage KeyStore from the left navigation panel

Manage KeyStore tab will show as below:

• KeyStore location from the CONNECT configuration

• List of available KeyStores from the CONNECT configuration with below table values:

  • Alias: Name given to the CA certificate

  • Algorithm: Indicates cryptographic algorithm that are used for creating key pairs and performing digital signature operations (e. x. RSA)

  • Key Size: Defines length of the key used by algorithm

  • Expiration Date: Displays certificate expiration date. 

    • Green: Indicates valid > 90 days

    • Red: Indicates expired

    • Yellow: Indicates expiring soon < 90 days

  • Subject Key Identifier (SKI):  Hash value of the SSL certificate used to identify certificates that contain a particular public key

  • Authority Key Identifier (AKI): Key identifier of the issuing CA certificate that signed the SSL certificate. This value would match the SKI value of the intermediate CA certificate

• 'View Certificate' button enabled

Using Keytool or KeyStore Explorer application verify list of certificates from KeyStore match with the list displayed in Manage KeyStore tab 

• Open KeyStore file from the CONNECT configuration

• List of certificates in the KeyStore file will match with the list displayed in Manage KeyStore tab

View certificate details

• Manage KeyStore tab → Select a record from the Keystore list table and click <View Certificate>

• User must see a non editable child window with all the certificate details for the selected record

Verify record selection validation

• Manage KeyStore tab → Do not select any record from Keystore list table and click <View Certificate>

• "Please choose a certificate to view details" message will appear

Manage TrustStore left navigation menu item availability

• Login to AdminGUI and click on Certificate Manager from left navigation panel

• Manage TrustStore menu item should appear under Certificate Manager

Verify Manage TrustStore page displays with list of all the available TrustStores from the CONNECT configuration

• Select Certificate Manager → Manage TrustStore from the left navigation panel

Manage TrustStore tab will show as below:

• TrustStore (cacerts.jks) location from the CONNECT configuration

• List of available TrustStores from the CONNECT configuration with below table values:

  • Alias: Name given to the CA certificate

  • Algorithm: Indicates cryptographic algorithm that are used for creating key pairs and performing digital signature operations (e. x. RSA)

  • Key Size: Defines length of the key used by algorithm

  • Expiration Date: Displays certificate expiration date

    • Green: Indicates valid > 90 days

    • Red: Indicates expired

    • Yellow: Indicates expiring soon < 90 days

  • Subject Key Identifier (SKI):  Hash value of the SSL certificate used to identify certificates that contain a particular public key.

  • Authority Key Identifier (AKI): Key identifier of the issuing CA certificate that signed the SSL certificate. This value would match the SKI value of the intermediate CA certificate.

• 'Delete', 'Import' , 'View', 'Refresh' and 'View Chain of Trust' buttons enabled

Using Keytool or KeyStore Explorer application verify list of certificates from cacerts.jks match with the list displayed in Manage TrustStore tab 

• Open cacerts.jks file from the CONNECT configuration

• List of certificates in the cacerts.jks file must match with the list displayed in Manage TrustStore tab

Verify record selection validation

• Manage TrustStore tab → Do not select any record from Truststore list table and click <View>

• "Please choose a certificate to view details" message will appear

View certificate details

• Manage TrustStore tab → Select a record from the Truststore list table and click <View>

• User must see a non editable child window with all the certificate details for the selected record

Verify certificate alias editable

• Manage TrustStore tab → Select a record from the Truststore list table and click <View>

• Edit Alias name to desired name and click <Update Certificate>

• Selected record/certificate alias name updated per user input. 

• Note: To cross verify open certificate (i.e. cacerts.jks) using Keytool or KeyStore Explorer application and user should see updated alias name for selected record/certificate

Delete certificate from the TrustStore list (i.e. cacerts.jks)

• Manage TrustStore tab → Select a record from the Truststore list table and click <Delete>

• Delete confirmation popup window will display with message "Are you sure you want to delete the selected certificate ?" with Yes, No buttons

Results as below:

• Yes:

  •  User required to enter TrustStore Credentials, i.e. TrustStore password and click <OK>

  • Selected certificate deleted from the TrustStore list and user navigated back to Manage TrustStore tab.

•  No:

  •  Record not deleted and user navigated back to Manage TrustStore tab

Verify user not allowed to delete server's public certificate

• Manage TrustStore tab → Select server's  public certificate from the Truststore list table and click <Delete>

• Delete confirmation popup window will display with message "Are you sure you want to delete the selected certificate ?" with Yes, No buttons

Results as below:

• Yes :

  •  User required to enter TrustStore Credentials, i.e. TrustStore password and click <OK>

  • "System cannot remove its own public certificate" message will appear. Click <Cancel> button to navigate back to Manage TrustStore tab.

•  No

  •  Record not deleted and user navigated back to Manage TrustStore tab

Verify user allowed to import any certificate (i.e. root certificate, intermediate certificate, server leaf certificate)  into truststore only (i.e. cacerts.jks)

• Manage TrustStore tab → Click <Import> 

• User navigated to Import Certificate popup window

• Click <Choose> and select desired certificate for import

• Desired certificate selected for import

• Click <Upload> to upload the selected certificate

• Successfully uploaded selected certificate

• Click on record's 'Alias' column and update desired name

• Successfully update the Alias name for newly uploaded certificate

• If Alias name not updated on click of <Import> an UI error message will display "Enter an alias for the certificate"

• Optional: Select <Refresh Services Cache> checkbox. (Note: Not necessary for new exchange, but when replacing certificate for an existing exchange it is recommended to select this box. It is because CONNECT caches and reuses web-services ports. When the ports are created, they are bind to a specific certificate. Importing a new certificate and trying to use it will result in error if user has not refreshed the ports.)

• Able to select Refresh Services Cache checkbox

  • Note: This is back-end or server-side refresh, hence will not be able to verify the step except selection

• Click <Import> for certificate to import into truststore (i..e cacert.jks)

• UI error message will display "Select certificate for import"

• Choose the record and click <Import> for certificate to import into truststore (i..e cacert.jks)

• User navigated to TrustStore Credentials popup window to enter Truststore password

• Enter Truststore password in TrustStore Credentials popup window and click <OK>

• If user enter an existing alias name then an UI error message will display " Alias already in use in Truststore" otherwise selected certificate successfully imported into truststore (i.e. cacerts.jks) and user navigated to Manage TrustStore tab.

• User must see newly uploaded certificate under Truststore list

• When user see "Alias already in use in Truststore" UI error message:

  • Update alias name to unique name (i.e. not already used in Truststore) and click <Import>

  • Enter password in TrustStore Credentials popup window and click <OK>

• Selected certificate successfully imported into truststore and user navigated to Manage TrustStore tab.

• User must see newly uploaded certificate under TrustStore list

Verify Refresh functionality

• To test this feature it is required to modify truststore (i.e. cacerts.jks) from the CONNECT server configuration not via AdminGUI UI. 

• Using Keytool or KeyStore Explorer application open truststore certificate from CONNECT server configuration

• Import a trusted certificate that is not present in truststore (i.e. cacerts.jks)

  • Keytool → Tools → Import Trusted Certificate → choose desired certificate and click <Open>

  • New certificate will be imported into truststore.

  • Click Save icon in Keytool application

  • Without restarting server click <Refresh> button in Manage TrustStore tab

• Newly imported certificate must be present under TrustStore list

• Follow above steps to open truststore from CONNECT server configuration and delete an existing certificate from truststore 

• Click Save icon in Keytool application

• Without restarting server click <Refresh> button in Manage TrustStore tab

• Deleted certificate must not be present under TrustStore list 

View Chain of Trust record selection validation

• Manage TrustStore tab → Do not select any record from Truststore list table and click <View Chain of Trust>

• "Please choose a certificate to view chain" message will appear

Verify View Chain of Trust functionality

• Manage TrustStore tab → Select a record from the Truststore list table and click <View Chain of Trust>

• User navigated to Chain of Trust view popup window which shows detailed certificate information for the selected record

• Manage TrustStore tab → Select an intermediate certificate from the Truststore list table and click <View Chain of Trust>

  • Note: Make sure CA root , CA intermediate imported into truststore for the selected intermediate certificate

• User navigated to a Chain of Trust view popup window which lists associated root, intermediate certificate details for the selected record.  Note: This feature helps user to view associated chain of trust certificates at single place when multiple certificates are present

• Manage TrustStore tab → Select a server or leaf certificate from the Truststore list table and click  <View Chain of Trust>

• User navigated to a Chain of Trust view popup window and results as below: 

  • If root, intermediate certificates imported into Manage TrustStore for the selected server certificate then Chain of Trust window lists associated leaf, root, intermediate certificate details for the selected record.

  • If root, intermediate did not imported into Manage TrustStore for the selected server or leaf certificate then Chain of Trust window show certificate details with UI error: "A Parent certificate is missing. Import all certificates in the trust chain and restart server"

Import Wizard left navigation menu item availability

• Login into AdminGUI and click on Certificate Manager from left navigation panel

• Import Wizard menu item should appear under Certificate Manager

Verify below on Start tab:

• Static text

• Clickable below 3 links

  • Create a new Certificate

  • Generate CSR for an existing Certificate

  • Import SSL Certificate(s)

• Select Certificate Manager → Import Wizard from the left navigation panel

Start tab will show below:

• Static text as below:

  Open

  

• Clickable below 3 links:

  • Create a new Certificate

  • Generate CSR for an existing Certificate

  • Import SSL Certificate(s)

• On server restart, Select Certificate Manager → Import Wizard  and click directly on Create CSR link.

User should be able to create a CSR.

• On server restart, Select Certificate Manager → Import Wizard  and click directly on Import SSL Certificate(s).

User should be able to go to Import SSL Certificate(s) tab. 

Verify tabs enable / disable functionality

• Select Certificate Manager → Import Wizard

• On page load only Start tab is enabled. Rest of the tabs must be disabled.

• Import Wizard → Start tab and click on any of the below links and verify tabs navigation and enable / disable functionality. 

  • Create a New Certificate 

  • Generate CSR for an existing Certificate 

  • Import SSL Certificate(s)

• When click on:

  • "Create a New Certificate" link

    • Only Start , Create Certificate tabs enabled and user navigated to Create Certificate tab

  • "Generate CSR for an existing Certificate" link

    • Only Start, Certificate Signing Request tabs enabled and user navigated to Certificate Signing Request tab

  • "Import SSL Certificate(s)" link

    • Only Start, Import SSL Certificates tabs enabled and user navigated to Import SSL Certificates tab

Visually verify Create Certificate default screen display

• Click on Create a New Certificate link

• Create Certificate  tab default view as below:

Open

• A temporary folder (importWizard/temp) must be created under CONNECT server configuration folder.  Existing KeyStore (i.e. gateway.jks) backup must be created under this temporary folder.

Required filed validation

• Do not provide any values and click <Create>

UI errors must be present as below:

Open

Verify Exchange drop down functionality 

• Select any value from Exchange drop down

• Below field values must be pre-populated

  • Organizational Unit(OU)

  • Organization(O)

  • County Name (C)

Verify updates in caauthority.properties file reflect  Exchange drop down 

• Update one of the exchange drop down pre-populated values in caauthority.properties and save file.

  • Ex: Health.Exchange.Valiation=NHIN-test\,nhin\,US        <<To>> 

  • e.Health.Exchange.Valiation=CONNECT-test\,CONNECT\,US

• Updated values must be pre-populated for selected exchange

Verify Create Certificate cancel functionality

• Enter data in all the required fields and click <Cancel>

• Cancel Import Wizard popup window display with " WARNING: This will clean up the file created by wizard. Continue delete ?"

  • Yes:  Must delete backup keystore file and temp folder from the importWizard folder which is under CONNECT server configuration

  • No: Must navigate back to Create Certificate screen

Verify Create Certificate functionality

• Continue with previously entered form data and click <Create>

• Below UI messages will display:

  • Successfully created certificate for: <<certificatename>>

  • Successfully created CSR for: <<certificatename>>

• <Next> button is enabled

Verify Certificate validity, key size and signature algorithm for newly created certificate

• Open newly created certificate (under //importWizard/temp) using Keytool or KeyStore Explorer applications. Right click on certificate → View Details → Certificate Chain Details

• Certificate must be valid

• Certificate signature algorithm must be (SHA256withRSA)

• Certificate publlic key size must be RSA 2048 bit

Verify navigation from Create Certificate page

• Once the certificate created successfully Next button is enabled. Click <Next>

• User navigated to Certificate Signing Request Tab

• If AdminGUI session expired after certificate creation, then re login into application. From Start tab click on ' Generate CSR for an existing Certificate' link