CA Controller Test Client

Exercises the CA Controller API at https://dev-wallet.pts.se:18030/api/v1. Left column drives the ordinary API endpoints; right column runs fault tests that engineer specific failure paths on the CA Controller.

Get access certificate

GET /get-access-certificate?orgid=…&sid=…[&serial=…][&full_chain=true] — omit the serial to fetch the newest active cert. Tick Full chain to receive the leaf followed by the issuing CA's chain (leaf first, root last).

Issue access certificate

POST /issue-access-certificate — a fresh EC P-256 key pair is generated server-side; only the public side is sent to the CA Controller.

Revoke access certificate

POST /revoke-access-certificate — call status first to get the serial and ca for the certificate you want to revoke.

Get registration certificate

GET /get-registration-certificate?orgid=…&sid=…

Get registration-cert status list

GET /registration-certificate-status — the signed Token Status List every issued WRPRC's status.status_list.uri claim points at. Media type application/statuslist+jwt, no parameters, public endpoint.

Get certificate status

GET /get-certificate-status?orgid=…&sid=…

Notification sent

POST /notification-sent — copy the serial and ca from a prior status call. Marks alertNotifiedAt on the row; expected 204 on success.

List services for organization

GET /services?orgid=… — landing-page fodder for the RP portal.

List pending alerts

GET /pending-alerts — the notifier's poll target. No parameters; returns every alert with alertNotifiedAt still null.

Certificate Management App

Opens the RP portal in a new tab as the selected organization by calling /test/impersonate?orgid=…&orgname=…. The orgname parameter mirrors what a bearer-token display-name claim will carry once real auth is wired up.

Fault tests

Each row engineers a specific failure path on the CA Controller. All tests are state-safe — nothing is issued or revoked.

Multi-source key input

Populates two or three of pkcs10, x5c, jwk at once, each with a different fresh key. Exercises the shape check that must run before any crypto.

Expected: HTTP 400, code=invalid_request

Malformed key material

Generates a valid PKCS#10 or self-signed certificate, then either truncates the last 16 bytes or flips the last byte. Exercises the resolver's DER-parse or signature-verification failure path.

Expected: HTTP 422, code=invalid_key_material

Broken PKCS#10 proof of possession

Sends a PKCS#10 whose SubjectPublicKeyInfo holds key A but whose outer signature was computed with key B. Isolates the POP-check failure path from a DER-parse failure — same status, different code path.

Expected: HTTP 422, code=invalid_key_material (POP failure)

Key algorithm outside policy

Sends a valid PKCS#10 signed by an RSA-1024 / RSA-2048 / Ed25519 key — all below policy or outside the accepted algorithm set. Exercises the policy validator's rejection path (the request is well-formed and its POP is valid).

Expected: HTTP 422, code=unsupported_key_algorithm

Public key already used

Silently reads the newest active certificate for the selected service, extracts its public key, and submits an issuance request reusing that key (as JWK, since the private key is not retained). Requires at least one active certificate on the service — otherwise the test is skipped with an alert above this row.

Expected — depends on ca-controller.prohibit-duplicate-keys: when true, HTTP 409 with code=key_already_has_certificate; when false, a normal HTTP 201 with a newly-issued access certificate.