ItsSecurity_TestCases.ttcn3

                log("*** " & testcasename() & ": PASS: Certificate has a valid rectangular region restrictions ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
            } else {
                log("*** " & testcasename() & ": PASS: Certificate doesn't have any location restrictions ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
            }
            
            // Postamble
            f_poNeighbour();
            f_cf01Down();
            
        } // End of testcase TC_SEC_SND_CERT_06_01
        
        /**
         * @desc Check Identified Region:
         * Must contain value that correspond to numeric country codes as defined in ISO 3166-1
         * Subordinate certificate restrictions must be a subset of the issuing certificate restrictions  
         * <pre>
         * Pics Selection: PIC_UseIdentifiedRegion, PIC_UseISO31661RegionDictionary
         * Config Id: CF01
         * with {
         *   the IUT being in the 'authorized' state
         *   the IUT being requested to include certificate chain in the next CAM
         * } ensure that {
         *    when {
         *     the IUT is requested to send a CAM
         *   } then {
         *     the IUT sends a SecuredMessage
         *       containing header_fields['signer_info'].signer {
         *         containing type
         *           indicating 'certificate_chain'
         *         containing certificates
         *           indicating CERTIFICATES {
         *             containing CERTIFICATES[0] {
         *               containing validity_restrictions['region'] {
         *                 containing region_type
         *                   indicating 'id'
         *                 containing id_region {
         *                   containing region_dictionary
         *                     indicating 'iso_3166_1' (0)
         *                   containing region_identifier
         *                     indicating valid value according to 'iso_3166_1'
         *                   containing local_region
         * 
         *                 }
         *             }
         *             containing CERTIFICATES[n] (1..N) {
         *               containing no validity restriction of type region or validity_restrictions['region'] {
         *                 containing region_type
         *                   indicating 'id'
         *                 containing id_region 
         *                   containing region_dictionary
         *                     indicating 'iso_3166_1' (0)
         *                   containing region_identifier
         *                     indicating CERTIFICATES[n-1].validity_restrictions['region'].id_region.region_identifier
         *                   containing local_region
         *                     indicating CERTIFICATES[n-1].validity_restrictions['region'].id_region.local_region
         *                       or any value if CERTIFICATES[n-1].validity_restrictions['region'].id_region.local_region == 0
         *                 }
         *               }
         *             }
         *           }
         *       }
         *   }
         * }
         * </pre>
         * @reference ETSI TS 103 097 V1.1.14, clauses 4.2.27
         */
        testcase TC_SEC_SND_CERT_06_02() runs on ItsGeoNetworking system ItsSecSystem {
            var CertificateChain         v_chain;
            var ValidityRestriction v_vr, v_vri;  // current and issuing cert validity restrictions
            var boolean f_vr, f_vri;
            
            // Test component configuration
            f_cf01Up();
            
            // Preamble
            f_prNeighbour();
            f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
            
            // Test Body
            log("*** " & testcasename() & ": INFO: Request and waiting for the message containing certificate chain  ***");
            tc_ac.start;
            if (f_askAndWaitForCertificateChain(v_chain, f_generateDefaultCam())) {
                log("*** " & testcasename() & ": INCONC: Expected message not received ***");
                f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_timeout);
            }
            tc_ac.stop;
            f_vr := false;
            for (var integer v_counter := 0; v_counter < lengthof(v_chain); v_counter := v_counter + 1) {
                v_vri := v_vr;
                f_vri := f_vr;
                f_vr := f_getCertificateValidityRestriction(v_chain[v_counter], e_region, v_vr);
                
                if (f_vr) {
                    if (v_vr.validity.region.region_type == e_id) {
                        if (not match (v_vr.validity.region, mw_geographicRegion_identified(mw_identifiedRegion_iso3166_any))) {
                            log("*** " & testcasename() & ": FAIL: Identified region is not conformed to ISO 3166-1 ***");
                            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                        }
                    }
                    
                    if (f_vri) {
                        // the region code must be the same
                        if (v_vr.validity.region.region.id_region.region_identifier !=
                           v_vri.validity.region.region.id_region.region_identifier) {
                            log("*** " & testcasename() & ": FAIL: Certificate validity restriction identified region in cert " & int2str(v_counter) & " is not the same as in the issuing one ***");
                            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                        }
                        if (    v_vri.validity.region.region.id_region.local_region != 0 
                           and v_vri.validity.region.region.id_region.local_region != v_vr.validity.region.region.id_region.local_region ) {
                            log("*** " & testcasename() & ": FAIL: Certificate validity restriction local identified region in cert " & int2str(v_counter) & " is not the same as in the issuing one ***");
                            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                        }
                    }
                    
                } else {
                    // Region validity restriction is not exist
                    if (f_vri) {
                        log("*** " & testcasename() & ": FAIL: Certificate validity restriction identified region must be set in the certificate "  & int2str(v_counter) &
                                                              "because this restriction exists in the issuing certificate ***");
                        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                    }
                }
            }
            
            // Postamble
            f_poNeighbour();
            f_cf01Down();
        } // End of testcase TC_SEC_SND_CERT_06_02
        
        /**
         * @desc Check Identified Region:
         * Must contain value that correspond to numeric country codes as defined by United Nations Statistics Division
         * <pre>
         * Pics Selection: PIC_UseIdentifiedRegion, PIC_UseUnStatsRegionDictionary
         * Config Id: CF01
         * with {
         *   the IUT being in the 'authorized' state
         *   the IUT being requested to include certificate in the next CAM
         * } ensure that {
         *    when {
         *     the IUT is requested to send a CAM
         *   } then {
         *     the IUT sends a SecuredMessage
         *       containing header_fields['signer_info'].signer {
         *         containing type
         *           indicating 'certificate'
         *         containing certificate {
         *           containing validity_restrictions['region']{
         *             containing region_type
         *               indicating 'id'
         *             containing id_region {
         *               containing region_dictionary
         *                 indicating 'un_stats' (0)
         *               containing region_dictionary
         *                 indicating 'un_stats' (0)
         *               indicating length >=3 and <=12
         *               indicating continuous region without holes and intersections
         *             }
         *           }
         *         }
         *       }
         *   }
         * }
         * </pre>
         * @reference ETSI TS 103 097 V1.1.14, clauses 4.2.27
         */
        testcase TC_SEC_SND_CERT_06_03() runs on ItsGeoNetworking system ItsSecSystem {
            var Certificate         v_cert;
            var ValidityRestriction v_vr;
            var integer             v_counter;
            
            // Test component configuration
            f_cf01Up();
            
            // Preamble
            f_prNeighbour();
            f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
            
            // Test body
            tc_ac.start;
            f_waitForCertificate(v_cert);
            tc_ac.stop;
            if (f_getCertificateValidityRestriction(v_cert, e_region, v_vr)) {
                if (v_vr.validity.region.region_type == e_id) {
                    if (not match (v_vr.validity.region, mw_geographicRegion_identified(mw_identifiedRegion_un_stats_any))) {
                        log("*** " & testcasename() & ": FAIL: Identified region is not the UN Stats Region Code ***");
                        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                    }
                }
                log("*** " & testcasename() & ": PASS: Certificate has a valid identified region restrictions ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
            } else {
                log("*** " & testcasename() & ": PASS: Certificate doesn't have any location restrictions ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
            }
            
            // Postamble
            f_poNeighbour();
            f_cf01Down();
        } // End of testcase TC_SEC_SND_CERT_06_03
        
        /**
         * @desc Check Identified Region:
         * Must contain value that correspond to numeric country codes as defined by United Nations Statistics Division 
         * Subordinate certificate restrictions must be a subset of the issuing certificate restrictions  
         * <pre>
         * Pics Selection: PIC_UseIdentifiedRegion, PIC_UseUnStatsRegionDictionary
         * Config Id: CF01
         * with {
         *   the IUT being in the 'authorized' state
         *   the IUT being requested to include certificate chain in the next CAM
         * } ensure that {
         *    when {
         *     the IUT is requested to send a CAM
         *   } then {
         *     the IUT sends a SecuredMessage
         *       containing header_fields['signer_info'].signer {
         *         containing type
         *           indicating 'certificate_chain'
         *         containing certificates
         *           indicating CERTIFICATES {
         *             containing CERTIFICATES[0] {
         *               containing validity_restrictions['region'] {
         *                 containing region_type
         *                   indicating 'id'
         *                 containing id_region {
         *                   containing region_dictionary
         *                     indicating 'un_stats' (1)
         *                   containing region_identifier
         *                     indicating valid value according to UnStats document
         *                   containing local_region
         * 
         *                 }
         *             }
         *             containing CERTIFICATES[n] (1..N) {
         *               containing no validity restriction of type region or validity_restrictions['region'] {
         *                 containing region_type
         *                   indicating 'id'
         *                 containing id_region 
         *                   containing region_dictionary
         *                     indicating 'un_stats' (1)
         *                   containing region_identifier
         *                     indicating CERTIFICATES[n-1].validity_restrictions['region'].id_region.region_identifier
         *                   containing local_region
         *                     indicating CERTIFICATES[n-1].validity_restrictions['region'].id_region.local_region
         *                       or any value if CERTIFICATES[n-1].validity_restrictions['region'].id_region.local_region == 0
         *                 }
         *               }
         *             }
         *           }
         *       }
         *   }
         * }
         * </pre>
         * @reference ETSI TS 103 097 V1.1.14, clauses 4.2.27
         */
        testcase TC_SEC_SND_CERT_06_04() runs on ItsGeoNetworking system ItsSecSystem {
            var CertificateChain         v_chain;
            var ValidityRestriction v_vr, v_vri;  // current and issuing cert validity restrictions
            var boolean f_vr, f_vri;
            
            // Test component configuration
            f_cf01Up();
            
            // Preamble
            f_prNeighbour();
            f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
            
            // Test Body
            log("*** " & testcasename() & ": INFO: Request and waiting for the message containing certificate chain  ***");
            tc_ac.start;
            if (f_askAndWaitForCertificateChain(v_chain, f_generateDefaultCam())) {
                log("*** " & testcasename() & ": INCONC: Expected message not received ***");
                f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_timeout);
            }
            tc_ac.stop;
            f_vr := false;
            for (var integer v_counter := 0; v_counter < lengthof(v_chain); v_counter := v_counter + 1) {
                v_vri := v_vr;
                f_vri := f_vr;
                f_vr := f_getCertificateValidityRestriction(v_chain[v_counter], e_region, v_vr);
                
                if (f_vr) {
                    if (v_vr.validity.region.region_type == e_id) {
                        if (not match (v_vr.validity.region, mw_geographicRegion_identified(mw_identifiedRegion_un_stats_any))) {
                            log("*** " & testcasename() & ": FAIL: Identified region is not the UN Stats Region Code ***");
                            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                        }
                    }
                    
                    if (f_vri) {
                        // the region code must be the same
                        if (v_vr.validity.region.region.id_region.region_identifier !=
                           v_vri.validity.region.region.id_region.region_identifier) {
                            log("*** " & testcasename() & ": FAIL: Certificate validity restriction identified region in cert " & int2str(v_counter) & " is not the same as in the issuing one ***");
                            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                        }
                        if (    v_vri.validity.region.region.id_region.local_region != 0 
                           and v_vri.validity.region.region.id_region.local_region != v_vr.validity.region.region.id_region.local_region
                           and not f_isIdentifiedRegionInside(v_vri.validity.region.region.id_region.local_region, v_vr.validity.region.region.id_region.local_region)
                        ) {
                            log("*** " & testcasename() & ": FAIL: Certificate validity restriction local identified region in cert " & int2str(v_counter) & " is not the subregion of the issuing one ***");
                            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                        }
                    }
                    
                } else {
                    // Region validity restriction is not exist
                    if (f_vri) {
                        log("*** " & testcasename() & ": FAIL: Certificate validity restriction identified region must be set in the certificate "  & int2str(v_counter) &
                                                              "because this restriction exists in the issuing certificate ***");
                        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                    }
                }
            }
            
            // Postamble
            f_poNeighbour();
            f_cf01Down();
            
        } // End of testcase TC_SEC_SND_CERT_06_04
        
        /**
         * @desc    Check that the certificate signature contains ECC point of type set to either compressed_lsb_y_0, compressed_lsb_y_1 or x_coordinate_only
         * <pre>
         * Pics Selection: none
         * Config Id: CF01
         * Initial conditions:
         * with {
         *   the IUT being in the 'authorized' state
         *      the IUT being requested to include certificate in the next CAM
         * }
         * Expected Behaviour:
         * ensure that {
         *    when {
         *     the IUT is requested to send a CAM
         *   } then {
         *     the IUT sends a SecuredMessage
         *       containing header_fields['signer_info'].signer {
         *         containing type
         *           indicating certificate
         *         containing certificate {
         *             containing signature.ecdsa_signature
         *                 containing R.type
         *                     indicating compressed_lsb_y_0
         *                     or indicating compressed_lsb_y_1 
         *                     or indicating x_coordinate_only
         *         }
         *       }
         *   }
         * }
         * </pre>
         * @reference ETSI TS 103 097 V1.1.14, clause 6.1
         */
        testcase TC_SEC_SND_CERT_07_01() runs on ItsGeoNetworking system ItsSecSystem {
            
            // Test component configuration
            f_cf01Up();
            
            // Preamble
            f_prNeighbour();
            f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
            
            // Test Body
            tc_ac.start;
            alt {
                [] geoNetworkingPort.receive(
                    mw_geoNwInd(
                        mw_geoNwSecPdu(
                            mdw_securedMessage(
                                superset(
                                    mw_header_field_signer_info_certificate(
                                        mw_at_certificate(
                                            ?,
                                            ?,
                                            ?,
                                            mw_signature(
                                                mw_ecdsaSignature(
                                                    mw_eccPointecdsa_nistp256_with_sha256_y0_coordinate_only
                ))))))))) {
                    tc_ac.stop;
                    log("*** " & testcasename() & ": PASS: AT certificate contains signature with the ECC point of type set to compressed_lsb_y_0 received ***");
                    f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
                }
                [] geoNetworkingPort.receive(
                    mw_geoNwInd(
                        mw_geoNwSecPdu(
                            mdw_securedMessage(
                                superset(
                                    mw_header_field_signer_info_certificate(
                                        mw_at_certificate(
                                            ?,
                                            ?,
                                            ?,
                                            mw_signature(
                                                mw_ecdsaSignature(
                                                    mw_eccPointecdsa_nistp256_with_sha256_y1_coordinate_only
                ))))))))) {
                    tc_ac.stop;
                    log("*** " & testcasename() & ": PASS: AT certificate contains signature with the ECC point of type set to compressed_lsb_y_1 received ***");
                    f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
                }
                [] geoNetworkingPort.receive(
                    mw_geoNwInd(
                        mw_geoNwSecPdu(
                            mdw_securedMessage(
                                superset(
                                    mw_header_field_signer_info_certificate(
                                        mw_at_certificate(
                                            ?,
                                            ?,
                                            ?,
                                            mw_signature(
                                                mw_ecdsaSignature(
                                                    mw_eccPointecdsa_nistp256_with_sha256_x_coordinate_only
                ))))))))) {
                    tc_ac.stop;
                    log("*** " & testcasename() & ": PASS: AT certificate contains signature with the ECC point of type set to x_coordinate_only received ***");
                    f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
                }
                [] geoNetworkingPort.receive(
                    mw_geoNwInd(
                        mw_geoNwSecPdu(
                            mdw_securedMessage(
                                superset(
                                    mw_header_field_signer_info_certificate(
                                        mw_at_certificate
                )))))) {
                    tc_ac.stop;
                    log("*** " & testcasename() & ": FAIL: AT certificate signature mismatch ***");
                    f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                }
                [] tc_ac.timeout {
                    log("*** " & testcasename() & ": INCONC: Expected message not received ***");
                    f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
                }
            } // End of 'alt' statement
            
            // Postamble
            f_poNeighbour();
            f_cf01Down();
            
        } // End of testcase TC_SEC_SND_CERT_07_01
        
        /**
         * @desc Check the certificate signature 
         * <pre>
         * Pics Selection: none
         * Config Id: CF01
         * Initial conditions:
         * with {
         *   the IUT being in the 'authorized' state
         *   the IUT being requested to include certificate in the next CAM
         * } ensure that {
         *    when {
         *     the IUT is requested to send a CAM
         *   } then {
         *     the IUT sends a SecuredMessage
         *       containing header_fields['signer_info'].signer {
         *         containing type
         *           indicating 'certificate'
         *         containing certificate {
         *           containing signer_info[0] {
         *             containing type
         *               indicating 'certificate_digest_with_sha256'
         *             containing digest
         *               referenced to the certificate CERT
         *           }
         *           containing signature
         *             verifiable using CERT.subject_attributes['verification_key'].key
         *         }
         *       }
         *   }
         * }
         * </pre>
         * @reference ETSI TS 103 097 V1.1.14, clause 7.4
         */
        testcase TC_SEC_SND_CERT_09_01() runs on ItsGeoNetworking system ItsSecSystem {
            // Local declarations
            var GeoNetworkingInd v_geoNwInd;
            var Certificate      v_at_cert;
            var Certificate      v_aa_cert;
            var HashedId8        v_aa_digest;
            var SignerInfo       v_si;
            var integer          v_counter;
            
            // Test component configuration
            f_cf01Up();
            
            // Preamble
            f_prNeighbour();
            f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
            
            // Wait for the message with the certificate to get the AA cert digest.
            // Ask for the chain, containing AT and AA certificate
            // Check that the AT cert in the first message is signed with the AA cert
            log("*** " & testcasename() & ": INFO: Waiting for the message containing certificate  ***");
            tc_ac.start;
            f_waitForCertificate(v_at_cert);
            tc_ac.stop;
            
            if (true != f_getCertificateSignerInfo(v_at_cert, v_si)) {
                log("*** " & testcasename() & ": FAIL: AT Certificate signer info is unknown ***");
                f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_error);
            }
            if (not match (v_si.type_, e_certificate_digest_with_sha256)) {
                log("*** " & testcasename() & ": FAIL: AT Certificate is not signed well ***");
                f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_error);
            }
            v_aa_digest := v_si.signerInfo.digest;
            
            // Send a certificate request to the IUT 
            f_sendCertificateRequest(v_aa_digest, f_generateDefaultCam());
                
            // Test Body
            tc_ac.start;
            alt {
                [] geoNetworkingPort.receive(
                    mw_geoNwInd(
                        mw_geoNwSecPdu(
                            mdw_securedMessage(
                                superset(
                                    mw_header_field_signer_info_certificate_chain
                ))))) -> value v_geoNwInd {
                    var SecuredMessage v_secMsg;
                    var integer v_chainLength;
                    tc_ac.stop;
                    // Check certificate chain
                    
                    if (f_getMsgSignerInfo(f_getSecuredMessage(v_geoNwInd.msgIn), v_si)) {
                        v_chainLength := lengthof(v_si.signerInfo.certificates);
                        if (v_chainLength < 2 ) {
                            log("*** " & testcasename() & ": FAIL: Certificate chain doesn't contain the AA cert ***");
                            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                        }
                        // get aa cert
                        v_aa_cert := v_si.signerInfo.certificates[v_chainLength-2];
                        if (not match (v_aa_digest, f_calculateDigestFromCertificate(v_aa_cert))) {
                            log("*** " & testcasename() & ": FAIL: AT certificate was not signed with the given AA cert ***");
                            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                        }
                        
                        // Check that at cert is signed with aa cert
                        if (false == f_verifyCertificateSignatureWithIssuingCertificate(v_at_cert, v_aa_cert)) {
                            log("*** " & testcasename() & ": FAIL: AT certificate signature error ***");
                            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                        }
                        
                        log("*** " & testcasename() & ": PASS: AT certificate was well signed with AA certificate ***");
                        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
                    } else {
                        log("*** " & testcasename() & ": FAIL: The message signer info is unknown ***");
                        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                    }
                }
                [] tc_ac.timeout {
                    log("*** " & testcasename() & ": INCONC: Expected message not received ***");
                    f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
                }
            } // End of 'alt' statement
            
            // Postamble
            f_poNeighbour();
            f_cf01Down();
            
        } // End of testcase TC_SEC_SND_CERT_09_01
        
        /**
         * @desc Check the signatures of the certificates in the chain 
         * <pre>
         * Pics Selection: none
         * Config Id: CF01
         * Initial conditions:
         * with {
         *   the IUT being in the 'authorized' state
         *   the IUT being requested to include certificate chain in the next CAM
         * } ensure that {
         *    when {
         *     the IUT is requested to send a CAM
         *   } then {
         *     the IUT sends a SecuredMessage
         *       containing header_fields['signer_info'].signer {
         *         containing type
         *           indicating 'certificate_chain'
         *         containing certificates
         *           indicating CERTIFICATES {
         *             containing CERTIFICATES[N] {
         *               containing signer_info[0] {
         *                 containing type
         *                   indicating 'certificate_digest_with_sha256'
         *                 containing digest
         *                   referenced to the certificate CERTIFICATES[N-1]
         *               }
         *               containing signature
         *                 verifiable using CERTIFICATES[N-1].subject_attributes['verification_key'].key
         *             }
         *         }
         *       }
         *   }
         * }
         * </pre>
         * @reference ETSI TS 103 097 V1.1.14, clause 7.4
         */
        testcase TC_SEC_SND_CERT_09_02() runs on ItsGeoNetworking system ItsSecSystem {
            // Local declarations
            var GeoNetworkingInd v_geoNwInd;
            var Certificate      v_cert;
            var CertificateChain v_chain;
            var SignerInfo       v_si;
            var HashedId8        v_digest;
            var integer          v_counter;
            
            // Test component configuration
            f_cf01Up();
            
            // Preamble
            f_prNeighbour();
            f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
            
            // Wait for the message with the certificate to get the AA cert digest.
            // Ask for the chain, containing AT and AA certificate
            // Check that the AT cert in the first message is signed with the AA cert
            log("*** " & testcasename() & ": INFO: Waiting for the message containing certificate and ask for a certificate chain ***");
            tc_ac.start;
            f_askForCertificateChain(f_generateDefaultCam());
            tc_ac.stop;
                
            // Test Body
            tc_ac.start;
            alt {
                [] geoNetworkingPort.receive(
                    mw_geoNwInd(
                        mw_geoNwSecPdu(
                            mdw_securedMessage(
                                superset(
                                    mw_header_field_signer_info_certificate_chain
                ))))) -> value v_geoNwInd {
                    var SecuredMessage v_secMsg;
                    var integer v_chainLength;
                    tc_ac.stop;
                    // Check certificate chain
                    if (f_getMsgSignerInfo(f_getSecuredMessage(v_geoNwInd.msgIn), v_si)) {
                        v_chain  :=  v_si.signerInfo.certificates;
                        for (v_counter := lengthof(v_chain) - 1; v_counter > 0; v_counter := v_counter - 1 ) {
                            if (not f_getCertificateSignerInfo(v_chain[v_counter], v_si)) {
                                log("*** " & testcasename() & ": FAIL: Certificate "&int2str(v_counter) & " doesn't have a signer info ***");
                                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                            }
                            if (not match (v_si.type_, e_certificate_digest_with_sha256)) {
                                log("*** " & testcasename() & ": FAIL: Certificate is not signed with digest ***");
                                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                            }
                            // Check that cert is signed by issuing cert
                            v_digest := f_calculateDigestFromCertificate(v_chain[v_counter - 1]);
                            if (not match (v_si.signerInfo.digest, v_digest)) {
                                log("*** " & testcasename() & ": FAIL: Certificate chain is not valid ***");
                                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                            }
                            // Check that the signature is valid
                            if (false == f_verifyCertificateSignatureWithIssuingCertificate(v_chain[v_counter], v_chain[v_counter - 1])) {
                                log("*** " & testcasename() & ": FAIL: AT certificate signature error ***");
                                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                            }
                        } // End of 'for' statement
                        
                        log("*** " & testcasename() & ": PASS: All certificates in the chain signed by it's issuing certs ***");
                        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
                    } else {
                        log("*** " & testcasename() & ": FAIL: The message signer info is unknown ***");
                        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                    }
                }
                [] tc_ac.timeout {
                    log("*** " & testcasename() & ": INCONC: Expected message not received ***");
                    f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
                }
            }
            
            // Postamble
            f_poNeighbour();
            f_cf01Down();
            
        } // End of testcase TC_SEC_SND_CERT_09_02
        
        group g_AA_Certificates {
            
            /**
             * @desc Check that the subject_type of the AA certificate is set to authorization_authority   
             * <pre>
             * Pics Selection: 
             * Config Id: CF01
             * with {
             *   the IUT being in the 'authorized' state
             *   the IUT being requested to include certificate chain in the next CAM
             * } ensure that {
             *    when {
             *     the IUT is requested to send a CAM
             *   } then {
             *     the IUT sends a SecuredMessage
             *       containing header_fields['signer_info'].signer {
             *         containing type
             *           indicating certificate_chain
             *         containing certificates[last-1] {
             *           containing subject_info.subject_type
             *             indicating 'authorization_authority' (2)
             *         }
             *       }
             *   }
             * }
             * </pre>
             * @reference ETSI TS 103 097 V1.1.14, clauses 7.4.3
             */
            testcase TC_SEC_SND_CERT_AA_01_01() runs on ItsGeoNetworking system ItsSecSystem {
                var CertificateChain         v_chain;
                
                // Test component configuration
                f_cf01Up();
                
                // Preamble
                f_prNeighbour();
                f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
                
                // Test Body
                log("*** " & testcasename() & ": INFO: Request and waiting for the message containing certificate chain  ***");
                tc_ac.start;
                if (f_askAndWaitForCertificateChain(v_chain, f_generateDefaultCam())) {
                    log("*** " & testcasename() & ": INCONC: Expected message not received ***");
                    f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_timeout);
                }
                tc_ac.stop;
                if (lengthof(v_chain) < 2) {
                    log("*** " & testcasename() & ": FAIL: Certificate chain is too short ***");
                    f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_error);
                }
                if (not match(v_chain[lengthof(v_chain) - 2], mw_aa_certificate)) {
                    log("*** " & testcasename() & ": FAIL: AA certificate not found in the chain[last-1] ***");
                    f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                }
                log("*** " & testcasename() & ": PASS: AA certificate was found in the chain ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
                
                // Postamble
                f_poNeighbour();
                f_cf01Down();
            } // End of testcase TC_SEC_SND_CERT_AA_01_01
            
            /**
             * @desc Check that the subject_name variable-length vector shall have a maximum length of 32 bytes.    
             * <pre>
             * Pics Selection: 
             * Config Id: CF01
             * with {
             *   the IUT being in the 'authorized' state
             *   the IUT being requested to include certificate chain in the next CAM
             * } ensure that {
             *    when {
             *     the IUT is requested to send a CAM
             *   } then {
             *     the IUT sends a SecuredMessage
             *       containing header_fields['signer_info'].signer {
             *         containing type
             *           indicating certificate_chain
             *         containing certificates[last-1] {
             *           containing subject_info.subject_name
             *             indicating length <= 32 bytes
             *         }
             *       }
             *   }
             * }
             * </pre>
             * @reference ETSI TS 103 097 V1.1.14, clauses 7.4.3
             */
            testcase TC_SEC_SND_CERT_AA_02_01() runs on ItsGeoNetworking system ItsSecSystem {
                var CertificateChain         v_chain;
                
                // Test component configuration
                f_cf01Up();
                
                // Preamble
                f_prNeighbour();
                f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
                
                // Test Body
                log("*** " & testcasename() & ": INFO: Request and waiting for the message containing certificate chain  ***");
                tc_ac.start;
                if (f_askAndWaitForCertificateChain(v_chain, f_generateDefaultCam())) {
                    log("*** " & testcasename() & ": INCONC: Expected message not received ***");
                    f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_timeout);
                }
                tc_ac.stop;
                if (lengthof(v_chain) < 2) {
                    log("*** " & testcasename() & ": FAIL: Certificate chain is too short ***");
                    f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_error);
                }
                // Verified automatically on decoding
                if (lengthof(v_chain[lengthof(v_chain) - 2].subject_info.subject_name) > 32 ) {
                    log("*** " & testcasename() & ": FAIL: Subject name of the AA certificate is too long ***");
                    f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                }
                log("*** " & testcasename() & ": PASS: Subject name of the AA certificate is good ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
                
                // Postamble
                f_poNeighbour();
                f_cf01Down();
            } // End of testcase TC_SEC_SND_CERT_AA_02_01
            
            /**
             * @desc Check that signer info of the AA certificate is a digest     
             * <pre>
             * Pics Selection: 
             * Config Id: CF01
             * with {
             *   the IUT being in the 'authorized' state
             *   the IUT being requested to include certificate chain in the next CAM
             * } ensure that {
             *    when {
             *     the IUT is requested to send a CAM
             *   } then {
             *     the IUT sends a SecuredMessage
             *       containing header_fields['signer_info'].signer {
             *         containing type
             *           indicating certificate_chain
             *         containing certificates[last-1] {
             *           containing signer_info {
             *             containing type
             *               indicating 'certificate_digest_with_sha256'
             *             containing digest
             *           }
             *         }
             *       }
             *   }
             * }
             * </pre>
             * @reference ETSI TS 103 097 V1.1.14, clauses 7.4.3
             */
            testcase TC_SEC_SND_CERT_AA_04_01() runs on ItsGeoNetworking system ItsSecSystem {
                var CertificateChain         v_chain;
                var Certificate              v_aa_cert;
                
                // Test component configuration
                f_cf01Up();
                
                // Preamble
                f_prNeighbour();
                f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
                
                // Test Body
                log("*** " & testcasename() & ": INFO: Request and waiting for the message containing certificate chain  ***");
                tc_ac.start;
                if (f_askAndWaitForCertificateChain(v_chain, f_generateDefaultCam())) {
                    log("*** " & testcasename() & ": INCONC: Expected message not received ***");
                    f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_timeout);
                }
                tc_ac.stop;
                if (lengthof(v_chain) < 2) {
                    log("*** " & testcasename() & ": FAIL: Certificate chain is too short ***");
                    f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_error);
                }
                v_aa_cert := v_chain[lengthof(v_chain) - 2];
                if (not match(v_aa_cert, mw_aa_certificate(mw_signerInfo_digest))) {
                    log("*** " & testcasename() & ": FAIL: AA certificate not signed by digest ***");
                    f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                }
                log("*** " & testcasename() & ": PASS: AA certificate is signed by digest ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
                
                // Postamble
                f_poNeighbour();
                f_cf01Down();
            } // End of testcase TC_SEC_SND_CERT_AA_04_01
            
            /**
             * @desc Check that all neccesary subject attributes are present and arranged in accesing order     
             * <pre>
             * Pics Selection: 
             * Config Id: CF01
             * with {
             *   the IUT being in the 'authorized' state
             *   the IUT being requested to include certificate chain in the next CAM
             * } ensure that {
             *    when {
             *     the IUT is requested to send a CAM
             *   } then {
             *     the IUT sends a SecuredMessage
             *       containing header_fields['signer_info'].signer {
             *         containing type
             *           indicating certificate_chain
             *         containing certificates[last-1] {
             *           containing subject_attributes [0..N] {
             *             indicating subject_attributes[n].type < subject_attributes[n+ 1].type
             *             containing subject_attributes['verification_key']
             *             containing subject_attributes['assurance_level']
             *             containing subject_attributes['its_aid_list']
             *           }
             *         }
             *       }
             *   }
             * }
             * </pre>
             * @reference ETSI TS 103 097 V1.1.14, clauses 6.1, 7.4, 7.4.3
             */
            testcase TC_SEC_SND_CERT_AA_05_01() runs on ItsGeoNetworking system ItsSecSystem {
                var CertificateChain         v_chain;
                var SubjectAttributes        v_attrs;
                
                // Test component configuration
                f_cf01Up();
                
                // Preamble
                f_prNeighbour();
                f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
                
                // Test Body
                log("*** " & testcasename() & ": INFO: Request and waiting for the message containing certificate chain  ***");
                tc_ac.start;
                if (f_askAndWaitForCertificateChain(v_chain, f_generateDefaultCam())) {
                    log("*** " & testcasename() & ": INCONC: Expected message not received ***");
                    f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_timeout);
                }
                tc_ac.stop;
                if (lengthof(v_chain) < 2) {
                    log("*** " & testcasename() & ": FAIL: Certificate chain is too short ***");
                    f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_error);
                }
                if (not match(v_chain[lengthof(v_chain) - 2], 
                             mw_aa_certificate(?,
                                    superset(mw_subject_attribute_verification_key,
                                             mw_subject_attribute_assurance_level,
                                             mw_subject_attribute_its_aid_list)))
                 ) {
                    log("*** " & testcasename() & ": FAIL: Required subject attribute of AA certificate is not found ***");
                    f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                }
                
                v_attrs := v_chain[lengthof(v_chain) - 2].subject_attributes;
                for (var integer v_counter := 1; v_counter < lengthof(v_attrs); v_counter := v_counter + 1 ) {
                    if (v_attrs[v_counter].type_ <= v_attrs[v_counter-1].type_) {
                        log("*** " & testcasename() & ": FAIL: AA certificate subject attributes are not arranged in accening order ***");
                        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
                    }
                }
                
                log("*** " & testcasename() & ": PASS: All required AA certificate subject attributes are presents ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
                
                // Postamble
                f_poNeighbour();
                f_cf01Down();
            } // End of testcase TC_SEC_SND_CERT_AA_05_01
            
            /**
             * @desc Check that time_start_and_end is included in the AA certificate validation restrictions
             *       Check that end_validity is later then start_validity      
             * <pre>
             * Pics Selection: 
             * Config Id: CF01
             * with {
             *   the IUT being in the 'authorized' state
             *   the IUT being requested to include certificate chain in the next CAM
             * } ensure that {
             *    when {
             *     the IUT is requested to send a CAM
             *   } then {
             *     the IUT sends a SecuredMessage
             *       containing header_fields['signer_info'].signer {
             *         containing type
             *           indicating certificate_chain
             *         containing certificates[last-1] {
             *           containing validity_restrictions [0..N] {
             *             not containing validity_restrictions['time_end']
             *             and not containing validity_restrictions['time_start_and_duration']
             *             and containing validity_restrictions['time_start_and_end']
             *               containing start_validity
             *                 indicating START_AA_VALIDITY
             *               containing end_validity
             *                 indicating END_AA_VALIDITY >=START_AA_VALIDITY
             *           }
             *         }
             *       }
             *   }
             * }
             * </pre>
             * @reference ETSI TS 103 097 V1.1.14, clauses 6.7, 7.4, 7.4.3
             */
            testcase TC_SEC_SND_CERT_AA_06_01() runs on ItsGeoNetworking system ItsSecSystem {
                var CertificateChain         v_chain;
                var Certificate              v_aa_cert;
                var ValidityRestriction      v_vr;
                
                // Test component configuration
                f_cf01Up();
                
                // Preamble
                f_prNeighbour();
                f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
                
                // Test Body