ItsPki_TestCases.ttcn

      var Certificate v_root_certificate;

      // Test control
      if (not PICS_IUT_CA_ROLE and not PICS_SEC_SHA256 and not PICS_SEC_BRAINPOOL_P256R1 and not PICS_SEC_BRAINPOOL_P384R1) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and (PICS_SEC_SHA256 or PICS_SEC_BRAINPOOL_P256R1 or PICS_SEC_BRAINPOOL_P384R1 required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration

      // Preamble
      v_authorized_certificate := "CERT_IUT_I_AA";
      v_result := f_get_root_ca_certificate(v_authorized_certificate, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(v_authorized_certificate, v_root_certificate) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_04_BV

    /**
     * @desc Check that the CA is able to issue the certificate with the well-formed circular region validity restriction
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_CIRCULAR_REGION
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         the CA is authorized with CA certificate 
     *             containing toBeSigned
     *                 containing region
     *                     indicating REGION
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *                 containing circular region restriction
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing region
     *                         containing circularRegion
     *                             containing center
     *                                 indicating a point inside the REGION
     *                             and containing radius
     *                                 indicating a value when all points of the circle are inside the REGION
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_05_BV
     * @reference IEEE Std 1609.2 [2], clauses 6.4.20, 6.4.17, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_05_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if (not PICS_IUT_CA_ROLE and not PICS_SEC_CIRCULAR_REGION) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_CIRCULAR_REGION required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_05_BV

    /**
     * @desc Check that the CA is able to issue the certificate with the well-formed rectangular region validity restriction
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_RECTANGULAR_REGION
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         the CA is authorized with CA certificate 
     *             containing toBeSigned
     *                 containing region
     *                     indicating REGION
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *                 containing rectangular region restriction
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing region
     *                         containing rectangularRegion
     *                             containing items of type RectangularRegion
     *                                containing northwest
     *                                     indicating a point inside the REGION
     *                                 and containing southeast
     *                                     indicating a point on the south and east from northwest
     *                                     and inside the REGION
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_06_BV
     * @reference IEEE Std 1609.2 [2], clauses 6.4.20, 6.4.17, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_06_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if (not PICS_IUT_CA_ROLE and not PICS_SEC_RECTANGULAR_REGION) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_RECTANGULAR_REGION required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_06_BV

    /**
     * @desc Check that the CA is able to issue the certificate with the well-formed polygonal region validity restriction
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_POLYGONAL_REGION
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         the CA is authorized with CA certificate 
     *             containing toBeSigned
     *                 containing region
     *                     indicating REGION
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *                 containing polygonal region restriction
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing region
     *                         containing polygonalRegion
     *                             containing more than 2 items of type TwoDLocation
     *                                indicating points inside the REGION
     *                                 and indicating unintercepting segments
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_07_BV
     * @reference IEEE Std 1609.2 [2], clauses 6.4.20, 6.4.17, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_07_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if (not PICS_IUT_CA_ROLE and not PICS_SEC_POLYGONAL_REGION) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_POLYGONAL_REGION required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_07_BV

    /**
     * @desc Check that the CA is able to issue the certificate with identified region validity restriction contains values that correspond to numeric country codes as defined by United Nations Statistics Division [5]
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_IDENTIFIED_REGION
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         the CA is authorized with CA certificate 
     *             containing toBeSigned
     *                 containing region
     *                     indicating REGION
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *                 containing identified region validity restriction
     *                     indicating country or area COUNTRY
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing region
     *                         containing identifiedRegion
     *                             containing 1 entry of type IdentifiedRegion
     *                                 containing countryOnly
     *                                     indicating integer representation of the identifier of country or area COUNTRY
     *                             or containing countryAndRegions
     *                                 containing countryOnly
     *                                     indicating integer representation of the identifier of country or area COUNTRY
     *                             or containing countryAndSubregions
     *                                 containing country
     *                                     indicating integer representation of the identifier of country or area COUNTRY
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_08_BV
     * @reference IEEE Std 1609.2 [2], clauses 6.4.23
     */
    testcase TC_SECPKI_CA_CERTGEN_08_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if (not PICS_IUT_CA_ROLE and not PICS_SEC_IDENTIFIED_REGION) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_IDENTIFIED_REGION required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_08_BV

    /**
     * @desc Check that the identified region validity restriction of the subordinate certificate is included in the identified region validity restriction of the issuing certificate
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_IDENTIFIED_REGION
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         the CA is authorized with CA certificate
     *             containing toBeSigned
     *                 containing region
     *                     containing identifiedRegion
     *                         containing countryOnly
     *                             indicating COUNTRY
     *                          or containing countryAndRegions
     *                             containing countryOnly
     *                          indicating COUNTRY
     *                             and containing regions
     *                                indicating REGIONS
     *                          or containing countryAndSubregions
     *                             containing country
     *                                indicating COUNTRY
     *                             and containing regionAndSubregions
     *                                indicating REGIONS and SUBREGIONS
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *                 containing identifiedRegion
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing region
     *                         containing identifiedRegion
     *                             containing countryOnly
     *                                 indicating value = COUNTRY
     *                             or containing countryAndRegions
     *                                 containing countryOnly
     *                                    indicating value = COUNTRY
     *                             and containing regions
     *                                 containing region identifiers contained in REGIONS
     *                             or containing countryAndSubregions
     *                                 containing country
     *                                    indicating value = COUNTRY
     *                                 and containing regionAndSubregions
     *                                    containing region identifiers contained in REGIONS
     *                                    and containing subRegion identifiers contained in SUBREGIONS for every region
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_09_BV
     * @reference IEEE Std 1609.2 [2], clauses 6.4.17, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_09_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if (not PICS_IUT_CA_ROLE and not PICS_SEC_IDENTIFIED_REGION) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_IDENTIFIED_REGION required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_09_BV

    /**
     * @desc Check that the certificate signature contains ECC point of type set to either compressed_lsb_y_0, compressed_lsb_y_1 or x_coordinate_only
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the explicit certificate
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing signature
     *                     containing X_SIGNATURE
     *                         containing rSig
     *                             containing x-only
     *                             or containing compressed-y-0
     *                             or containing compressed-y-1
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_10_BV
     * @reference IEEE Std 1609.2 [3], clause 6.3.29, 6.3.30, 6.3.31
     */
    testcase TC_SECPKI_CA_CERTGEN_10_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) and not PICS_SEC_SHA256 and not PICS_SEC_BRAINPOOL_P256R1 and not PICS_SEC_BRAINPOOL_P384R1) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and (PICS_SEC_SHA256 or PICS_SEC_BRAINPOOL_P256R1 or PICS_SEC_BRAINPOOL_P384R1 required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_10_BV

    /**
     * @desc Check that the certificate verification key contains ECC point of type set to either compressed_lsb_y_0, compressed_lsb_y_1 or uncompressed
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the explicit certificate
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing verifyKeyIndicator
     *                     containing verificationKey
     *                         containing X_KEY
     *                             containing x-only
     *                             or containing compressed-y-0
     *                             or containing compressed-y-1
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_11_BV
     * @reference IEEE Std 1609.2 [3], clause 6.3.38
     */
    testcase TC_SECPKI_CA_CERTGEN_11_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) and not PICS_SEC_SHA256 and not PICS_SEC_BRAINPOOL_P256R1 and not PICS_SEC_BRAINPOOL_P384R1) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and (PICS_SEC_SHA256 or PICS_SEC_BRAINPOOL_P256R1 or PICS_SEC_BRAINPOOL_P384R1 required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_11_BV

    /**
     * @desc Check that the certificate encryption key contains ECC point of type set to either compressed_lsb_y_0, compressed_lsb_y_1 or uncompressed
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the explicit certificate
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing encryptionKey
     *                         containing publicKey
     *                             containing X_KEY
     *                                 containing uncompressed
     *                                 or containing compressed-y-0
     *                                 or containing compressed-y-1
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_12_BV
     * @reference IEEE Std 1609.2 [3], clause 6.3.38
     */
    testcase TC_SECPKI_CA_CERTGEN_12_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) and not PICS_SEC_SHA256 and not PICS_SEC_BRAINPOOL_P256R1) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and (PICS_SEC_SHA256 or PICS_SEC_BRAINPOOL_P256R1 required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_12_BV

    /**
     * @desc Check the explicit certificate signature
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         and the CA is authorized with explicit certificate
     *             containing toBeSigned
     *                 containing verifyKeyIndicator
     *                     containing verificationKey
     *                         containing X_KEY
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the explicit certificate
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing issuer
     *                     referencing the certificate
     *                         containing toBeSigned
     *                             containing verifyKeyIndicator
     *                                 containing verificationKey
     *                                     containing X_KEY
     *                                         indicating KEY
     *                 and containing signature
     *                     containing X_SIGNATURE
     *                         verifiable using KEY
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_13_BV_01
     * @reference ETSI TS 103 097 [1], clause 6
     */
    testcase TC_SECPKI_CA_CERTGEN_13_BV_01() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) and not PICS_SEC_SHA256 and not PICS_SEC_BRAINPOOL_P256R1 and not PICS_SEC_BRAINPOOL_P384R1) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and (PICS_SEC_SHA256 or PICS_SEC_BRAINPOOL_P256R1 or PICS_SEC_BRAINPOOL_P384R1 required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_13_BV_01

    /**
     * @desc Check the explicit certificate signature
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         and the CA is authorized with explicit certificate
     *             containing toBeSigned
     *                 containing verifyKeyIndicator
     *                     containing verificationKey
     *                         containing X_KEY
     *         and the CA issued the implicit certificate of type EtsiTs103097Certificate (CERT)
     *             not containing signature
     *             and containing issuer
     *                 referencing the certificate
     *                     containing toBeSigned
     *                         containing verifyKeyIndicator
     *                             containing reconstructionValue
     *                                 indicating VALUE
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is calculated the digital signature
     *                 using the private key associated with the CERT
     *         }
     *         then {
     *             this signature can be verified using public key
     *                 reconstructed using VALUE and KEY
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_13_BV_02
     * @reference ETSI TS 103 097 [1], clause 6
     */
    testcase TC_SECPKI_CA_CERTGEN_13_BV_02() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) and not PICS_SEC_SHA256 and not PICS_SEC_BRAINPOOL_P256R1 and not PICS_SEC_BRAINPOOL_P384R1) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and (PICS_SEC_SHA256 or PICS_SEC_BRAINPOOL_P256R1 or PICS_SEC_BRAINPOOL_P384R1 required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, true, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_13_BV_02

    /**
     * @desc Check that all PSID entries of the appPermissions component of the certificate are unique
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA issued the certificate
     *                 containing toBeSigned
     *                     containing appPermissions
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing appPermissions
     *                         containing items of type PsidSsp
     *                             containing psid
     *                                 indicating unique values in this sequence
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_14_BV
     * @reference ETSI TS 103 097 [1], clauses 6.4.28, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_14_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if (not PICS_IUT_CA_ROLE) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_14_BV

    /**
     * @desc Check that all PSID entries of the appPermissions component of the certificate are also contained in the certIssuePermissions component in the issuing certificate
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA issued the certificate
     *                 containing toBeSigned
     *                     containing appPermissions
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing issuer
     *                     referenced to the certificate
     *                         containing toBeSigned
     *                             containing certIssuePermissions
     *                                 containing items of type PsidGroupPermissions
     *                                     containing eeType
     *                                         indicating app(0)
     *                                     and containing subjectPermissions
     *                                         containing explicit
     *                                             containing items of type PsidSspRange
     *                                                 indicating X_PSID_RANGE_LIST
     *                                         or containing all
     *                         and containing toBeSigned
     *                             containing appPermissions
     *                                 containing items of type PsidSsp
     *                                     containing psid
     *                                         contained in the X_PSID_RANGE_LIST
     *                                             as a psid
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_15_BV
     * @reference ETSI TS 103 097 [1], clauses 6.4.28, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_15_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if (not PICS_IUT_CA_ROLE) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_15_BV

    /**
     * @desc Check that all PSID entries of the certIssuePermissions component of the certificate are unique
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA issued the certificate
     *                 containing toBeSigned
     *                     containing certIssuePermissions
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing issuer
     *                     containing toBeSigned
     *                         containing certIssuePermissions
     *                             containing items of type PsidGroupPermissions
     *                                 containing subjectPermissions
     *                                     containing explicit
     *                                     and containing items of type PsidSspRange
     *                                         containing psid
     *                                             indicating unique values in this sequence