ItsPki_TestCases.ttcn

                                                                                           m_signerIdentifier_digest(v_rca_hashed_id8),
                                                                                           v_signature
                                                                                           )));
              // Send response with CERT_RCA_NEW
              f_init_default_headers_list(-, "tlm_ectl", v_headers);
              f_http_send(
                          v_headers,
                          m_http_response(
                                          m_http_response_ok(
                                                             m_http_message_body_binary(
                                                                                        m_binary_body_ieee1609dot2_data(
                                                                                                                        v_ieee1609dot2_signed_data
                                                                                                                        )),
                                                             v_headers
                                                             )));
              
              log("*** " & testcasename() & ": INFO: CERT_RCA_NEW was sent to the IUT ***");
              f_selfOrClientSyncAndVerdict(c_prDone, e_success);
            }
            [] tc_ac.timeout {
              log("*** " & testcasename() & ": INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdict(c_prDone, e_timeout);
            }
          } // End of 'alt' statement
          
          // Test Body
          f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
          
          // Postamble
          f_cfHttpDown_tlm();
        } // End of function f_TC_SECPKI_ITSS_CTLDIST_03_BV_pki

      } // End of group f_TC_SECPKI_ITSS_CTLDIST_03_BV

      /**
       * @desc Check that the IUT stops to redistribute the Delta CTL if anorther node is also sending it
       * <pre>
       * Pics Selection: PICS_UC_SEC_05_2
       * Initial conditions: {
       *     the IUT is configured to support P2P Delta X_DISTRIBUTION distribution
       *     and the IUT has started broadcasting the Delta X_DISTRIBUTION message
       *         signed with X_CERTIFICATE
       *         and containing ctlSequence (SN)
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT has received the Delta X_DISTRIBUTION
       *                 signed with X_CERTIFICATE
       *                 and containing ctlSequence
       *                     indicating value equal or higher than SN
       *         }
       *         then {
       *             the IUT stops broadfcasting the Delta X_DISTRIBUTION
       *                 signed with X_CERTIFICATE
       *                 and containing ctlSequence (SN)
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 TP SECPKI_ITSS_CTLDIST_04_BV
       * @reference ETSI TS 103 601, clause 5.4.4
       */
      testcase TC_SECPKI_ITSS_CTLDIST_04_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_cpoc;
        
        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_UC_SEC_05_2) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_UC_SEC_05_2 required for executing the TC ***");
          setverdict(inconc);
          stop;
        }
        
        // Test component configuration
        f_cfMtcUp03(v_itss, v_cpoc);

        // Start components
        v_itss.start(f_TC_SECPKI_ITSS_CTLDIST_04_BV_itss());
        v_cpoc.start(f_TC_SECPKI_ITSS_CTLDIST_04_BV_pki());
        
        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});
        
        // Cleanup
        f_cfMtcDown03(v_itss, v_cpoc);
        
      } // End of testcase TC_SECPKI_ITSS_CTLDIST_04_BV
      
      group f_TC_SECPKI_ITSS_CTLDIST_04_BV {

        function f_broadcast_delta_ctl(
                                       in charstring p_certificate_id,
                                       out Ieee1609Dot2Data p_delta_ctl
                                       ) runs on ItsPkiItss return GeoNetworkingPdu {
          // Local variables
          var GeoNetworkingPdu v_securedGnPdu;
          
          log(">>> f_broadcast_delta_ctl");
          
          v_securedGnPdu := f_prepareSecuredCam(p_certificate_id, valueof(m_headerInfo_cam(-, (f_getCurrentTime() * 1000)/*us*/)), valueof(m_signerIdentifier_digest), f_getTsStationId());
          log("f_sendSecuredCam: v_securedGnPdu= ", v_securedGnPdu);
          geoNetworkingPort.send(valueof(m_geoNwReq_linkLayerBroadcast(v_securedGnPdu)));

          return v_securedGnPdu;
        } // End of function f_broadcast_delta_ctl
        
        function f_TC_SECPKI_ITSS_CTLDIST_04_BV_itss()  runs on ItsPkiItss system ItsPkiItssSystem {
          // Local variables
          var GeoNetworkingInd v_geonetworking_message;
          var octetstring v_payload;
          var Ieee1609Dot2Data v_delta_ctl;
          
          // Test component configuration
          f_cfUp_itss();
          
          // Test adapter configuration
          
          // Preamble
          geoNetworkingPort.clear;
          tc_ac.start;
          alt {
            [] geoNetworkingPort.receive(
                                         mw_geoNwInd(
                                                     mw_geoNwSecPdu(
                                                                    mw_etsiTs103097Data_signed(
                                                                                               mw_signedData
                                                                                               )))) {
              tc_ac.stop;
              
              f_sendUtTriggerUpdateEctl(""); // FIXME Create PIXIT for ETCL URI
            }
            [] tc_ac.timeout {
              log("*** " & testcasename() & ": INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
            }
          } // End of 'alt' statement
          // Check that the IUT is boradcasting the Delta CTL
          geoNetworkingPort.clear;
          tc_ac.start;
          alt {
            [] geoNetworkingPort.receive(
                                         mw_geoNwInd(
                                                     mw_geoNwSecPdu(
                                                                    mw_etsiTs103097Data_signed(
                                                                                               mw_signedData
                                                                                               )))) -> value v_geonetworking_message {
              tc_ac.stop;
              
              if (f_verify_and_extract_payload(v_geonetworking_message.msgIn, -, v_payload) == false) {
                log("*** " & testcasename() & ": INCONC: Failed to verifiy payload ***");
                f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
              } else {
                // TODO Check payload
                if (substr(v_payload, 0, 2) == int2oct(2014, 2)) { // TODO Reorganize CAM/DENM/BTP test suites
                  log("*** " & testcasename() & ": INFO: Delta CTL was successfully broadcasted on the correct BTP port ***");
                  f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
                } else {
                  log("*** " & testcasename() & ": INCONC: Delta CTL was not broadcasted on BTP port 114 ***");
                  f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_timeout);
                }
              }
            }
            [] tc_ac.timeout {
              log("*** " & testcasename() & ": INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement
          
          // Test Body
          // Delta CTL boradcasting from another node
          f_broadcast_delta_ctl(cc_ectl_rca_new, v_delta_ctl);
          // Check that the IUT stops broadcasting Delta CTL
          geoNetworkingPort.clear;
          tc_noac.start;
          alt {
            [] geoNetworkingPort.receive(
                                         mw_geoNwInd(
                                                     mw_geoNwSecPdu(
                                                                    mw_etsiTs103097Data_signed(
                                                                                               mw_signedData
                                                                                               )))) -> value v_geonetworking_message {
              tc_noac.stop;
              
              if (f_verify_and_extract_payload(v_geonetworking_message.msgIn, -, v_payload) == false) {
                log("*** " & testcasename() & ": INCONC: Failed to verifiy payload ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_timeout);
              } else {
                // TODO Check payload
                if (substr(v_payload, 0, 2) == int2oct(2014, 2)) { // TODO Reorganize CAM/DENM/BTP test suites
                  log("*** " & testcasename() & ": FAIL: The IUT shall not continue Delta CTL broadcasting ***");
                  f_selfOrClientSyncAndVerdict(c_tbDone, e_error);
                } else {
                  tc_noac.start;
                  repeat;
                }
              }
            }
            [] tc_noac.timeout {
              log("*** " & testcasename() & ": PASS: IUT stops broadcasting Delta CTL ***");
              f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
            }
          } // End of 'alt' statement
          
          // Postamble
          f_cfDown_itss();
          
        } // End of function TC_SECPKI_ITSS_CTLDIST_04_BV_itss
        
        function f_TC_SECPKI_ITSS_CTLDIST_04_BV_pki() runs on ItsPkiHttp system ItsPkiItssSystem {
          // Local variable
          var HttpMessage v_response;
          var Headers v_headers;

          // Test component configuration
          f_cfHttpUp_tlm();
          
          // Test adapter configuration
          
          // Preamble
          tc_ac.start;
          alt {
            [] a_await_cpoc_http_request_from_iut(
                                                  mw_http_request(
                                                                  mw_http_request_get(
                                                                                      PICS_HTTP_GET_URI_ECTL
                                                                                      )),
                                                  v_response
                                                  ) {
              var HashedId8 v_rca_hashed_id8; // Used for signature
              var Oct32 v_rca_private_key;
              var EtsiTs103097Certificate v_rca_new; // The CERT_RCA_NEW
              var bitstring v_enc_msg;
              var ToBeSignedData v_tbs;
              var bitstring v_tbs_enc;
              var Oct32 v_tbs_signed;
              var Signature v_signature;
              var Ieee1609Dot2Data v_ieee1609dot2_signed_data;

              tc_ac.stop;

              // Read certificates
              f_getCertificateHash(PICS_IUT_CA_CERTIFICATE_ID, v_rca_hashed_id8);
              f_readSigningKey(PICS_IUT_CA_CERTIFICATE_ID, v_rca_private_key);
              f_readCertificate(cc_ectl_rca_new, v_rca_new);
              // Build the ToBeSignedTlmCtl data structure
              v_enc_msg := encvalue(
                                    valueof(
                                            m_to_be_signed_tlm_full_ctl(
                                                                        f_getCurrentTime() / 1000 + 3600,
                                                                        10,
                                                                        {
                                                                          m_ctrl_command_add(
                                                                                             m_ctl_entry_rca(
                                                                                                             m_root_ca_entry(
                                                                                                                             v_rca_new
                                                                                                                             )))
                                                                          }
                                                                        )));
              v_tbs := valueof(
                               m_toBeSignedData(
                                                m_signedDataPayload(
                                                                    m_etsiTs103097Data_unsecured(bit2oct(v_enc_msg))
                                                                    ),
                                                m_headerInfo_inner_pki_request(-, (f_getCurrentTime() * 1000)/*us*/)
                                                ));
              v_tbs_enc := encvalue(v_tbs);
              // Sign the certificate
              v_tbs_signed := f_signWithEcdsa(bit2oct(v_tbs_enc), v_rca_hashed_id8, v_rca_private_key);
              v_signature := valueof(
                                     m_signature_ecdsaNistP256(
                                                               m_ecdsaP256Signature(
                                                                                    m_eccP256CurvePoint_x_only(
                                                                                                               substr(v_tbs_signed, 0, 32)
                                                                                                               ),
                                                                                    substr(v_tbs_signed, 32, 32)
                                                                                    )));
              log(testcasename() & ": v_signature= ", v_signature);
              v_ieee1609dot2_signed_data := valueof(
                                                    m_etsiTs103097Data_signed(
                                                                              m_signedData(
                                                                                           sha256,
                                                                                           v_tbs,
                                                                                           m_signerIdentifier_digest(v_rca_hashed_id8),
                                                                                           v_signature
                                                                                           )));
              // Send response with CERT_RCA_NEW
              f_init_default_headers_list(-, "tlm_ectl", v_headers);
              f_http_send(
                          v_headers,
                          m_http_response(
                                          m_http_response_ok(
                                                             m_http_message_body_binary(
                                                                                        m_binary_body_ieee1609dot2_data(
                                                                                                                        v_ieee1609dot2_signed_data
                                                                                                                        )),
                                                             v_headers
                                                             )));
              
              log("*** " & testcasename() & ": INFO: CERT_RCA_NEW was sent to the IUT ***");
              f_selfOrClientSyncAndVerdict(c_prDone, e_success);
            }
            [] tc_ac.timeout {
              log("*** " & testcasename() & ": INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdict(c_prDone, e_timeout);
            }
          } // End of 'alt' statement
          
          // Test Body
          f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
          
          // Postamble
          f_cfHttpDown_tlm();
        } // End of function f_TC_SECPKI_ITSS_CTLDIST_04_BV_pki

      } // End of group f_TC_SECPKI_ITSS_CTLDIST_04_BV















      



    } // End of group itss_ctl_distribution
    
    group itss_crl_handling {
      // TODO To be done after validation of itss_ctl_handling group as CTL and CRL are close
    } // End of group itss_crl_handling
    
    group itss_crl_distribution {
      // TODO To be done after validation of itss_ctl_distribution group as CTL and CRL are close
    } // End of group itss_crl_distribution
    
  } // End of group itss_behavior

  group ca_behaviour {

    /**
     * @desc Check that the issuing certificate has version 3
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing version
     *                     indicating value 3
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_01_BV
     * @reference ETSI TS 103 097 [2], clause 6
     *            IEEE Std 1609.2 [3], clause 6.4.3
     */
    testcase TC_SECPKI_CA_CERTGEN_01_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
      
      // Test control
      if (not PICS_IUT_CA_ROLE) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
      
      // Test component configuration
      f_connect4SelfOrClientSync();
      
      // Test adapter configuration
      
      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
      
      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }
      
      // Postamble
      f_disconnect4SelfOrClientSync();
      
    } // End of testcase TC_SECPKI_CA_CERTGEN_01_BV
    
    /**
     * @desc Check that the issuing certificate has type explicit
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         CA is initialized with the explicit certificate (CERT_IUT_A_CA)
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the explicit certificate
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing version
     *                     indicating value 3
     *                 and containing type
     *                      indicating 'explicit'
     *                 and containing toBeSigned
     *                      containing verifyKeyIndicator
     *                          containing verificationKey
     *                 and containing signature
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_02_BV_01
     * @reference ETSI TS 103 097 [2], clause 6
     *            IEEE Std 1609.2 [3], clause 6.4.3
     */
    testcase TC_SECPKI_CA_CERTGEN_02_BV_01() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
        
      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES)) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
        
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
        
      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_02_BV_01

      /**
       * @desc Check that the CA, been authorized using explicit certificate, is able to issue an implicit certificate
       * <pre>
       * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and PICS_SEC_IMPLICIT_CERTIFICATES
       * Initial conditions: 
       *     with {
       *         CA is in 'operational' state
       *         CA is initialized with the explicit certificate (CERT_IUT_A_CA)
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the CA is requested to issue the implicit certificate
       *         }
       *         then {
       *             this certificate is of type EtsiTs103097Certificate
       *                 containing version
       *                     indicating value 3
       *                 and containing type
       *                      indicating 'implicit'
       *                 and containing toBeSigned
       *                      containing verifyKeyIndicator
       *                          containing reconstructionValue
       *                 and not containing signature
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_02_BV_02
       * @reference ETSI TS 103 097 [2], clause 6
       *            IEEE Std 1609.2 [3], clause 6.4.3
       */
    testcase TC_SECPKI_CA_CERTGEN_02_BV_02() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
        
      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) or not(PICS_SEC_IMPLICIT_CERTIFICATES)) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and PICS_SEC_IMPLICIT_CERTIFICATES required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
        
      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration
        
      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, true, true, true) == false) { // implicit, reconstructionKey and no signature
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_02_BV_02

      /**
       * @desc Check that the CA, been authorized using explicit certificate, is able to issue an implicit certificate
       * <pre>
       * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and PICS_SEC_IMPLICIT_CERTIFICATES
       * Initial conditions: 
       *     with {
       *         CA is in 'operational' state
       *         CA is initialized with the explicit certificate (CERT_IUT_I_AA)
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the CA is requested to issue the implicit certificate
       *         }
       *         then {
       *             this certificate is of type EtsiTs103097Certificate
       *                 containing version
       *                     indicating value 3
       *                 and containing type
       *                      indicating 'implicit'
       *                 and containing toBeSigned
       *                      containing verifyKeyIndicator
       *                          containing reconstructionValue
       *                 and not containing signature
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_02_BV_03
       * @reference ETSI TS 103 097 [2], clause 6
       *            IEEE Std 1609.2 [3], clause 6.4.3
       */
    testcase TC_SECPKI_CA_CERTGEN_02_BV_03() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
        
      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) or not(PICS_SEC_IMPLICIT_CERTIFICATES)) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and PICS_SEC_IMPLICIT_CERTIFICATES required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
        
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
        
      // Preamble
      v_result := f_get_root_ca_certificate("CERT_IUT_I_AA", -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate("CERT_IUT_I_AA", v_root_certificate) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_02_BV_03
    
    /**
     * @desc Check that the CA, been authorized using implicit certificate, does not issue an explicit certificate
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and PICS_SEC_IMPLICIT_CERTIFICATES
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         CA is initialized with the explicit certificate (CERT_IUT_I_AA)
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the explicit certificate
     *         }
     *         then {
     *             the CA doesn’t issue the certificate
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_02_BO_01
     * @reference ETSI TS 103 097 [2], clause 6
     *            IEEE Std 1609.2 [3], clause 6.4.3
     */
    testcase TC_SECPKI_CA_CERTGEN_02_BO_01() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
        
      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) or not(PICS_SEC_IMPLICIT_CERTIFICATES)) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and PICS_SEC_IMPLICIT_CERTIFICATES required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
        
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
        
      // Preamble
      f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
        
      // Test Body
      v_result := f_get_root_ca_certificate("CERT_IUT_I_AA", true, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": PASS: No root certificate was generated ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        log("*** " & testcasename() & ": FAIL: Root certificate shll not be generated ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      }
      
      // Postamble
      f_disconnect4SelfOrClientSync();
      
    } // End of testcase TC_SECPKI_CA_CERTGEN_02_BO_01
    
    /**
     * @desc Check that CA issues certificate conformed to ETSI TS 103 097 [1], clause 6
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         CA is initialized with the explicit certificate (CERT_IUT_I_AA)
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBesigned
     *                     containing id
     *                          indicating 'none' or 'name'
     *                 and containing cracaId
     *                      indicating '000000'H
     *                 and containing crlSeries
     *                      indicating '0'D
     *                 and not containing certRequestPermissions
     *                 and not containing canRequestRollover
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_03_BV
     * @reference ETSI TS 103 097 [2], clause 6
     */
    testcase TC_SECPKI_CA_CERTGEN_03_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
      
      // Test control
      if (not PICS_IUT_CA_ROLE) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
      
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
        
      // Preamble
      v_result := f_get_root_ca_certificate("CERT_IUT_I_AA", -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate("CERT_IUT_I_AA", v_root_certificate) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_03_BV
    
    /**
     * @desc Check that the certificate issuer of certificates is referenced using digest
     *       Check that right digest field is used to reference to the certificate
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         CA is initialized with the explicit certificate (C_ISSUER)
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the explicit certificate
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing issuer
     *                     containing self
     *                     or containing X_DIGEST
     *                         indicating last 8 bytes of the hash of the certificate calculated using X_ALGORITHM
     *                             referenced to certificate
     *                 and containing toBeSigned
     *                     containing verifyKeyIndicator
     *                         containing verificationKey
     *                             containing X_KEY
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_04_BV
     * @reference ETSI TS 103 097 [2], clause 6
     */
    testcase TC_SECPKI_CA_CERTGEN_04_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var charstring v_authorized_certificate;
      var integer v_result;
      var Certificate v_root_certificate;
      
      // Test control
      if (not PICS_IUT_CA_ROLE and not PICS_SEC_SHA256 and not PICS_SEC_BRAINPOOL_P256R1 and not PICS_SEC_BRAINPOOL_P384R1) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and (PICS_SEC_SHA256 or PICS_SEC_BRAINPOOL_P256R1 or PICS_SEC_BRAINPOOL_P384R1 required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
      
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
        
      // Preamble
      v_authorized_certificate := "CERT_IUT_I_AA";
      v_result := f_get_root_ca_certificate(v_authorized_certificate, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate(v_authorized_certificate, v_root_certificate) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_04_BV
    
    /**
     * @desc Check that the CA is able to issue the certificate with the well-formed circular region validity restriction
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_CIRCULAR_REGION
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         the CA is authorized with CA certificate 
     *             containing toBeSigned
     *                 containing region
     *                     indicating REGION
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *                 containing circular region restriction
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing region
     *                         containing circularRegion
     *                             containing center
     *                                 indicating a point inside the REGION
     *                             and containing radius
     *                                 indicating a value when all points of the circle are inside the REGION
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_05_BV
     * @reference IEEE Std 1609.2 [2], clauses 6.4.20, 6.4.17, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_05_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
      
      // Test control
      if (not PICS_IUT_CA_ROLE and not PICS_SEC_CIRCULAR_REGION) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_CIRCULAR_REGION required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
      
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }
        
      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_05_BV
    
    /**
     * @desc Check that the CA is able to issue the certificate with the well-formed rectangular region validity restriction
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_RECTANGULAR_REGION
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         the CA is authorized with CA certificate 
     *             containing toBeSigned
     *                 containing region
     *                     indicating REGION
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *                 containing rectangular region restriction
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing region
     *                         containing rectangularRegion
     *                             containing items of type RectangularRegion
     *                                containing northwest
     *                                     indicating a point inside the REGION
     *                                 and containing southeast
     *                                     indicating a point on the south and east from northwest
     *                                     and inside the REGION
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_06_BV
     * @reference IEEE Std 1609.2 [2], clauses 6.4.20, 6.4.17, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_06_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
      
      // Test control
      if (not PICS_IUT_CA_ROLE and not PICS_SEC_RECTANGULAR_REGION) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_RECTANGULAR_REGION required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
      
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }
        
      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_06_BV
    
    /**
     * @desc Check that the CA is able to issue the certificate with the well-formed polygonal region validity restriction
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_POLYGONAL_REGION
     * Initial conditions: