ItsPki_TestCases.ttcn

            [] tc_ac.timeout {
              log("*** " & testcasename() & ": INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictPreamble(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement
          
          // Test Body
          // Delta CTL boradcasting from another node
          f_broadcast_delta_ctl(cc_ectl_rca_new, v_delta_ctl);
          // Check that the IUT stops broadcasting Delta CTL
          geoNetworkingPort.clear;
          tc_noac.start;
          alt {
            [] geoNetworkingPort.receive(
                                         mw_geoNwInd(
                                                     mw_geoNwSecPdu(
                                                                    mw_etsiTs103097Data_signed(
                                                                                               mw_signedData
                                                                                               )))) -> value v_geonetworking_message {
              tc_noac.stop;
              
              if (f_verify_and_extract_payload(v_geonetworking_message.msgIn, -, v_payload) == false) {
                log("*** " & testcasename() & ": INCONC: Failed to verifiy payload ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_timeout);
              } else {
                // TODO Check payload
                if (substr(v_payload, 0, 2) == int2oct(2014, 2)) { // TODO Reorganize CAM/DENM/BTP test suites
                  log("*** " & testcasename() & ": FAIL: The IUT shall not continue Delta CTL broadcasting ***");
                  f_selfOrClientSyncAndVerdict(c_tbDone, e_error);
                } else {
                  tc_noac.start;
                  repeat;
                }
              }
            }
            [] tc_noac.timeout {
              log("*** " & testcasename() & ": PASS: IUT stops broadcasting Delta CTL ***");
              f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
            }
          } // End of 'alt' statement
          
          // Postamble
          f_cfDown_itss();
          
        } // End of function TC_SECPKI_ITSS_CTLDIST_04_BV_itss
        
        function f_TC_SECPKI_ITSS_CTLDIST_04_BV_pki() runs on ItsPkiHttp system ItsPkiItssSystem {
          // Local variable
          var HttpMessage v_response;
          var Headers v_headers;

          // Test component configuration
          f_cfHttpUp_tlm();
          
          // Test adapter configuration
          
          // Preamble
          tc_ac.start;
          alt {
            [] a_await_cpoc_http_request_from_iut(
                                                  mw_http_request(
                                                                  mw_http_request_get(
                                                                                      PICS_HTTP_GET_URI_ECTL
                                                                                      )),
                                                  v_response
                                                  ) {
              var HashedId8 v_rca_hashed_id8; // Used for signature
              var Oct32 v_rca_private_key;
              var EtsiTs103097Certificate v_rca_new; // The CERT_RCA_NEW
              var bitstring v_enc_msg;
              var ToBeSignedData v_tbs;
              var bitstring v_tbs_enc;
              var Oct32 v_tbs_signed;
              var Signature v_signature;
              var Ieee1609Dot2Data v_ieee1609dot2_signed_data;

              tc_ac.stop;

              // Read certificates
              f_getCertificateHash(PICS_IUT_CA_CERTIFICATE_ID, v_rca_hashed_id8);
              f_readSigningKey(PICS_IUT_CA_CERTIFICATE_ID, v_rca_private_key);
              f_readCertificate(cc_ectl_rca_new, v_rca_new);
              // Build the ToBeSignedTlmCtl data structure
              v_enc_msg := encvalue(
                                    valueof(
                                            m_to_be_signed_tlm_full_ctl(
                                                                        f_getCurrentTime() / 1000 + 3600,
                                                                        10,
                                                                        {
                                                                          m_ctrl_command_add(
                                                                                             m_ctl_entry_rca(
                                                                                                             m_root_ca_entry(
                                                                                                                             v_rca_new
                                                                                                                             )))
                                                                          }
                                                                        )));
              v_tbs := valueof(
                               m_toBeSignedData(
                                                m_signedDataPayload(
                                                                    m_etsiTs103097Data_unsecured(bit2oct(v_enc_msg))
                                                                    ),
                                                m_headerInfo_inner_pki_request(-, (f_getCurrentTime() * 1000)/*us*/)
                                                ));
              v_tbs_enc := encvalue(v_tbs);
              // Sign the certificate
              v_tbs_signed := f_signWithEcdsa(bit2oct(v_tbs_enc), v_rca_hashed_id8, v_rca_private_key);
              v_signature := valueof(
                                     m_signature_ecdsaNistP256(
                                                               m_ecdsaP256Signature(
                                                                                    m_eccP256CurvePoint_x_only(
                                                                                                               substr(v_tbs_signed, 0, 32)
                                                                                                               ),
                                                                                    substr(v_tbs_signed, 32, 32)
                                                                                    )));
              log(testcasename() & ": v_signature= ", v_signature);
              v_ieee1609dot2_signed_data := valueof(
                                                    m_etsiTs103097Data_signed(
                                                                              m_signedData(
                                                                                           sha256,
                                                                                           v_tbs,
                                                                                           m_signerIdentifier_digest(v_rca_hashed_id8),
                                                                                           v_signature
                                                                                           )));
              // Send response with CERT_RCA_NEW
              f_init_default_headers_list(-, "tlm_ectl", v_headers);
              f_http_send(
                          v_headers,
                          m_http_response(
                                          m_http_response_ok(
                                                             m_http_message_body_binary(
                                                                                        m_binary_body_ieee1609dot2_data(
                                                                                                                        v_ieee1609dot2_signed_data
                                                                                                                        )),
                                                             v_headers
                                                             )));
              
              log("*** " & testcasename() & ": INFO: CERT_RCA_NEW was sent to the IUT ***");
              f_selfOrClientSyncAndVerdict(c_prDone, e_success);
            }
            [] tc_ac.timeout {
              log("*** " & testcasename() & ": INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdict(c_prDone, e_timeout);
            }
          } // End of 'alt' statement
          
          // Test Body
          f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
          
          // Postamble
          f_cfHttpDown_tlm();
        } // End of function f_TC_SECPKI_ITSS_CTLDIST_04_BV_pki

      } // End of group f_TC_SECPKI_ITSS_CTLDIST_04_BV















      



    } // End of group itss_ctl_distribution
    
    group itss_crl_handling {
      // TODO To be done after validation of itss_ctl_handling group as CTL and CRL are close
    } // End of group itss_crl_handling
    
    group itss_crl_distribution {
      // TODO To be done after validation of itss_ctl_distribution group as CTL and CRL are close
    } // End of group itss_crl_distribution
    
  } // End of group itss_behavior

  group ca_behaviour {

    /**
     * @desc Check that the issuing certificate has version 3
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing version
     *                     indicating value 3
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_01_BV
     * @reference ETSI TS 103 097 [2], clause 6
     *            IEEE Std 1609.2 [3], clause 6.4.3
     */
    testcase TC_SECPKI_CA_CERTGEN_01_BV() runs on ItsMtc system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
      
      // Test control
      if (not PICS_IUT_CA_ROLE) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
      
      // Test component configuration
      f_connect4SelfOrClientSync();
      
      // Test adapter configuration
      
      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
      
      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }
      
      // Postamble
      f_disconnect4SelfOrClientSync();
      
    } // End of testcase TC_SECPKI_CA_CERTGEN_01_BV
    
    /**
     * @desc Check that the issuing certificate has type explicit
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         CA is initialized with the explicit certificate (CERT_IUT_A_CA)
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the explicit certificate
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing version
     *                     indicating value 3
     *                 and containing type
     *                      indicating 'explicit'
     *                 and containing toBeSigned
     *                      containing verifyKeyIndicator
     *                          containing verificationKey
     *                 and containing signature
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_02_BV_01
     * @reference ETSI TS 103 097 [2], clause 6
     *            IEEE Std 1609.2 [3], clause 6.4.3
     */
    testcase TC_SECPKI_CA_CERTGEN_02_BV_01() runs on ItsMtc system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
        
      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES)) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
        
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
        
      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_02_BV_01

      /**
       * @desc Check that the CA, been authorized using explicit certificate, is able to issue an implicit certificate
       * <pre>
       * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and PICS_SEC_IMPLICIT_CERTIFICATES
       * Initial conditions: 
       *     with {
       *         CA is in 'operational' state
       *         CA is initialized with the explicit certificate (CERT_IUT_A_CA)
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the CA is requested to issue the implicit certificate
       *         }
       *         then {
       *             this certificate is of type EtsiTs103097Certificate
       *                 containing version
       *                     indicating value 3
       *                 and containing type
       *                      indicating 'implicit'
       *                 and containing toBeSigned
       *                      containing verifyKeyIndicator
       *                          containing reconstructionValue
       *                 and not containing signature
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_02_BV_02
       * @reference ETSI TS 103 097 [2], clause 6
       *            IEEE Std 1609.2 [3], clause 6.4.3
       */
    testcase TC_SECPKI_CA_CERTGEN_02_BV_02() runs on ItsMtc system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
        
      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) or not(PICS_SEC_IMPLICIT_CERTIFICATES)) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and PICS_SEC_IMPLICIT_CERTIFICATES required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
        
      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration
        
      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, true, true, true) == false) { // implicit, reconstructionKey and no signature
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_02_BV_02

      /**
       * @desc Check that the CA, been authorized using explicit certificate, is able to issue an implicit certificate
       * <pre>
       * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and PICS_SEC_IMPLICIT_CERTIFICATES
       * Initial conditions: 
       *     with {
       *         CA is in 'operational' state
       *         CA is initialized with the explicit certificate (CERT_IUT_I_AA)
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the CA is requested to issue the implicit certificate
       *         }
       *         then {
       *             this certificate is of type EtsiTs103097Certificate
       *                 containing version
       *                     indicating value 3
       *                 and containing type
       *                      indicating 'implicit'
       *                 and containing toBeSigned
       *                      containing verifyKeyIndicator
       *                          containing reconstructionValue
       *                 and not containing signature
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_02_BV_03
       * @reference ETSI TS 103 097 [2], clause 6
       *            IEEE Std 1609.2 [3], clause 6.4.3
       */
    testcase TC_SECPKI_CA_CERTGEN_02_BV_03() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
        
      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) or not(PICS_SEC_IMPLICIT_CERTIFICATES)) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and PICS_SEC_IMPLICIT_CERTIFICATES required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
        
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
        
      // Preamble
      v_result := f_get_root_ca_certificate("CERT_IUT_I_AA", -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate("CERT_IUT_I_AA", v_root_certificate) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_02_BV_03
    
    /**
     * @desc Check that the CA, been authorized using implicit certificate, does not issue an explicit certificate
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and PICS_SEC_IMPLICIT_CERTIFICATES
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         CA is initialized with the explicit certificate (CERT_IUT_I_AA)
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the explicit certificate
     *         }
     *         then {
     *             the CA doesn’t issue the certificate
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_02_BO_01
     * @reference ETSI TS 103 097 [2], clause 6
     *            IEEE Std 1609.2 [3], clause 6.4.3
     */
    testcase TC_SECPKI_CA_CERTGEN_02_BO_01() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
        
      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) or not(PICS_SEC_IMPLICIT_CERTIFICATES)) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and PICS_SEC_IMPLICIT_CERTIFICATES required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
        
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
        
      // Preamble
      f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
        
      // Test Body
      v_result := f_get_root_ca_certificate("CERT_IUT_I_AA", true, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": PASS: No root certificate was generated ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        log("*** " & testcasename() & ": FAIL: Root certificate shll not be generated ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      }
      
      // Postamble
      f_disconnect4SelfOrClientSync();
      
    } // End of testcase TC_SECPKI_CA_CERTGEN_02_BO_01
    
    /**
     * @desc Check that CA issues certificate conformed to ETSI TS 103 097 [1], clause 6
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         CA is initialized with the explicit certificate (CERT_IUT_I_AA)
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBesigned
     *                     containing id
     *                          indicating 'none' or 'name'
     *                 and containing cracaId
     *                      indicating '000000'H
     *                 and containing crlSeries
     *                      indicating '0'D
     *                 and not containing certRequestPermissions
     *                 and not containing canRequestRollover
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_03_BV
     * @reference ETSI TS 103 097 [2], clause 6
     */
    testcase TC_SECPKI_CA_CERTGEN_03_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
      
      // Test control
      if (not PICS_IUT_CA_ROLE) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
      
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
        
      // Preamble
      v_result := f_get_root_ca_certificate("CERT_IUT_I_AA", -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate("CERT_IUT_I_AA", v_root_certificate) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_03_BV
    
    /**
     * @desc Check that the certificate issuer of certificates is referenced using digest
     *       Check that right digest field is used to reference to the certificate
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         CA is initialized with the explicit certificate (C_ISSUER)
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the explicit certificate
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing issuer
     *                     containing self
     *                     or containing X_DIGEST
     *                         indicating last 8 bytes of the hash of the certificate calculated using X_ALGORITHM
     *                             referenced to certificate
     *                 and containing toBeSigned
     *                     containing verifyKeyIndicator
     *                         containing verificationKey
     *                             containing X_KEY
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_04_BV
     * @reference ETSI TS 103 097 [2], clause 6
     */
    testcase TC_SECPKI_CA_CERTGEN_04_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var charstring v_authorized_certificate;
      var integer v_result;
      var Certificate v_root_certificate;
      
      // Test control
      if (not PICS_IUT_CA_ROLE and not PICS_SEC_SHA256 and not PICS_SEC_BRAINPOOL_P256R1 and not PICS_SEC_BRAINPOOL_P384R1) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and (PICS_SEC_SHA256 or PICS_SEC_BRAINPOOL_P256R1 or PICS_SEC_BRAINPOOL_P384R1 required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
      
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
        
      // Preamble
      v_authorized_certificate := "CERT_IUT_I_AA";
      v_result := f_get_root_ca_certificate(v_authorized_certificate, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate(v_authorized_certificate, v_root_certificate) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_04_BV
    
    /**
     * @desc Check that the CA is able to issue the certificate with the well-formed circular region validity restriction
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_CIRCULAR_REGION
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         the CA is authorized with CA certificate 
     *             containing toBeSigned
     *                 containing region
     *                     indicating REGION
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *                 containing circular region restriction
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing region
     *                         containing circularRegion
     *                             containing center
     *                                 indicating a point inside the REGION
     *                             and containing radius
     *                                 indicating a value when all points of the circle are inside the REGION
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_05_BV
     * @reference IEEE Std 1609.2 [2], clauses 6.4.20, 6.4.17, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_05_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
      
      // Test control
      if (not PICS_IUT_CA_ROLE and not PICS_SEC_CIRCULAR_REGION) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_CIRCULAR_REGION required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
      
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }
        
      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_05_BV
    
    /**
     * @desc Check that the CA is able to issue the certificate with the well-formed rectangular region validity restriction
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_RECTANGULAR_REGION
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         the CA is authorized with CA certificate 
     *             containing toBeSigned
     *                 containing region
     *                     indicating REGION
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *                 containing rectangular region restriction
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing region
     *                         containing rectangularRegion
     *                             containing items of type RectangularRegion
     *                                containing northwest
     *                                     indicating a point inside the REGION
     *                                 and containing southeast
     *                                     indicating a point on the south and east from northwest
     *                                     and inside the REGION
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_06_BV
     * @reference IEEE Std 1609.2 [2], clauses 6.4.20, 6.4.17, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_06_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
      
      // Test control
      if (not PICS_IUT_CA_ROLE and not PICS_SEC_RECTANGULAR_REGION) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_RECTANGULAR_REGION required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
      
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }
        
      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_06_BV
    
    /**
     * @desc Check that the CA is able to issue the certificate with the well-formed polygonal region validity restriction
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_POLYGONAL_REGION
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         the CA is authorized with CA certificate 
     *             containing toBeSigned
     *                 containing region
     *                     indicating REGION
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *                 containing polygonal region restriction
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing region
     *                         containing polygonalRegion
     *                             containing more than 2 items of type TwoDLocation
     *                                indicating points inside the REGION
     *                                 and indicating unintercepting segments
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_07_BV
     * @reference IEEE Std 1609.2 [2], clauses 6.4.20, 6.4.17, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_07_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
      
      // Test control
      if (not PICS_IUT_CA_ROLE and not PICS_SEC_POLYGONAL_REGION) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_POLYGONAL_REGION required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
      
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }
        
      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_07_BV
    
    /**
     * @desc Check that the CA is able to issue the certificate with identified region validity restriction contains values that correspond to numeric country codes as defined by United Nations Statistics Division [5]
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_IDENTIFIED_REGION
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         the CA is authorized with CA certificate 
     *             containing toBeSigned
     *                 containing region
     *                     indicating REGION
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the certificate
     *                 containing identified region validity restriction
     *                     indicating country or area COUNTRY
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing region
     *                         containing identifiedRegion
     *                             containing 1 entry of type IdentifiedRegion
     *                                 containing countryOnly
     *                                     indicating integer representation of the identifier of country or area COUNTRY
     *                             or containing countryAndRegions
     *                                 containing countryOnly
     *                                     indicating integer representation of the identifier of country or area COUNTRY
     *                             or containing countryAndSubregions
     *                                 containing country
     *                                     indicating integer representation of the identifier of country or area COUNTRY
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v1.1.4 SECPKI_CA_CERTGEN_08_BV
     * @reference IEEE Std 1609.2 [2], clauses 6.4.23
     */
    testcase TC_SECPKI_CA_CERTGEN_08_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;
      
      // Test control
      if (not PICS_IUT_CA_ROLE and not PICS_SEC_IDENTIFIED_REGION) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_IDENTIFIED_REGION required for executing the TC ***");
        setverdict(inconc);
        stop;
      }
      
      // Test component configuration
      f_connect4SelfOrClientSync();
        
      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }
        
      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }
        
      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_08_BV
    
    /**
     * @desc Check that the identified region validity restriction of the subordinate certificate is included in the identified region validity restriction of the issuing certificate
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_IDENTIFIED_REGION
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         the CA is authorized with CA certificate