ItsPki_TestCases.ttcn

      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) and not PICS_SEC_SHA256 and not PICS_SEC_BRAINPOOL_P256R1 and not PICS_SEC_BRAINPOOL_P384R1) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and (PICS_SEC_SHA256 or PICS_SEC_BRAINPOOL_P256R1 or PICS_SEC_BRAINPOOL_P384R1 required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_11_BV

    /**
     * @desc Check that the certificate encryption key contains ECC point of type set to either compressed_lsb_y_0, compressed_lsb_y_1 or uncompressed
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the explicit certificate
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing encryptionKey
     *                         containing publicKey
     *                             containing X_KEY
     *                                 containing uncompressed
     *                                 or containing compressed-y-0
     *                                 or containing compressed-y-1
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_12_BV
     * @reference IEEE Std 1609.2 [3], clause 6.3.38
     */
    testcase TC_SECPKI_CA_CERTGEN_12_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) and not PICS_SEC_SHA256 and not PICS_SEC_BRAINPOOL_P256R1) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and (PICS_SEC_SHA256 or PICS_SEC_BRAINPOOL_P256R1 required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_12_BV

    /**
     * @desc Check the explicit certificate signature
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         and the CA is authorized with explicit certificate
     *             containing toBeSigned
     *                 containing verifyKeyIndicator
     *                     containing verificationKey
     *                         containing X_KEY
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is requested to issue the explicit certificate
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing issuer
     *                     referencing the certificate
     *                         containing toBeSigned
     *                             containing verifyKeyIndicator
     *                                 containing verificationKey
     *                                     containing X_KEY
     *                                         indicating KEY
     *                 and containing signature
     *                     containing X_SIGNATURE
     *                         verifiable using KEY
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_13_BV_01
     * @reference ETSI TS 103 097 [1], clause 6
     */
    testcase TC_SECPKI_CA_CERTGEN_13_BV_01() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) and not PICS_SEC_SHA256 and not PICS_SEC_BRAINPOOL_P256R1 and not PICS_SEC_BRAINPOOL_P384R1) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and (PICS_SEC_SHA256 or PICS_SEC_BRAINPOOL_P256R1 or PICS_SEC_BRAINPOOL_P384R1 required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_13_BV_01

    /**
     * @desc Check the explicit certificate signature
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         and the CA is authorized with explicit certificate
     *             containing toBeSigned
     *                 containing verifyKeyIndicator
     *                     containing verificationKey
     *                         containing X_KEY
     *         and the CA issued the implicit certificate of type EtsiTs103097Certificate (CERT)
     *             not containing signature
     *             and containing issuer
     *                 referencing the certificate
     *                     containing toBeSigned
     *                         containing verifyKeyIndicator
     *                             containing reconstructionValue
     *                                 indicating VALUE
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA is calculated the digital signature
     *                 using the private key associated with the CERT
     *         }
     *         then {
     *             this signature can be verified using public key
     *                 reconstructed using VALUE and KEY
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_13_BV_02
     * @reference ETSI TS 103 097 [1], clause 6
     */
    testcase TC_SECPKI_CA_CERTGEN_13_BV_02() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if ((not PICS_IUT_CA_ROLE) or not(PICS_SEC_EXPLICIT_CERTIFICATES) and not PICS_SEC_SHA256 and not PICS_SEC_BRAINPOOL_P256R1 and not PICS_SEC_BRAINPOOL_P384R1) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE and PICS_SEC_EXPLICIT_CERTIFICATES and (PICS_SEC_SHA256 or PICS_SEC_BRAINPOOL_P256R1 or PICS_SEC_BRAINPOOL_P384R1 required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, true, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_13_BV_02

    /**
     * @desc Check that all PSID entries of the appPermissions component of the certificate are unique
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA issued the certificate
     *                 containing toBeSigned
     *                     containing appPermissions
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing appPermissions
     *                         containing items of type PsidSsp
     *                             containing psid
     *                                 indicating unique values in this sequence
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_14_BV
     * @reference ETSI TS 103 097 [1], clauses 6.4.28, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_14_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if (not PICS_IUT_CA_ROLE) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_14_BV

    /**
     * @desc Check that all PSID entries of the appPermissions component of the certificate are also contained in the certIssuePermissions component in the issuing certificate
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA issued the certificate
     *                 containing toBeSigned
     *                     containing appPermissions
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing issuer
     *                     referenced to the certificate
     *                         containing toBeSigned
     *                             containing certIssuePermissions
     *                                 containing items of type PsidGroupPermissions
     *                                     containing eeType
     *                                         indicating app(0)
     *                                     and containing subjectPermissions
     *                                         containing explicit
     *                                             containing items of type PsidSspRange
     *                                                 indicating X_PSID_RANGE_LIST
     *                                         or containing all
     *                         and containing toBeSigned
     *                             containing appPermissions
     *                                 containing items of type PsidSsp
     *                                     containing psid
     *                                         contained in the X_PSID_RANGE_LIST
     *                                             as a psid
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_15_BV
     * @reference ETSI TS 103 097 [1], clauses 6.4.28, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_15_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if (not PICS_IUT_CA_ROLE) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_15_BV

    /**
     * @desc Check that all PSID entries of the certIssuePermissions component of the certificate are unique
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA issued the certificate
     *                 containing toBeSigned
     *                     containing certIssuePermissions
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing issuer
     *                     containing toBeSigned
     *                         containing certIssuePermissions
     *                             containing items of type PsidGroupPermissions
     *                                 containing subjectPermissions
     *                                     containing explicit
     *                                     and containing items of type PsidSspRange
     *                                         containing psid
     *                                             indicating unique values in this sequence
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_16_BV
     * @reference ETSI TS 103 097 [1], clauses 6.4.28, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_16_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if (not PICS_IUT_CA_ROLE) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_16_BV

    /**
     * @desc Check that SSP field in each entry of the appPermissions component of the AT certificate is equal to or a subset of the SSP Range in the corresponding issuing entry
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA issued the certificate
     *                 containing toBeSigned
     *                     containing certIssuePermissions
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing issuer
     *                     referenced to the certificate
     *                         containing toBeSigned
     *                             containing certIssuePermissions
     *                                 containing items of type PsidGroupPermissions
     *                                       containing eeType
     *                                         indicating app(0)
     *                                       and containing subjectPermissions
     *                                         containing explicit
     *                                             containing items of type PsidSspRange
     *                                                 containing psid
     *                                                     indicating X_PSID_AA
     *                                                 containing sspRange
     *                                                     indicating X_SSP_AA [ X_PSID_AA ]
     *                                             or containing all
     *                 and containing toBeSigned
     *                         containing appPermissions
     *                             containing items of type PsidSsp
     *                                 containing psid
     *                                     indicating value equal to X_PSID_AA
     *                                 containing ssp
     *                                     indicating value permitted by X_SSP_AA [ X_PSID_AA ]
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_17_BV
     * @reference ETSI TS 103 097 [1], clauses 6.4.28, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_17_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if (not PICS_IUT_CA_ROLE) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_17_BV

    /**
     * @desc Check that the validityPeriod of the subordinate certificate is inside the validityPeriod of the issuing certificate
     * <pre>
     * Pics Selection: PICS_IUT_CA_ROLE
     * Initial conditions: 
     *     with {
     *         CA is in 'operational' state
     *         and the CA is authorized with CA certificate
     *             containing toBeSigned
     *                 containing validityPeriod
     *                     containing start
     *                         indicating X_START_VALIDITY_CA
     *                     containing duration
     *                         indicating X_DURATION_CA
     *     }
     * Expected behaviour:
     *     ensure that {
     *         when {
     *             the CA issued the certificate
     *                 containing toBeSigned
     *                     containing certIssuePermissions
     *         }
     *         then {
     *             this certificate is of type EtsiTs103097Certificate
     *                 containing toBeSigned
     *                     containing validityPeriod
     *                         containing start
     *                             indicating X_START_VALIDITY ( X_START_VALIDITY >= X_START_VALIDITY_CA )
     *                         and containing duration
     *                             indicating value <= X_START_VALIDITY_CA + X_DURATION_CA - X_START_VALIDITY
     *         }
     *     }
     * </pre>
     * 
     * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_CA_CERTGEN_18_BV
     * @reference ETSI TS 103 097 [1], clauses 6.4.28, 5.1.2.4
     */
    testcase TC_SECPKI_CA_CERTGEN_18_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
      // Local variables
      var integer v_result;
      var Certificate v_root_certificate;

      // Test control
      if (not PICS_IUT_CA_ROLE) {
        log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
        setverdict(inconc);
        stop;
      }

      // Test component configuration
      f_connect4SelfOrClientSync();

      // Test adapter configuration
      if (not f_loadCertificates(PX_IUT_SEC_CONFIG_NAME) ) {
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
        stop;
      }

      // Preamble
      v_result := f_get_root_ca_certificate(-, -, v_root_certificate);
      if (v_result == -1) {
        log("*** " & testcasename() & ": INCONC: Fail to retrive the RCA ***");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
      } else {
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
      }

      // Test Body
      if (f_verify_rca_certificate(-, v_root_certificate, -, -, -, -, -, -, -, true) == false) {
        log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
      } else {
        log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
        f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
      }

      // Postamble
      f_disconnect4SelfOrClientSync();

    } // End of testcase TC_SECPKI_CA_CERTGEN_18_BV

  } // End of group ca_behaviour

  group ea_behavior {

    group ea_helpers {

    } // End of group ea_helpers

    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.4.1  Enrollment request handling
    group ea_enrolment_request_handling {

      /**
       * @desc The EnrolmentResponse message shall be sent by the EA to the  ITS-S across the interface at 
       *       reference point S3 in response to a received EnrolmentRequest message.
       * <pre>
       * Pics Selection: PICS_IUT_EA_ROLE
       * Initial conditions: 
       *     with {
       *         the IUT being in the "operational state"
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT receives an EnrolmentRequestMessage across the interface at the reference point S3
       *         }
       *         then {
       *             the IUT answers with an EnrolmentResponseMessage across the interface at reference point S3
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 TP SECPKI_EA_ENR_RCV_01_BV
       * @reference ETSI TS 102 941, clause 6.2.3.2.2
       */
      testcase TC_SECPKI_EA_ENR_RCV_01_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
        // Local variables
        var Oct32 v_private_key;
        var Oct32 v_public_compressed_key;
        var integer v_compressed_mode;
        var Oct32 v_request_hash;
        var Oct16 v_encrypted_sym_key;
        var Oct16 v_aes_sym_key;
        var HashedId8 v_aes_sym_key_hashed_id8;
        var Oct16 v_authentication_vector;
        var Oct12 v_nonce;
        var octetstring v_salt;
        var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
        var Headers v_headers;
        var HttpMessage v_response;
        var EtsiTs102941Data v_etsi_ts_102941_data;

        // Test control
        if (not PICS_IUT_EA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_EA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID);

        // Test adapter configuration

        // Preamble
        f_http_build_inner_ec_request(v_private_key, v_public_compressed_key, v_compressed_mode, v_aes_sym_key, v_encrypted_sym_key, v_authentication_vector, v_nonce, v_salt, v_ieee1609dot2_signed_and_encrypted_data, v_request_hash);
        v_aes_sym_key_hashed_id8 := f_hashedId8FromSha256(f_hashWithSha256('80'O & v_aes_sym_key)); // Used to match the response
        f_init_default_headers_list(-, "inner_ec_request", v_headers);
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);

        // Test Body
        f_http_send(
                    v_headers,
                    m_http_request(
                                   m_http_request_post(
                                                       PICS_HTTP_POST_URI_EC,
                                                       v_headers,
                                                       m_http_message_body_binary(
                                                                                  m_binary_body_ieee1609dot2_data(
                                                                                                                  v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                  )))));
        tc_ac.start;
        alt {
          [] a_await_ec_http_response_from_iut(
                                               mw_http_response(
                                                                mw_http_response_ok(
                                                                                    mw_http_message_body_binary(
                                                                                                                mw_binary_body_ieee1609dot2_data(
                                                                                                                                                 mw_enrolmentResponseMessage(
                                                                                                                                                                             mw_encryptedData(
                                                                                                                                                                                              { *, mw_recipientInfo_pskRecipInfo(v_aes_sym_key_hashed_id8), * },
                                                                                                                                                                                              mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                              )))))),
                                               v_response
                                               ) {
            tc_ac.stop;

            if (f_verify_pki_response_message(v_private_key, v_aes_sym_key, v_authentication_vector, vc_eaWholeHash, v_response.response.body.binary_body.ieee1609dot2_data, true, 1, v_etsi_ts_102941_data) == false) {
              log("*** " & testcasename() & ": FAIL: Failed to verify PKI message ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
            } else {
              log("*** " & testcasename() & ": PASS: InnerEcResponse received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
            }
          }
          [] tc_ac.timeout {
            log("*** " & testcasename() & ": INCONC: Expected message not received ***");
            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
          }
        } // End of 'alt' statement

        // Postamble
        f_cfHttpDown();

      } // End of testcase TC_SECPKI_EA_ENR_RCV_01_BV

      /**
       * @desc Check that EA doesn't accept Enrolment rekeying request when enrolment is not permitted 
       *       by signing certificate.
       * <pre>
       * Pics Selection: PICS_IUT_EA_ROLE
       * Initial conditions: 
       *     with {
       *         the IUT being in the "operational state"
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT receives an EnrolmentRequestMessage
       *                 containing an encrypted EtsiTs103097Data-Signed
       *                     containing signer
       *                         containing digest
       *                             indicating HashedId8 of the certificate CERT
       *                                 containing appPermissions
       *                                     not containing an item of type PsidSsp
       *                                         containing psid
       *                                             indicating AID_CERT_REQ
       *                                     or containing an item of type PsidSsp
       *                                         containing psid
       *                                             indicating AID_CERT_REQ
       *                                         and containing ssp
       *                                             containing opaque[0] (version)
       *                                                 indicating other value than 1
       *                                             or containing opaque[1] (value)
       *                                                 indicating "Enrolment Request" (bit 1) set to 0
       *         }
       *         then {
       *             the IUT answers with an EnrolmentResponseMessage
       *                 containing InnerECResponse
       *                     containing responseCode
       *                         indicating "deniedpermissions"
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 TP SECPKI_EA_ENR_RCV_02_BI
       * @reference ETSI TS 102 941, clause B.5
       */
      testcase TC_SECPKI_EA_ENR_RCV_02_BI_01() runs on ItsPkiHttp system ItsPkiHttpSystem {
        // Local variables
        var Oct32 v_private_key;
        var Oct32 v_public_compressed_key;
        var integer v_compressed_mode;
        var Oct32 v_request_hash;
        var Oct16 v_encrypted_sym_key;
        var Oct16 v_aes_sym_key;
        var Oct16 v_authentication_vector;
        var Oct12 v_nonce;
        var octetstring v_salt;
        var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
        var Headers v_headers;
        var HttpMessage v_response;
        var EtsiTs102941Data v_etsi_ts_102941_data;

        // Test control
        if (not PICS_IUT_EA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_EA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID);
        //        f_cfHttpUp("CERT_TS_A_EA_AA_AUTHVAL_RCV_02_BI_01", PICS_TS_AA_CERTIFICATE_ID);

        // Test adapter configuration

        // Preamble
        f_http_build_inner_ec_request_with_wrong_parameters({ valueof(m_appPermissions(c_its_aid_CAM, { bitmapSsp := PX_INNER_EC_CERTFICATE_BITMAP_SSP_SCR })) }, -, f_getCurrentTime() / 1000, valueof(m_duration_in_hours(PX_GENERATED_CERTIFICATE_DURATION)), -, v_private_key, v_public_compressed_key, v_compressed_mode, v_aes_sym_key, v_encrypted_sym_key, v_authentication_vector, v_nonce, v_salt, v_ieee1609dot2_signed_and_encrypted_data, v_request_hash);
        //        f_http_build_inner_ec_request(v_private_key, v_public_compressed_key, v_compressed_mode, v_aes_sym_key, v_encrypted_sym_key, v_authentication_vector, v_nonce, v_salt, v_ieee1609dot2_signed_and_encrypted_data, v_request_hash);
        f_init_default_headers_list(-, "inner_ec_request", v_headers);
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);

        // Test Body
        f_http_send(
                    v_headers,
                    m_http_request(
                                   m_http_request_post(
                                                       PICS_HTTP_POST_URI_EC,
                                                       v_headers,
                                                       m_http_message_body_binary(
                                                                                  m_binary_body_ieee1609dot2_data(
                                                                                                                  v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                  )))));
        tc_ac.start;
        alt {
          [] a_await_ec_http_response_from_iut(
                                               mw_http_response(
                                                                mw_http_response_ok(
                                                                                    mw_http_message_body_binary(
                                                                                                                mw_binary_body_ieee1609dot2_data(
                                                                                                                                                 mw_enrolmentResponseMessage(
                                                                                                                                                                             mw_encryptedData(
                                                                                                                                                                                              -,
                                                                                                                                                                                              mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                              )))))),
                                               v_response
                                               ) {
            tc_ac.stop;

            if (f_verify_pki_response_message(v_private_key, v_aes_sym_key, v_authentication_vector, vc_eaWholeHash, v_response.response.body.binary_body.ieee1609dot2_data, true, 1, v_etsi_ts_102941_data) == false) {
              log("*** " & testcasename() & ": FAIL: Failed to verify PKI message ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
            } else {
              log(match(v_etsi_ts_102941_data, mw_etsiTs102941Data_inner_ec_response(mw_innerEcResponse_ko(substr(v_request_hash, 0, 16), deniedpermissions))));
              if (match(v_etsi_ts_102941_data, mw_etsiTs102941Data_inner_ec_response(mw_innerEcResponse_ko(substr(v_request_hash, 0, 16), deniedpermissions))) == true) {
                log("*** " & testcasename() & ": PASS: InnerEcResponse error code received ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
              } else {
                log("*** " & testcasename() & ": FAIL: Invalid InnerEcResponse received ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
              }
            }
          }
          [] tc_ac.timeout {
            log("*** " & testcasename() & ": INCONC: Expected message not received ***");
            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
          }
        } // End of 'alt' statement

        // Postamble
        f_cfHttpDown();

      } // End of testcase TC_SECPKI_EA_ENR_RCV_02_BI_01

      testcase TC_SECPKI_EA_ENR_RCV_02_BI_02() runs on ItsPkiHttp system ItsPkiHttpSystem {
        // Local variables
        var Oct32 v_private_key;
        var Oct32 v_public_compressed_key;
        var integer v_compressed_mode;
        var Oct32 v_request_hash;
        var Oct16 v_encrypted_sym_key;
        var Oct16 v_aes_sym_key;
        var Oct16 v_authentication_vector;
        var Oct12 v_nonce;
        var octetstring v_salt;
        var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
        var Headers v_headers;
        var HttpMessage v_response;
        var EtsiTs102941Data v_etsi_ts_102941_data;

        // Test control
        if (not PICS_IUT_EA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_EA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID);
        //        f_cfHttpUp("CERT_TS_A_EA_AA_AUTHVAL_RCV_02_BI_01", PICS_TS_AA_CERTIFICATE_ID);

        // Test adapter configuration

        // Preamble
        f_http_build_inner_ec_request_with_wrong_parameters({ valueof(m_appPermissions(c_its_aid_SCR, { bitmapSsp := PX_INNER_EC_CERTFICATE_INCORRECT_BITMAP_SSP_SCR_WRONG_VERSION })) }, -, f_getCurrentTime() / 1000, valueof(m_duration_in_hours(PX_GENERATED_CERTIFICATE_DURATION)), -, v_private_key, v_public_compressed_key, v_compressed_mode, v_aes_sym_key, v_encrypted_sym_key, v_authentication_vector, v_nonce, v_salt, v_ieee1609dot2_signed_and_encrypted_data, v_request_hash);
        //        f_http_build_inner_ec_request(v_private_key, v_public_compressed_key, v_compressed_mode, v_aes_sym_key, v_encrypted_sym_key, v_authentication_vector, v_nonce, v_salt, v_ieee1609dot2_signed_and_encrypted_data, v_request_hash);
        f_init_default_headers_list(-, "inner_ec_request", v_headers);
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);

        // Test Body
        f_http_send(
                    v_headers,
                    m_http_request(
                                   m_http_request_post(
                                                       PICS_HTTP_POST_URI_EC,
                                                       v_headers,
                                                       m_http_message_body_binary(
                                                                                  m_binary_body_ieee1609dot2_data(
                                                                                                                  v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                  )))));
        tc_ac.start;
        alt {
          [] a_await_ec_http_response_from_iut(
                                               mw_http_response(
                                                                mw_http_response_ok(
                                                                                    mw_http_message_body_binary(
                                                                                                                mw_binary_body_ieee1609dot2_data(
                                                                                                                                                 mw_enrolmentResponseMessage(
                                                                                                                                                                             mw_encryptedData(
                                                                                                                                                                                              -,
                                                                                                                                                                                              mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                              )))))),
                                               v_response
                                               ) {
            tc_ac.stop;

            if (f_verify_pki_response_message(v_private_key, v_aes_sym_key, v_authentication_vector, vc_eaWholeHash, v_response.response.body.binary_body.ieee1609dot2_data, true, 1, v_etsi_ts_102941_data) == false) {
              log("*** " & testcasename() & ": FAIL: Failed to verify PKI message ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
            } else {
              log(match(v_etsi_ts_102941_data, mw_etsiTs102941Data_inner_ec_response(mw_innerEcResponse_ko(substr(v_request_hash, 0, 16), deniedpermissions))));
              if (match(v_etsi_ts_102941_data, mw_etsiTs102941Data_inner_ec_response(mw_innerEcResponse_ko(substr(v_request_hash, 0, 16), deniedpermissions))) == true) {
                log("*** " & testcasename() & ": PASS: InnerEcResponse error code received ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
              } else {
                log("*** " & testcasename() & ": FAIL: Invalid InnerEcResponse received ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
              }
            }
          }
          [] tc_ac.timeout {
            log("*** " & testcasename() & ": INCONC: Expected message not received ***");
            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
          }
        } // End of 'alt' statement

        // Postamble
        f_cfHttpDown();

      } // End of testcase TC_SECPKI_EA_ENR_RCV_02_BI_02

      testcase TC_SECPKI_EA_ENR_RCV_02_BI_03() runs on ItsPkiHttp system ItsPkiHttpSystem {
        // Local variables
        var Oct32 v_private_key;
        var Oct32 v_public_compressed_key;