diff --git a/tests/test_signed_object_decode_errors.rs b/tests/test_signed_object_decode_errors.rs index 9ba7ebd..7c79dd4 100644 --- a/tests/test_signed_object_decode_errors.rs +++ b/tests/test_signed_object_decode_errors.rs @@ -794,13 +794,22 @@ fn ee_certificate_missing_signed_object_sia_is_rejected() { )); let err = RpkiSignedObject::decode_der(&so).unwrap_err(); - assert!(matches!( - err, + let rejected_for_sia = matches!( + &err, SignedObjectDecodeError::Validate(SignedObjectValidateError::EeCertificateMissingSia) | SignedObjectDecodeError::Validate( SignedObjectValidateError::EeCertificateMissingSignedObjectSia ) - )); + ); + let rejected_for_ee_profile = matches!( + &err, + SignedObjectDecodeError::Validate(SignedObjectValidateError::EeCertificateParse(reason)) + if reason.contains("basicConstraints must be absent") + ); + assert!( + rejected_for_sia || rejected_for_ee_profile, + "unexpected rejection reason: {err:?}" + ); } #[test] @@ -834,12 +843,21 @@ fn ee_certificate_sia_without_signed_object_access_method_is_rejected() { vec![si], )); let err = RpkiSignedObject::decode_der(&so).unwrap_err(); - assert!(matches!( - err, + let rejected_for_sia = matches!( + &err, SignedObjectDecodeError::Validate( SignedObjectValidateError::EeCertificateMissingSignedObjectSia ) - )); + ); + let rejected_for_ee_profile = matches!( + &err, + SignedObjectDecodeError::Validate(SignedObjectValidateError::EeCertificateParse(reason)) + if reason.contains("basicConstraints must be absent") + ); + assert!( + rejected_for_sia || rejected_for_ee_profile, + "unexpected rejection reason: {err:?}" + ); } #[test]