1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
package localca
import (
"encoding/pem"
"errors"
"os"
"path/filepath"
"testing"
"github.com/cloudflare/cfssl/csr"
"github.com/cloudflare/cfssl/helpers"
"github.com/cloudflare/cfssl/initca"
)
func TestEncodePEM(t *testing.T) {
p := &pem.Block{
Type: "CERTIFICATE REQUEST",
Bytes: []byte(`¯\_(ツ)_/¯`),
}
t.Logf("PEM:\n%s\n\n", string(pem.EncodeToMemory(p)))
}
func TestLoadSigner(t *testing.T) {
lca := &CA{}
certPEM, csrPEM, keyPEM, err := initca.New(ExampleRequest())
if err != nil {
t.Fatal(err)
}
_, err = lca.CACertificate()
if !errors.Is(err, errNotSetup) {
t.Fatalf("expected an errNotSetup (%v), got: %v", errNotSetup, err)
}
_, err = lca.SignCSR(csrPEM)
if !errors.Is(err, errNotSetup) {
t.Fatalf("expected an errNotSetup (%v), got: %v", errNotSetup, err)
}
tmpDir := t.TempDir()
lca.KeyFile = filepath.Join(tmpDir, "KeyFile")
lca.CertFile = filepath.Join(tmpDir, "CertFile")
err = os.WriteFile(lca.KeyFile, keyPEM, 0644)
if err != nil {
t.Fatal(err)
}
err = os.WriteFile(lca.CertFile, certPEM, 0644)
if err != nil {
t.Fatal(err)
}
err = Load(lca, ExampleSigningConfig())
if err != nil {
t.Fatal(err)
}
}
var testRequest = &csr.CertificateRequest{
CN: "Transport Test Identity",
KeyRequest: &csr.KeyRequest{
A: "ecdsa",
S: 256,
},
Hosts: []string{"127.0.0.1"},
}
func TestNewSigner(t *testing.T) {
req := ExampleRequest()
lca, err := New(req, ExampleSigningConfig())
if err != nil {
t.Fatal(err)
}
csrPEM, _, err := csr.ParseRequest(testRequest)
if err != nil {
t.Fatal(err)
}
certPEM, err := lca.SignCSR(csrPEM)
if err != nil {
t.Fatal(err)
}
_, err = helpers.ParseCertificatePEM(certPEM)
if err != nil {
t.Fatal(err)
}
certPEM, err = lca.CACertificate()
if err != nil {
t.Fatal(err)
}
cert, err := helpers.ParseCertificatePEM(certPEM)
if err != nil {
t.Fatal(err)
}
if cert.Subject.CommonName != req.CN {
t.Fatalf("common names don't match: '%s' != '%s'", cert.Subject.CommonName, req.CN)
}
lca.Toggle()
_, err = lca.SignCSR(csrPEM)
if !errors.Is(err, errDisabled) {
t.Fatalf("expected an errDisabled (%v), got: %v", errDisabled, err)
}
lca.Toggle()
_, err = lca.SignCSR(certPEM)
if err == nil {
t.Fatal("shouldn't be able to sign non-CSRs")
}
p := &pem.Block{
Type: "CERTIFICATE REQUEST",
Bytes: []byte(`¯\_(ツ)_/¯`),
}
junkCSR := pem.EncodeToMemory(p)
_, err = lca.SignCSR(junkCSR)
if err == nil {
t.Fatal("signing a junk CSR should fail")
}
t.Logf("error: %s", err)
}
|
