You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
54 lines
1.7 KiB
54 lines
1.7 KiB
package tlscert
|
|
|
|
import (
|
|
"bytes"
|
|
"path/filepath"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestFactoryCertificateRecoversAfterInitialClockSync(t *testing.T) {
|
|
now := time.Unix(100, 0)
|
|
options := Options{Root: t.TempDir(), Clock: func() time.Time { return now }}
|
|
options.ActiveCert = filepath.Join(options.Root, "active", "server.crt")
|
|
options.ActiveKey = filepath.Join(options.Root, "active", "server.key")
|
|
r, err := Open(options)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
key := append([]byte(nil), r.records[FactoryCertificateID].keyPEM...)
|
|
old, _ := r.Metadata(FactoryCertificateID)
|
|
if _, err = r.Generate("user-cert", Subject{CommonName: "user.example"}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
now = time.Date(2026, 9, 9, 0, 0, 0, 0, time.UTC)
|
|
fresh, err := r.Activate(FactoryCertificateID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if fresh.NotBefore.Year() != 2026 || fresh.FingerprintSHA256 == old.FingerprintSHA256 {
|
|
t.Fatal("factory certificate was not reissued")
|
|
}
|
|
if !bytes.Equal(key, r.records[FactoryCertificateID].keyPEM) {
|
|
t.Fatal("factory private key changed")
|
|
}
|
|
again, err := r.Activate(FactoryCertificateID)
|
|
if err != nil || again.FingerprintSHA256 != fresh.FingerprintSHA256 {
|
|
t.Fatal("unnecessary repeat renewal")
|
|
}
|
|
if _, err = r.Activate("user-cert"); err == nil {
|
|
t.Fatal("invalid user certificate accepted")
|
|
}
|
|
reopened, err := Open(options)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
persisted, err := reopened.Activate(FactoryCertificateID)
|
|
if err != nil || persisted.FingerprintSHA256 != fresh.FingerprintSHA256 {
|
|
t.Fatal("repaired certificate not persisted")
|
|
}
|
|
now = now.AddDate(11, 0, 0)
|
|
if _, err = r.Activate(FactoryCertificateID); err == nil {
|
|
t.Fatal("normally expired factory certificate silently renewed")
|
|
}
|
|
}
|
|
|