Mercurial > hg > nginx-tests

annotate ssl_certificate.t @ 1974:b5036a0f9ae0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Tests: improved compatibility when using recent "openssl" app. Starting with OpenSSL 3.0, "openssl genrsa" generates encrypted keys in PKCS#8 format instead of previously used PKCS#1 format. Further, since OpenSSL 1.1.0 such keys are using PBKDF2 hmacWithSHA256. Such keys are not supported by old SSL libraries, notably by OpenSSL before 1.0.0 (OpenSSL 0.9.8 only supports hmacWithSHA1) and by BoringSSL before May 21, 2019 (support for hmacWithSHA256 was added in 302a4dee6c), and trying to load such keys into nginx compiled with an old SSL library results in "unsupported prf" errors. To facilitate testing with old SSL libraries, keys are now generated with "openssl genrsa -traditional" if the flag is available.
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 06 May 2024 00:04:26 +0300
parents c924ae8d7104
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1 #!/usr/bin/perl
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
3 # (C) Sergey Kandaurov
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
4 # (C) Nginx, Inc.
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
5
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
6 # Tests for http ssl module with dynamic certificates.
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
7
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
8 ###############################################################################
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
9
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
10 use warnings;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
11 use strict;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
12
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
13 use Test::More;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
14
1621
fd440d324700 Tests: simplified get_ssl_socket() functions that use Net::SSLeay.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1619
diff changeset
15 use Socket qw/ CRLF /;
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
16
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
17 BEGIN { use FindBin; chdir($FindBin::Bin); }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
18
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
19 use lib 'lib';
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
20 use Test::Nginx qw/ :DEFAULT http_end /;
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
21
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
22 ###############################################################################
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
23
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
24 select STDERR; $| = 1;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
25 select STDOUT; $| = 1;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
26
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
27 my $t = Test::Nginx->new()
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
28 ->has(qw/http http_ssl geo openssl:1.0.2 socket_ssl_sni/)
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
29 ->has_daemon('openssl');
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
30
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
31 $t->write_file_expand('nginx.conf', <<'EOF');
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
32
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
33 %%TEST_GLOBALS%%
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
34
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
35 daemon off;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
36
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
37 events {
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
38 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
39
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
40 http {
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
41 %%TEST_GLOBALS_HTTP%%
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
42
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
43 geo $one {
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
44 default one;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
45 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
46
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
47 geo $two {
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
48 default two;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
49 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
50
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
51 geo $pass {
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
52 default pass;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
53 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
54
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
55 add_header X-SSL $ssl_server_name:$ssl_session_reused;
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
56 add_header X-SSL-Protocol $ssl_protocol;
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
57 ssl_session_cache shared:SSL:1m;
1836
74cffa9d4c43 Tests: enabled session reuse via TLS session tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1637
diff changeset
58 ssl_session_tickets on;
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
59
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
60 server {
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
61 listen 127.0.0.1:8080 ssl;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
62 server_name default;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
63
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
64 ssl_certificate $one.crt;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
65 ssl_certificate_key $one.key;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
66 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
67
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
68 server {
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
69 listen 127.0.0.1:8080 ssl;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
70 server_name virtual;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
71
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
72 # found in key
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
73 ssl_certificate $two.crt;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
74 ssl_certificate_key $two.key;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
75 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
76
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
77 server {
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
78 listen 127.0.0.1:8080 ssl;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
79 server_name no_ctx;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
80 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
81
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
82 server {
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
83 listen 127.0.0.1:8083 ssl;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
84 server_name password;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
85
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
86 # found in key
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
87 ssl_certificate pass.crt;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
88 ssl_certificate_key $pass.key;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
89 ssl_password_file password_file;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
90 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
91
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
92 server {
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
93 listen 127.0.0.1:8081 ssl;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
94 server_name default;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
95
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
96 ssl_certificate $one.crt;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
97 ssl_certificate_key $one.key;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
98 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
99
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
100 server {
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
101 listen 127.0.0.1:8082 ssl;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
102 server_name default;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
103
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
104 ssl_certificate $two.crt;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
105 ssl_certificate_key $two.key;
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
106 }
1445
889283abadf8 Tests: added basic ssl tests with dynamic certificate not found.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1443
diff changeset
107
889283abadf8 Tests: added basic ssl tests with dynamic certificate not found.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1443
diff changeset
108 server {
889283abadf8 Tests: added basic ssl tests with dynamic certificate not found.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1443
diff changeset
109 listen 127.0.0.1:8084 ssl;
889283abadf8 Tests: added basic ssl tests with dynamic certificate not found.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1443
diff changeset
110 server_name localhost;
889283abadf8 Tests: added basic ssl tests with dynamic certificate not found.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1443
diff changeset
111
889283abadf8 Tests: added basic ssl tests with dynamic certificate not found.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1443
diff changeset
112 ssl_certificate $ssl_server_name.crt;
889283abadf8 Tests: added basic ssl tests with dynamic certificate not found.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1443
diff changeset
113 ssl_certificate_key $ssl_server_name.key;
889283abadf8 Tests: added basic ssl tests with dynamic certificate not found.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1443
diff changeset
114 }
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
115 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
116
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
117 EOF
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
118
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
119 $t->write_file('openssl.conf', <<EOF);
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
120 [ req ]
1488
dbce8fb5f5f8 Tests: align with OpenSSL security level 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1477
diff changeset
121 default_bits = 2048
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
122 encrypt_key = no
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
123 distinguished_name = req_distinguished_name
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
124 [ req_distinguished_name ]
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
125 EOF
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
126
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
127 my $d = $t->testdir();
1974
b5036a0f9ae0 Tests: improved compatibility when using recent "openssl" app.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1966
diff changeset
128 my $tr = `openssl genrsa -help 2>&1` =~ /-traditional/ ? '-traditional' : '';
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
129
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
130 foreach my $name ('one', 'two') {
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
131 system('openssl req -x509 -new '
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
132 . "-config $d/openssl.conf -subj /CN=$name/ "
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
133 . "-out $d/$name.crt -keyout $d/$name.key "
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
134 . ">>$d/openssl.out 2>&1") == 0
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
135 or die "Can't create certificate for $name: $!\n";
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
136 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
137
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
138 foreach my $name ('pass') {
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
139 system("openssl genrsa -out $d/$name.key -passout pass:pass "
1974
b5036a0f9ae0 Tests: improved compatibility when using recent "openssl" app.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1966
diff changeset
140 . "-aes128 $tr 2048 >>$d/openssl.out 2>&1") == 0
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
141 or die "Can't create $name key: $!\n";
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
142 system("openssl req -x509 -new -config $d/openssl.conf "
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
143 . "-subj /CN=$name/ -out $d/$name.crt -key $d/$name.key "
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
144 . "-passin pass:pass >>$d/openssl.out 2>&1") == 0
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
145 or die "Can't create $name certificate: $!\n";
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
146 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
147
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
148 $t->write_file('password_file', 'pass');
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
149 $t->write_file('index.html', '');
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
150
1535
144c6ce732e4 Tests: removed TODO and try_run() checks for legacy versions.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1488
diff changeset
151 $t->run()->plan(11);
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
152
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
153 ###############################################################################
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
154
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
155 like(cert('default', 8080), qr/CN=one/, 'default certificate');
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
156 like(get('default', 8080), qr/default/, 'default context');
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
157
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
158 like(cert('virtual', 8080), qr/CN=two/, 'virtual server certificate');
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
159 like(get('virtual', 8080), qr/virtual/, 'virtual server context');
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
160
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
161 like(cert('no_ctx', 8080), qr/CN=one/, 'certificate - no context');
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
162 like(get('no_ctx', 8080), qr/no_ctx/, 'virtual server - no context');
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
163
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
164 like(get('password', 8083), qr/password/, 'ssl_password_file');
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
165
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
166 # session reuse
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
167
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
168 my $s = session('default', 8080);
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
169
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
170 TODO: {
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
171 local $TODO = 'no TLSv1.3 sessions, old Net::SSLeay'
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
172 if $Net::SSLeay::VERSION < 1.88 && test_tls13();
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
173 local $TODO = 'no TLSv1.3 sessions, old IO::Socket::SSL'
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
174 if $IO::Socket::SSL::VERSION < 2.061 && test_tls13();
1966
c924ae8d7104 Tests: session reuse handling with Net::SSLeay with LibreSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1868
diff changeset
175 local $TODO = 'not TLSv1.3 sessions in Net::SSLeay (LibreSSL)'
c924ae8d7104 Tests: session reuse handling with Net::SSLeay with LibreSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1868
diff changeset
176 if Net::SSLeay::constant("LIBRESSL_VERSION_NUMBER") && test_tls13();
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
177
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
178 like(get('default', 8080, $s), qr/default:r/, 'session reused');
1851
0351dee227a8 Tests: unbreak tests with dynamic certificates on stable.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1836
diff changeset
179
0351dee227a8 Tests: unbreak tests with dynamic certificates on stable.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1836
diff changeset
180 TODO: {
0351dee227a8 Tests: unbreak tests with dynamic certificates on stable.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1836
diff changeset
181 # ticket key name mismatch prevents session resumption
0351dee227a8 Tests: unbreak tests with dynamic certificates on stable.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1836
diff changeset
182 local $TODO = 'not yet' unless $t->has_version('1.23.2');
1868
d570dbcad925 Tests: unbreak tests with IO::Socket:SSL lacking SSL_session_key.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1865
diff changeset
183 local $TODO = 'no SSL_session_key, old IO::Socket::SSL'
d570dbcad925 Tests: unbreak tests with IO::Socket:SSL lacking SSL_session_key.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1865
diff changeset
184 if $IO::Socket::SSL::VERSION < 1.965;
1851
0351dee227a8 Tests: unbreak tests with dynamic certificates on stable.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1836
diff changeset
185
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
186 like(get('default', 8081, $s), qr/default:r/, 'session id context match');
1851
0351dee227a8 Tests: unbreak tests with dynamic certificates on stable.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1836
diff changeset
187
0351dee227a8 Tests: unbreak tests with dynamic certificates on stable.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1836
diff changeset
188 }
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
189 }
1851
0351dee227a8 Tests: unbreak tests with dynamic certificates on stable.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1836
diff changeset
190
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
191 like(get('default', 8082, $s), qr/default:\./, 'session id context distinct');
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
192
1445
889283abadf8 Tests: added basic ssl tests with dynamic certificate not found.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1443
diff changeset
193 # errors
889283abadf8 Tests: added basic ssl tests with dynamic certificate not found.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1443
diff changeset
194
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
195 ok(!get('nx', 8084), 'no certificate');
1445
889283abadf8 Tests: added basic ssl tests with dynamic certificate not found.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1443
diff changeset
196
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
197 ###############################################################################
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
198
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
199 sub get {
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
200 my $s = get_socket(@_) || return;
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
201 return http_end($s);
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
202 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
203
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
204 sub cert {
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
205 my $s = get_socket(@_) || return;
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
206 return $s->dump_peer_certificate();
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
207 }
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
208
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
209 sub session {
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
210 my $s = get_socket(@_) || return;
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
211 http_end($s);
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
212 return $s;
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
213 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
214
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
215 sub get_socket {
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
216 my ($host, $port, $ctx) = @_;
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
217 return http_get(
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
218 '/', start => 1, PeerAddr => '127.0.0.1:' . port($port),
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
219 SSL => 1,
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
220 SSL_hostname => $host,
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
221 SSL_session_cache_size => 100,
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
222 SSL_session_key => 1,
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
223 SSL_reuse_ctx => $ctx
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
224 );
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
225 }
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
226
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
227 sub test_tls13 {
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
228 return get('default', 8080) =~ /TLSv1.3/;
1443
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
229 }
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
230
7c217d343d1e Tests: ssl tests with dynamic certificates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
231 ###############################################################################