9
9
"context"
10
10
"crypto/rand"
11
11
"crypto/rsa"
12
- "crypto/tls"
13
12
"crypto/x509"
14
13
"crypto/x509/pkix"
15
14
"encoding/base64"
@@ -22,8 +21,6 @@ import (
22
21
"net/http"
23
22
"net/http/httptest"
24
23
"reflect"
25
- "sort"
26
- "strings"
27
24
"testing"
28
25
"time"
29
26
)
@@ -692,71 +689,6 @@ func TestLinkHeader(t *testing.T) {
692
689
}
693
690
}
694
691
695
- func TestTLSSNI01ChallengeCert (t * testing.T ) {
696
- const (
697
- token = "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA"
698
- // echo -n <token.testKeyECThumbprint> | shasum -a 256
699
- san = "dbbd5eefe7b4d06eb9d1d9f5acb4c7cd.a27d320e4b30332f0b6cb441734ad7b0.acme.invalid"
700
- )
701
-
702
- tlscert , name , err := newTestClient ().TLSSNI01ChallengeCert (token )
703
- if err != nil {
704
- t .Fatal (err )
705
- }
706
-
707
- if n := len (tlscert .Certificate ); n != 1 {
708
- t .Fatalf ("len(tlscert.Certificate) = %d; want 1" , n )
709
- }
710
- cert , err := x509 .ParseCertificate (tlscert .Certificate [0 ])
711
- if err != nil {
712
- t .Fatal (err )
713
- }
714
- if len (cert .DNSNames ) != 1 || cert .DNSNames [0 ] != san {
715
- t .Fatalf ("cert.DNSNames = %v; want %q" , cert .DNSNames , san )
716
- }
717
- if cert .DNSNames [0 ] != name {
718
- t .Errorf ("cert.DNSNames[0] != name: %q vs %q" , cert .DNSNames [0 ], name )
719
- }
720
- if cn := cert .Subject .CommonName ; cn != san {
721
- t .Errorf ("cert.Subject.CommonName = %q; want %q" , cn , san )
722
- }
723
- }
724
-
725
- func TestTLSSNI02ChallengeCert (t * testing.T ) {
726
- const (
727
- token = "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA"
728
- // echo -n evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA | shasum -a 256
729
- sanA = "7ea0aaa69214e71e02cebb18bb867736.09b730209baabf60e43d4999979ff139.token.acme.invalid"
730
- // echo -n <token.testKeyECThumbprint> | shasum -a 256
731
- sanB = "dbbd5eefe7b4d06eb9d1d9f5acb4c7cd.a27d320e4b30332f0b6cb441734ad7b0.ka.acme.invalid"
732
- )
733
-
734
- tlscert , name , err := newTestClient ().TLSSNI02ChallengeCert (token )
735
- if err != nil {
736
- t .Fatal (err )
737
- }
738
-
739
- if n := len (tlscert .Certificate ); n != 1 {
740
- t .Fatalf ("len(tlscert.Certificate) = %d; want 1" , n )
741
- }
742
- cert , err := x509 .ParseCertificate (tlscert .Certificate [0 ])
743
- if err != nil {
744
- t .Fatal (err )
745
- }
746
- names := []string {sanA , sanB }
747
- if ! reflect .DeepEqual (cert .DNSNames , names ) {
748
- t .Fatalf ("cert.DNSNames = %v;\n want %v" , cert .DNSNames , names )
749
- }
750
- sort .Strings (cert .DNSNames )
751
- i := sort .SearchStrings (cert .DNSNames , name )
752
- if i >= len (cert .DNSNames ) || cert .DNSNames [i ] != name {
753
- t .Errorf ("%v doesn't have %q" , cert .DNSNames , name )
754
- }
755
- if cn := cert .Subject .CommonName ; cn != sanA {
756
- t .Errorf ("CommonName = %q; want %q" , cn , sanA )
757
- }
758
- }
759
-
760
692
func TestTLSALPN01ChallengeCert (t * testing.T ) {
761
693
const (
762
694
token = "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA"
@@ -813,6 +745,7 @@ func TestTLSChallengeCertOpt(t *testing.T) {
813
745
if err != nil {
814
746
t .Fatal (err )
815
747
}
748
+ domain := "example.com"
816
749
tmpl := & x509.Certificate {
817
750
SerialNumber : big .NewInt (2 ),
818
751
Subject : pkix.Name {Organization : []string {"Test" }},
@@ -821,52 +754,43 @@ func TestTLSChallengeCertOpt(t *testing.T) {
821
754
opts := []CertOption {WithKey (key ), WithTemplate (tmpl )}
822
755
823
756
client := newTestClient ()
824
- cert1 , _ , err := client .TLSSNI01ChallengeCert ("token" , opts ... )
757
+ cert , err := client .TLSALPN01ChallengeCert ("token" , domain , opts ... )
825
758
if err != nil {
826
759
t .Fatal (err )
827
760
}
828
- cert2 , _ , err := client .TLSSNI02ChallengeCert ("token" , opts ... )
761
+
762
+ // verify generated cert private key
763
+ tlskey , ok := cert .PrivateKey .(* rsa.PrivateKey )
764
+ if ! ok {
765
+ t .Fatalf ("tlscert.PrivateKey is %T; want *rsa.PrivateKey" , cert .PrivateKey )
766
+ }
767
+ if tlskey .D .Cmp (key .D ) != 0 {
768
+ t .Errorf ("tlskey.D = %v; want %v" , tlskey .D , key .D )
769
+ }
770
+ // verify generated cert public key
771
+ x509Cert , err := x509 .ParseCertificate (cert .Certificate [0 ])
829
772
if err != nil {
830
773
t .Fatal (err )
831
774
}
832
-
833
- for i , tlscert := range []tls.Certificate {cert1 , cert2 } {
834
- // verify generated cert private key
835
- tlskey , ok := tlscert .PrivateKey .(* rsa.PrivateKey )
836
- if ! ok {
837
- t .Errorf ("%d: tlscert.PrivateKey is %T; want *rsa.PrivateKey" , i , tlscert .PrivateKey )
838
- continue
839
- }
840
- if tlskey .D .Cmp (key .D ) != 0 {
841
- t .Errorf ("%d: tlskey.D = %v; want %v" , i , tlskey .D , key .D )
842
- }
843
- // verify generated cert public key
844
- x509Cert , err := x509 .ParseCertificate (tlscert .Certificate [0 ])
845
- if err != nil {
846
- t .Errorf ("%d: %v" , i , err )
847
- continue
848
- }
849
- tlspub , ok := x509Cert .PublicKey .(* rsa.PublicKey )
850
- if ! ok {
851
- t .Errorf ("%d: x509Cert.PublicKey is %T; want *rsa.PublicKey" , i , x509Cert .PublicKey )
852
- continue
853
- }
854
- if tlspub .N .Cmp (key .N ) != 0 {
855
- t .Errorf ("%d: tlspub.N = %v; want %v" , i , tlspub .N , key .N )
856
- }
857
- // verify template option
858
- sn := big .NewInt (2 )
859
- if x509Cert .SerialNumber .Cmp (sn ) != 0 {
860
- t .Errorf ("%d: SerialNumber = %v; want %v" , i , x509Cert .SerialNumber , sn )
861
- }
862
- org := []string {"Test" }
863
- if ! reflect .DeepEqual (x509Cert .Subject .Organization , org ) {
864
- t .Errorf ("%d: Subject.Organization = %+v; want %+v" , i , x509Cert .Subject .Organization , org )
865
- }
866
- for _ , v := range x509Cert .DNSNames {
867
- if ! strings .HasSuffix (v , ".acme.invalid" ) {
868
- t .Errorf ("%d: invalid DNSNames element: %q" , i , v )
869
- }
775
+ tlspub , ok := x509Cert .PublicKey .(* rsa.PublicKey )
776
+ if ! ok {
777
+ t .Fatalf ("x509Cert.PublicKey is %T; want *rsa.PublicKey" , x509Cert .PublicKey )
778
+ }
779
+ if tlspub .N .Cmp (key .N ) != 0 {
780
+ t .Errorf ("tlspub.N = %v; want %v" , tlspub .N , key .N )
781
+ }
782
+ // verify template option
783
+ sn := big .NewInt (2 )
784
+ if x509Cert .SerialNumber .Cmp (sn ) != 0 {
785
+ t .Errorf ("SerialNumber = %v; want %v" , x509Cert .SerialNumber , sn )
786
+ }
787
+ org := []string {"Test" }
788
+ if ! reflect .DeepEqual (x509Cert .Subject .Organization , org ) {
789
+ t .Errorf ("Subject.Organization = %+v; want %+v" , x509Cert .Subject .Organization , org )
790
+ }
791
+ for _ , v := range x509Cert .DNSNames {
792
+ if v != domain {
793
+ t .Errorf ("invalid DNSNames element: %q" , v )
870
794
}
871
795
}
872
796
}
0 commit comments