github.com/jlmeeker/kismatic@v1.10.1-0.20180612190640-57f9005a1f1a/integration-tests/tls/cert_test.go (about)

     1  package tls
     2  
     3  import (
     4  	"bytes"
     5  	"net"
     6  	"reflect"
     7  	"testing"
     8  	"time"
     9  
    10  	"github.com/cloudflare/cfssl/csr"
    11  	"github.com/cloudflare/cfssl/helpers"
    12  )
    13  
    14  func TestGenerateNewCertificate(t *testing.T) {
    15  	// Create CA Cert
    16  	subject := Subject{
    17  		Country:            "someCountry",
    18  		State:              "someState",
    19  		Locality:           "someLocality",
    20  		Organization:       "someOrganization",
    21  		OrganizationalUnit: "someOrgUnit",
    22  	}
    23  	key, caCert, err := NewCACert("test/ca-csr.json", "someCN", subject)
    24  	if err != nil {
    25  		t.Fatalf("error creating CA: %v", err)
    26  	}
    27  	parsedCACert, err := helpers.ParseCertificatePEM(caCert)
    28  	if err != nil {
    29  		t.Fatalf("error parsing CA Certificate: %v", err)
    30  	}
    31  	ca := &CA{
    32  		Key:        key,
    33  		Cert:       caCert,
    34  		ConfigFile: "test/ca-config.json",
    35  		Profile:    "kubernetes",
    36  	}
    37  	certHosts := []string{"testHostname", "otherName", "127.0.0.1", "10.5.6.217"}
    38  	req := csr.CertificateRequest{
    39  		CN: "testKube",
    40  		KeyRequest: &csr.BasicKeyRequest{
    41  			A: "rsa",
    42  			S: 2048,
    43  		},
    44  		Hosts: certHosts,
    45  		Names: []csr.Name{
    46  			{
    47  				C:  "US",
    48  				L:  "Troy",
    49  				O:  "Kubernetes",
    50  				OU: "Cluster",
    51  				ST: "New York",
    52  			},
    53  		},
    54  	}
    55  
    56  	if err != nil {
    57  		t.Fatalf("error decoding csr: %v", err)
    58  	}
    59  
    60  	_, cert, err := NewCert(ca, req)
    61  	if err != nil {
    62  		t.Errorf("error creating certificate: %v", err)
    63  	}
    64  
    65  	parsedCert, err := helpers.ParseCertificatePEM(cert)
    66  	if err != nil {
    67  		t.Fatalf("error parsing certificate: %v", err)
    68  	}
    69  
    70  	if parsedCert.IsCA {
    71  		t.Errorf("Non-CA certificate is CA")
    72  	}
    73  
    74  	if parsedCert.Subject.CommonName != req.CN {
    75  		t.Errorf("common name mismatch: expected %q, but got %q", req.CN, parsedCert.Subject.CommonName)
    76  	}
    77  
    78  	if parsedCert.Subject.Organization[0] != req.Names[0].O {
    79  		t.Errorf("organization mismatch: expected %q, but got %q", req.Names[0].O, parsedCert.Subject.Organization)
    80  	}
    81  
    82  	if parsedCert.Subject.OrganizationalUnit[0] != req.Names[0].OU {
    83  		t.Errorf("organizational unit mismatch: expected %q, but got %q", req.Names[0].OU, parsedCert.Subject.OrganizationalUnit)
    84  	}
    85  
    86  	if parsedCert.Subject.Country[0] != req.Names[0].C {
    87  		t.Errorf("country mismatch: expected %q, but got %q", req.Names[0].C, parsedCert.Subject.Country[0])
    88  	}
    89  
    90  	if parsedCert.Subject.Locality[0] != req.Names[0].L {
    91  		t.Errorf("locality mismatch: expected %q, but got %q", req.Names[0].L, parsedCert.Subject.Locality[0])
    92  	}
    93  
    94  	if parsedCert.Subject.Province[0] != req.Names[0].ST {
    95  		t.Errorf("state mismatch: expected %q, but got %q", req.Names[0].ST, parsedCert.Subject.Province[0])
    96  	}
    97  
    98  	if !reflect.DeepEqual(parsedCert.Issuer, parsedCACert.Subject) {
    99  		t.Errorf("cert issuer is not equal to the CA's subject")
   100  	}
   101  
   102  	if !bytes.Equal(parsedCert.AuthorityKeyId, parsedCACert.SubjectKeyId) {
   103  		t.Errorf("certificate auth key ID is not the subject key ID of the CA")
   104  	}
   105  
   106  	expectedDNSNames := []string{"testHostname", "otherName"}
   107  	if !reflect.DeepEqual(expectedDNSNames, parsedCert.DNSNames) {
   108  		t.Errorf("DNS names of the generated certificate are invalid")
   109  	}
   110  
   111  	expectedIPAddresses := []net.IP{net.ParseIP("127.0.0.1"), net.ParseIP("10.5.6.217")}
   112  	if len(expectedIPAddresses) != len(parsedCert.IPAddresses) {
   113  		t.Errorf("expected %d IP addresses, but got %d", len(expectedIPAddresses), len(parsedCert.IPAddresses))
   114  	}
   115  	for i := 0; i < len(expectedIPAddresses); i++ {
   116  		if !expectedIPAddresses[i].Equal(parsedCert.IPAddresses[i]) {
   117  			t.Errorf("expected IP %q, but got %q", expectedIPAddresses[i], parsedCert.IPAddresses[i])
   118  		}
   119  	}
   120  
   121  	// Verify expiration
   122  	now := time.Now().UTC()
   123  	d, err := time.ParseDuration("8760h")
   124  	if err != nil {
   125  		t.Fatalf("error parsing duration: %v", err)
   126  	}
   127  	expectedExpiration := now.Add(d)
   128  	if expectedExpiration.Year() != parsedCert.NotAfter.Year() || expectedExpiration.YearDay() != parsedCert.NotAfter.YearDay() {
   129  		t.Errorf("expected expiration date %q, got %q", expectedExpiration, parsedCert.NotAfter)
   130  	}
   131  
   132  }