google.golang.org/grpc@v1.72.2/testdata/spiffe/README.md (about)

     1  ## File Purposes
     2  
     3  *   spiffe_cert.pem - the certificate that is placed in spiffe bundles (copied
     4      into the `x5c` field)
     5  *   server1_spiffe.pem - another certificate placed in spiffe bundles
     6  *   spiffe_multi_uri_san_cert.pem - another certificate placed in spiffe bundles
     7  *   spiffe-openssl.cnf - the configuration file passed to the openssl CLI when
     8      creating these certificate files
     9  *   spiffebundle.json - the valid spiffe bundle for happy path testing
    10  *   spiffebundle2.json - Another valid spiffe bundle that is used in testing
    11      file reloading (a different file is needed to ensure changes are picked up).
    12      It is just the `example.com` trust domain from spiffebundle.json.
    13  *   spiffebundle_corrupted_cert.json - manually modifies the `x5c` field and
    14      removes a character to create an invalid certificate
    15  *   spiffebundle_invalid_trustdomain - uses a `#` in the trust domain which is a
    16      disallowed character per the spec
    17  *   spiffebundle_malformed.json - a fully wrong json
    18  *   spiffebundle_wrong_kid.json - has the `kid` field instead of the `kty` field
    19  *   spiffebundle_wrong_kty.json - Uses `EC` instead of `RSA` in the `kty` field
    20  *   spiffebundle_wrong_multi_certs.json - place 2 certificates in the `x5c`
    21      field
    22  *   spiffebundle_wrong_root.json - The top level json string is `trustDomains`
    23      instead of `trust_domains`
    24  *   spiffebundle_wrong_seq_type.json - the `spiffe_sequence` number must be an
    25      integer
    26  *   spiffebundle_wrong_use.json - The `use` field must be `x509-svid` or
    27      `jwt-svid` (we are expecting and support `x509-svid` per the gRFC)
    28  
    29  ## Test File Creation:
    30  
    31  The SPIFFE related extensions are listed in spiffe-openssl.cnf config. Both
    32  client_spiffe.pem and server1_spiffe.pem are generated in the same way as the
    33  client and server certificates described in the testdata/x509 with the same CAs.
    34  Specifically they were made with the following commands:
    35  
    36  ```
    37  $ openssl req -new -key client.key -out spiffe-cert.csr \
    38   -subj /C=US/ST=CA/L=SVL/O=gRPC/CN=testclient/ \
    39   -config spiffe-openssl.cnf -reqexts spiffe_client_e2e
    40  $ openssl x509 -req -CA ca.pem -CAkey ca.key -CAcreateserial \
    41   -in spiffe-cert.csr -out client_spiffe.pem -extensions spiffe_client_e2e \
    42    -extfile spiffe-openssl.cnf -days 3650 -sha256
    43  $ openssl req -new -key server1.key -out spiffe-cert.csr \
    44   -subj /C=US/ST=CA/L=SVL/O=gRPC/CN=*.test.google.com/ \
    45   -config spiffe-openssl.cnf -reqexts spiffe_server_e2e
    46  $ openssl x509 -req -CA ca.pem -CAkey ca.key -CAcreateserial \
    47   -in spiffe-cert.csr -out server1_spiffe.pem -extensions spiffe_server_e2e \
    48    -extfile spiffe-openssl.cnf -days 3650 -sha256
    49  ```
    50  
    51  Additionally, the SPIFFE trust bundle map files (spiffebundle*.json) are
    52  manually created for end to end testing. The spiffebundle.json contains the
    53  "example.com" trust domain (only this entry is used in e2e tests) matching URI
    54  SAN of server1_spiffe.pem, and the CA certificate there is ca.pem. The
    55  spiffebundle.json file contains "foo.bar.com" trust domain (only this entry is
    56  used in e2e tests) matching URI SAN of client_spiffe.pem, and the CA certificate
    57  there is also ca.pem.
    58  
    59  If updating these files, the `x5c` field in the json is the raw PEM certificates
    60  and can be copy pasted from the certificate file. `n` and `e` are values from
    61  the public key. `e` should *probably* be `AQAB` as it is the exponent. `n` can
    62  be fetched from the certificate by getting the RSA key from the cert and
    63  extracting the value. This can be done in golang with the following codeblock:
    64  ``` func GetBase64ModulusFromPublicKey(key *rsa.PublicKey) string { return
    65  base64.RawURLEncoding.EncodeToString(key.N.Bytes()) }
    66  
    67  block, _ := pem.Decode(rawPemCert) cert, _ := x509.ParseCertificate(block.Bytes)
    68  publicKey := cert.PublicKey.(*rsa.PublicKey)
    69  fmt.Println(GetBase64ModulusFromPublicKey(publicKey)) ```
    70  
    71  The rest of the files are manually modified as described above.