knative.dev/pkg@v0.0.0-20260602142205-ac97e43f6622/webhook/certificates/resources/certs_test.go (about)

     1  /*
     2  Copyright 2019 The Knative Authors
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package resources
    18  
    19  import (
    20  	"crypto/ecdsa"
    21  	"crypto/x509"
    22  	"encoding/pem"
    23  	"fmt"
    24  	"testing"
    25  	"time"
    26  
    27  	"github.com/google/go-cmp/cmp"
    28  
    29  	. "knative.dev/pkg/logging/testing"
    30  )
    31  
    32  func TestCreateCerts(t *testing.T) {
    33  	sKey, serverCertPEM, caCertBytes, err := CreateCerts(TestContextWithLogger(t), "got-the-hook", "knative-webhook", time.Now().AddDate(0, 0, 7))
    34  	if err != nil {
    35  		t.Fatal("Failed to create certs", err)
    36  	}
    37  
    38  	// Test server private key
    39  	p, _ := pem.Decode(sKey)
    40  	if p.Type != "PRIVATE KEY" {
    41  		t.Fatal("Expected the key to be Private key type")
    42  	}
    43  	key, err := x509.ParsePKCS8PrivateKey(p.Bytes)
    44  	if err != nil {
    45  		t.Fatal("Failed to parse private key", err)
    46  	}
    47  	if _, ok := key.(*ecdsa.PrivateKey); !ok {
    48  		t.Fatalf("Key is not ecdsa format, actually %t", key)
    49  	}
    50  
    51  	// Test Server Cert
    52  	sCert, err := validCertificate(serverCertPEM, t)
    53  	if err != nil {
    54  		t.Fatal(err)
    55  	}
    56  
    57  	// Test CA Cert
    58  	caParsedCert, err := validCertificate(caCertBytes, t)
    59  	if err != nil {
    60  		t.Fatal(err)
    61  	}
    62  
    63  	// Verify common name
    64  	const expectedCommonName = "got-the-hook.knative-webhook.svc"
    65  
    66  	if caParsedCert.Subject.CommonName != expectedCommonName {
    67  		t.Fatalf("Unexpected Cert Common Name %q, wanted %q", caParsedCert.Subject.CommonName, expectedCommonName)
    68  	}
    69  
    70  	// Verify domain names
    71  	expectedDNSNames := []string{
    72  		"got-the-hook",
    73  		"got-the-hook.knative-webhook",
    74  		"got-the-hook.knative-webhook.svc",
    75  		"got-the-hook.knative-webhook.svc.cluster.local",
    76  	}
    77  	if diff := cmp.Diff(caParsedCert.DNSNames, expectedDNSNames); diff != "" {
    78  		t.Fatal("Unexpected CA Cert DNS Name (-want +got) :", diff)
    79  	}
    80  
    81  	if diff := cmp.Diff(caParsedCert.DNSNames, expectedDNSNames); diff != "" {
    82  		t.Fatal("Unexpected CA Cert DNS Name (-want +got):", diff)
    83  	}
    84  
    85  	// Verify Server Cert is Signed by CA Cert
    86  	if err = sCert.CheckSignatureFrom(caParsedCert); err != nil {
    87  		t.Fatal("Failed to verify that the signature on server certificate is from parent CA cert", err)
    88  	}
    89  }
    90  
    91  func validCertificate(cert []byte, t *testing.T) (*x509.Certificate, error) {
    92  	t.Helper()
    93  	const certificate = "CERTIFICATE"
    94  	caCert, _ := pem.Decode(cert)
    95  	if caCert.Type != certificate {
    96  		return nil, fmt.Errorf("cert.Type = %s, want: %s", caCert.Type, certificate)
    97  	}
    98  	parsedCert, err := x509.ParseCertificate(caCert.Bytes)
    99  	if err != nil {
   100  		return nil, fmt.Errorf("Failed to parse cert %w", err)
   101  	}
   102  	if parsedCert.SignatureAlgorithm != x509.ECDSAWithSHA256 {
   103  		return nil, fmt.Errorf("Failed to match signature. Got: %s, want: %s", parsedCert.SignatureAlgorithm, x509.SHA256WithRSA)
   104  	}
   105  	return parsedCert, nil
   106  }