Skip to content

Commit c4a4b9e

Browse files
author
Mengqi Yu
committed
validate cert
1 parent 6865d0a commit c4a4b9e

File tree

4 files changed

+301
-46
lines changed

4 files changed

+301
-46
lines changed

‎pkg/admission/cert/writer/certwriter.go

Lines changed: 42 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,13 @@ package writer
1919
import (
2020
"bytes"
2121
"crypto/tls"
22+
"crypto/x509"
23+
"encoding/pem"
2224
"errors"
2325
"fmt"
2426
"log"
2527
"net/url"
28+
"time"
2629

2730
admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
2831
"k8s.io/apimachinery/pkg/runtime"
@@ -39,6 +42,8 @@ const (
3942
ServerCertName = "cert.pem"
4043
)
4144

45+
const month = 31 * 24 * time.Hour
46+
4247
// CertWriter provides method to handle webhooks.
4348
type CertWriter interface {
4449
// EnsureCert ensures that the webhooks have proper certificates.
@@ -91,8 +96,16 @@ func handleCommon(webhook *admissionregistrationv1beta1.Webhook, ch certReadWrit
9196
return err
9297
}
9398

99+
dnsName, err := dnsNameForWebhook(&webhook.ClientConfig)
100+
if err != nil {
101+
return err
102+
}
94103
// Recreate the cert if it's invalid.
95-
if !validCert(certs) {
104+
valid, err := validCert(certs, dnsName, 6*month)
105+
if err != nil {
106+
return err
107+
}
108+
if !valid {
96109
log.Printf("cert is invalid or expiring, regenerating a new one")
97110
certs, err = ch.overwrite(webhook.Name)
98111
if err != nil {
@@ -141,19 +154,37 @@ type certReadWriter interface {
141154
overwrite(webhookName string) (*generator.Artifacts, error)
142155
}
143156

144-
func validCert(certs *generator.Artifacts) bool {
145-
// TODO:
146-
// 1) validate the key and the cert are valid pair e.g. call crypto/tls.X509KeyPair()
147-
// 2) validate the cert with the CA cert
148-
// 3) validate the cert is for a certain DNSName
149-
// e.g.
150-
// c, err := tls.X509KeyPair(cert, key)
151-
// err := c.Verify(options)
157+
func validCert(certs *generator.Artifacts, dnsName string, validTime time.Duration) (bool, error) {
152158
if certs == nil {
153-
return false
159+
return false, nil
154160
}
161+
162+
// Verify key and cert are valid pair
155163
_, err := tls.X509KeyPair(certs.Cert, certs.Key)
156-
return err == nil
164+
if err != nil {
165+
return false, nil
166+
}
167+
168+
// Verify cert is good for desired DNS name and signed by CA and will be valid for desired period of time.
169+
pool := x509.NewCertPool()
170+
if !pool.AppendCertsFromPEM(certs.CACert) {
171+
return false, nil
172+
}
173+
block, _ := pem.Decode([]byte(certs.Cert))
174+
if block == nil {
175+
return false, nil
176+
}
177+
cert, err := x509.ParseCertificate(block.Bytes)
178+
if err != nil {
179+
return false, nil
180+
}
181+
ops := x509.VerifyOptions{
182+
DNSName: dnsName,
183+
Roots: pool,
184+
CurrentTime: time.Now().Add(validTime),
185+
}
186+
_, err = cert.Verify(ops)
187+
return err == nil, nil
157188
}
158189

159190
func getWebhooksFromObject(obj runtime.Object) ([]admissionregistrationv1beta1.Webhook, error) {

‎pkg/admission/cert/writer/certwriter_test.go

Lines changed: 229 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -154,11 +154,16 @@ var _ = Describe("handleCommon", func() {
154154
var invalidCert *generator.Artifacts
155155

156156
BeforeEach(func(done Done) {
157-
webhook = &admissionregistration.Webhook{}
157+
url := "https://example.com/admission"
158+
webhook = &admissionregistration.Webhook{
159+
ClientConfig: admissionregistration.WebhookClientConfig{
160+
URL: &url,
161+
},
162+
}
158163
cert = &generator.Artifacts{
159-
CACert: []byte(`CACertBytes`),
160-
Cert: []byte(certPEM),
161-
Key: []byte(keyPEM),
164+
CACert: []byte(pair1CA),
165+
Cert: []byte(pair1Cert),
166+
Key: []byte(pair1Key),
162167
}
163168
invalidCert = &generator.Artifacts{
164169
CACert: []byte(`CACertBytes`),
@@ -188,7 +193,11 @@ var _ = Describe("handleCommon", func() {
188193
certrw := &fakeCertReadWriter{
189194
readCertAndErr: []certAndErr{
190195
{
191-
err: notFoundError{errors.NewNotFound(schema.GroupResource{}, "foo")},
196+
err: notFoundError{errors.NewNotFound(schema.GroupResource{}, "foo")},
197+
},
198+
},
199+
writeCertAndErr: []certAndErr{
200+
{
192201
cert: cert,
193202
},
194203
},
@@ -198,6 +207,7 @@ var _ = Describe("handleCommon", func() {
198207
Expect(err).NotTo(HaveOccurred())
199208
Expect(certrw.numReadCalled).To(Equal(1))
200209
Expect(certrw.numWriteCalled).To(Equal(1))
210+
Expect(certrw.numOverwriteCalled).To(Equal(0))
201211
})
202212

203213
It("should return the error on failed write", func() {
@@ -218,6 +228,7 @@ var _ = Describe("handleCommon", func() {
218228
Expect(err).To(MatchError(goerrors.New("failed to write")))
219229
Expect(certrw.numReadCalled).To(Equal(1))
220230
Expect(certrw.numWriteCalled).To(Equal(1))
231+
Expect(certrw.numOverwriteCalled).To(Equal(0))
221232
})
222233
})
223234

@@ -234,6 +245,8 @@ var _ = Describe("handleCommon", func() {
234245
err := handleCommon(webhook, certrw)
235246
Expect(err).NotTo(HaveOccurred())
236247
Expect(certrw.numReadCalled).To(Equal(1))
248+
Expect(certrw.numWriteCalled).To(Equal(0))
249+
Expect(certrw.numOverwriteCalled).To(Equal(0))
237250
})
238251

239252
It("should return the error on failed read", func() {
@@ -248,6 +261,8 @@ var _ = Describe("handleCommon", func() {
248261
err := handleCommon(webhook, certrw)
249262
Expect(err).To(MatchError(goerrors.New("failed to read")))
250263
Expect(certrw.numReadCalled).To(Equal(1))
264+
Expect(certrw.numWriteCalled).To(Equal(0))
265+
Expect(certrw.numOverwriteCalled).To(Equal(0))
251266
})
252267
})
253268

@@ -269,6 +284,7 @@ var _ = Describe("handleCommon", func() {
269284
err := handleCommon(webhook, certrw)
270285
Expect(err).NotTo(HaveOccurred())
271286
Expect(certrw.numReadCalled).To(Equal(1))
287+
Expect(certrw.numWriteCalled).To(Equal(0))
272288
Expect(certrw.numOverwriteCalled).To(Equal(1))
273289
})
274290

@@ -289,6 +305,7 @@ var _ = Describe("handleCommon", func() {
289305
err := handleCommon(webhook, certrw)
290306
Expect(err).NotTo(HaveOccurred())
291307
Expect(certrw.numReadCalled).To(Equal(1))
308+
Expect(certrw.numWriteCalled).To(Equal(0))
292309
Expect(certrw.numOverwriteCalled).To(Equal(1))
293310
})
294311

@@ -413,3 +430,210 @@ var _ = Describe("dnsNameForWebhook", func() {
413430
})
414431
})
415432
})
433+
434+
// pair1 is for DNS name: example.com
435+
var pair1Cert = []byte(`
436+
-----BEGIN CERTIFICATE-----
437+
MIIC2TCCAcGgAwIBAgIIfnO/uBlD+jMwDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UE
438+
AxMPd2ViaG9vay1jZXJ0LWNhMB4XDTE4MDcxMDIyMTgxN1oXDTE5MDcxMDIyMTgx
439+
OFowFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IB
440+
DwAwggEKAoIBAQDRWApXn6WIAw2ZU/q2WPU2X0I4brwZvvx3UBIKGYE6rxirWpNC
441+
zBBsK4lnn+5BTiS2cE59jZ1AAp1hwzlmmrok7PXQJuUX7rojIJ1JG3OqZAvVKv0y
442+
Hu7naPLR0mF51goEolsq79/6RMFEHnEG/PW/EHOSrmL+alENWhTANUBlwMQ/1J8P
443+
EnayvrX3RynNA98WOiKDpsFcj53pXd2zUlPZ5tht7HafWrkK/g8kZAe/b1XAlFaY
444+
usPOyhJFPiBYRatIRt7Txb582qHd85VeKkrjat3yfEQqsA52r0CmOot52RG+8uXr
445+
smuBGjtMYmsUiwn5f4UMCT3gqrWaHfOdais7AgMBAAGjJzAlMA4GA1UdDwEB/wQE
446+
AwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAQEAGAEm
447+
X6IL/A4DhmlcmedS9oCmp4qtyE3at4xU+7GIQ6fVMUAKpbXnXl5FEH+cuEbdzfTW
448+
DDCXxnpQmK6TJR+IEjmyNv1AOOLXiHiTCQVzz1rTyJN8mhUSRuoLC3KjfdI3Ccl2
449+
VwLm3IYQlEY/BQr7XiRLFws1ilVl04iSwwQEKiCmAe/9yZEPvH9l9USVoLvtJJc8
450+
t95PX4eUGYPGyO6nQWGX/4HvUo26XBXFEv+q2Lu5aOKhro4VF12p3nqkxG+kOmp1
451+
IF+79qBdgMtQfaKazRkAG2iWPPz6W6WvVGaczvodX7B0JCe+b9+Vd3zY2w5vaZq6
452+
JHVoxUBuexCYndPf8w==
453+
-----END CERTIFICATE-----
454+
`)
455+
456+
var pair1Key = []byte(`
457+
-----BEGIN RSA PRIVATE KEY-----
458+
MIIEowIBAAKCAQEA0VgKV5+liAMNmVP6tlj1Nl9COG68Gb78d1ASChmBOq8Yq1qT
459+
QswQbCuJZ5/uQU4ktnBOfY2dQAKdYcM5Zpq6JOz10CblF+66IyCdSRtzqmQL1Sr9
460+
Mh7u52jy0dJhedYKBKJbKu/f+kTBRB5xBvz1vxBzkq5i/mpRDVoUwDVAZcDEP9Sf
461+
DxJ2sr6190cpzQPfFjoig6bBXI+d6V3ds1JT2ebYbex2n1q5Cv4PJGQHv29VwJRW
462+
mLrDzsoSRT4gWEWrSEbe08W+fNqh3fOVXipK42rd8nxEKrAOdq9ApjqLedkRvvLl
463+
67JrgRo7TGJrFIsJ+X+FDAk94Kq1mh3znWorOwIDAQABAoIBAQDM3MFSOnL9BS/b
464+
qmkg5TEiQlpFa2g8McBS6lKc+5SRXyRfG8YciiJQGNLgS4wW8GfQ+Vp2V41ZRLXL
465+
JAcaN7SNyi5LwqRSpVYWZiZFks3AIyPJOcaJs+fLIdLuLlkhp6oqGs/o1tFy0rHm
466+
/XtSgV3j2i+fjXRm0Jf83viLmBErAJCgo+TD9dS7VCzdCDtiZpKHUq8EvQD9FRzF
467+
P3B59LHCTcCFBB+j8l9aE96eWsEXcuFUdghB+w0C85MTR3FEIDPd29mbXgZ3AlS3
468+
FwIatBargbhuyudNie/AusngCZZ1BxAUvIg3Nk/fI3Wgy8lPy4fF/tgJLUmAhDew
469+
vJ7j804xAoGBANOfVofdyPnAJJSTKG9ELkaG6pwseLrokcHQhVDXm+RAfk18OGUh
470+
W2mc/DpRtVPPGKoiylirE29qB9E5fywJVaEkEjd2Tb2TQPjDOKwMhJTGnrbvlhpr
471+
0/Zo70G5BqHn9EHMixdsNrSNwau1RYhLOfTpb9w4hzVntzJAAGK/l/MtAoGBAP0+
472+
YkVuqwyN6ct8ct7tgwFRH75SV4HoARwKrsZZKlCAGGc7WsfYmXx8Tu5eXEkhMDpN
473+
4wpj44squdj6+JFJEGdk2POwPa2onwCirbffImF/0AZHHm/WRxrQMlqcfnE+TYAr
474+
tQJZtlTi1tRXYGqDC2PR2lrejTDmjgtyfsWYA7kHAoGAQZuemhS6YCOfs6hD2usK
475+
ZbciOTTYYSoFNk9NZZjSrdsIzUD7wu6qhn2y/OmkC82i2exbS04OgnYe4lCvCpoC
476+
QCkMtMEqrOFgPT9Y7I4c9Hr3bcOth5dyaWxy8K9KTRu6cEPXw3U7KJLiPje+zNh1
477+
qWZN1bp4wKfc9ek9tV+s3ikCgYAulAjTKHXBi2CTEsK2Cg1scpVaFh8OP7Pkinp2
478+
9PN5dvYGFr6tv0MLyHlkEmr68GXEc4rs4E57zFH+fLq3Ti78NWpJ+AKALGGCZml5
479+
Rks2j6GdZftNKqZNYjnAvMPs5D6w8lkKo6GLn2VQDPoo3Q19QJ3e1Mw3UFCT/m0e
480+
vsUAhQKBgGNiN6EyMAcRn8Wh5kyY5jStDQKtID0reFUYf0VZcfNf8KSKqhJzHy8X
481+
S7R8Pq3QKiWo86tqFrA1PgcwD/69m5SzFo1JPWzDSiiLvwcigsurEoK1m3zUpSC0
482+
gD2teD4DuJSvS19WvRebC3035/qYOrmv2PAIaKSiYNzcGmDSOX9A
483+
-----END RSA PRIVATE KEY-----
484+
`)
485+
486+
var pair1CA = []byte(`
487+
-----BEGIN CERTIFICATE-----
488+
MIIC0jCCAbqgAwIBAgIBADANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw93ZWJo
489+
b29rLWNlcnQtY2EwHhcNMTgwNzEwMjIxODE3WhcNMjgwNzA3MjIxODE3WjAaMRgw
490+
FgYDVQQDEw93ZWJob29rLWNlcnQtY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
491+
ggEKAoIBAQDkXTPy5gJAjigEgyDU/+kEdAoTZKkaLXv45rJqLIozSyV/DveF1F6m
492+
/0C9K8IIAIM5T6TsYsS0BhD2CM/wWi1flXcG25vtA7n8RHuklkZqGx/LfKzdkElW
493+
+lETAAtcIIiJrTS1JLxfzRaeFMdmiRF+hByfRtWiMOG+yYzQp6VmI72FU6u/5PcA
494+
NInDuYx9iIjov6FEmK2nSJpZY7Z4UNCpQAui3IsajAtM0T+mnX2O3PA85ELtzZis
495+
hLSfnG3dQum7JtjA47co48W20BV43fiIZTyA16oMJirOW8Y/XNVaXvUduFSkhskf
496+
w5mNRL+NQcjaXuZxslpg4KDPWNWM1EIVAgMBAAGjIzAhMA4GA1UdDwEB/wQEAwIC
497+
pDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQDMxCy8Uvf1JHFP
498+
xtetGeeXs5lA9lFaxHlhsHfpGkuFd0exrNZTbNx4BJ2fwkmAreiJ9G5ykNcxFAx5
499+
8T1ri02elRDUQUkUSk1CYOvRjL7Tb2tXVOfPKUuNp8KX4YyQ+8H6QRi9Sz02AJ2U
500+
mNsQ+hnzKYNm4ew8gdmoUNzdPpovSo/GWmETScVV30i+odlA7yyww2MTWoZYXApI
501+
TW0pve7WWIK9L7sqmUwLS4ib0IoqcRCNuoMrz/ddDTkIxLmzWhVh3E72xWmXOnlm
502+
asdwRTGdlUKCvEN4BJMc99NswRPr3HwHHFOyf49LeDY+oZ1JcukGyVJNIjOat9Nk
503+
NU/8tP41
504+
-----END CERTIFICATE-----
505+
`)
506+
507+
// pair 2 is for DNS name: test-service.test-svc-namespace.svc
508+
var pair2Cert = []byte(`
509+
-----BEGIN CERTIFICATE-----
510+
MIIC8TCCAdmgAwIBAgIIM5wsxq4y7pkwDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UE
511+
AxMPd2ViaG9vay1jZXJ0LWNhMB4XDTE4MDcxMDIzMDAzM1oXDTE5MDcxMDIzMDAz
512+
M1owLjEsMCoGA1UEAxMjdGVzdC1zZXJ2aWNlLnRlc3Qtc3ZjLW5hbWVzcGFjZS5z
513+
dmMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7SNlyOM4k/HpYka+i
514+
Mt+INws+a+qQMVWsazjNfeeP83ckMjVQzfIhmUGhBKxruqqJ9GqxWQtKWieBVTC8
515+
mIoj00k3oF/r8V+DArOUcmTs0hHBhL+KMwtKMk1hYvHoiz7xwNtHNIhPy1n2z4zR
516+
kLkqhe/rQz55jLv6p6nJ9weHEsjgrTmzHNhvE1c/bII80Q4LH9dx+VUmLCoUfY5s
517+
byYOJJD5u0s9OxwKoPFFKPFRCsOj9lUhkmt6AArcAGBi5WXsc3faaF3vATRQ3v8E
518+
Gy6L0TqA1PRiP1taeperB0NBMNhiwtaKrXfQ5l9fMjWXGnn7WuuiAwVFIXhNR7ZN
519+
CwjrAgMBAAGjJzAlMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcD
520+
ATANBgkqhkiG9w0BAQsFAAOCAQEAQlO4peuNKtUHeXQ231LFNrTVg08dIEnHcuOk
521+
laUfeUoKE5ifNjdQBArtcECFlgGqSXEBS+fQnM9BEV2f6/ANyabPXmKugXWPpQEN
522+
uzCduxVSnBYqq28KtJ3Yj0SgPiQ/Wawn/6t5r/RSdkIymDzR4Wb1kL7oaMCGjeRc
523+
GAooblrPq3dKxJPi163BpxH0iL9Id4ZU4agFV12gUjv7IaHlzhWN+OkyaRRDKR59
524+
USlbVnnjNqFoNwzxfEcVZlCSGwSmx8LxpcYbaclnka2BmSKZSaxlQlNWKhZHXi8M
525+
CrJdMmDbdPjR/GC87Ub1XRATpZtvyR3enDrrArHHfblCNNTALQ==
526+
-----END CERTIFICATE-----
527+
`)
528+
529+
var pair2Key = []byte(`
530+
-----BEGIN RSA PRIVATE KEY-----
531+
MIIEpQIBAAKCAQEAu0jZcjjOJPx6WJGvojLfiDcLPmvqkDFVrGs4zX3nj/N3JDI1
532+
UM3yIZlBoQSsa7qqifRqsVkLSlongVUwvJiKI9NJN6Bf6/FfgwKzlHJk7NIRwYS/
533+
ijMLSjJNYWLx6Is+8cDbRzSIT8tZ9s+M0ZC5KoXv60M+eYy7+qepyfcHhxLI4K05
534+
sxzYbxNXP2yCPNEOCx/XcflVJiwqFH2ObG8mDiSQ+btLPTscCqDxRSjxUQrDo/ZV
535+
IZJregAK3ABgYuVl7HN32mhd7wE0UN7/BBsui9E6gNT0Yj9bWnqXqwdDQTDYYsLW
536+
iq130OZfXzI1lxp5+1rrogMFRSF4TUe2TQsI6wIDAQABAoIBAQCXPwfMRK/GEtfD
537+
OzQ5qxf2a217Ja+ybwUfTx/6Y9lj2Vy4MIv6C7elBp2HqbyM65zZ+DdJrf1+ODx7
538+
KA9J325/7BvO/oc4hh96L+5SzedPkX6hZ9E/jGVrsB/pq/xsrjdRCUyMvpHuzuyC
539+
c67ndxbyjmPo/M8xXkRY8pod7o93toQ1Pao1w2sgHx6fOMVj9l2OquFAOwM7/PMa
540+
ro+a2FwZHfX4Z+2AHGaCfbi6C8JgkIF4p5UkEziHbH5nxIQLKSb8nui/Zap3h9F/
541+
a/40TuE6oRQbZl8SJuUEZMIF08PV9QLQLo859GArdq6tEyEov/+P54JPOt8ARzwJ
542+
tqh4qOohAoGBANpnca1OROh3fzov03fhJLiGc0NeCjCbhEr887C0b91v/WyLGCjK
543+
lb+wmqxxTkWqrnAihyYZ5LGnxUbypX17weIpOWdOo1UO+AFxn4qD3K6mhWuNyn9+
544+
dlCoYcsBIKrLygCjmkvWcAq03g1bxykYNHPg+SSE+JCzyDPMDRRpWwh5AoGBANuG
545+
CpxjOtHL5lj9LoI5QTK3X3LuBVtIAu+lT5lRTKacnU21eEyO3XnX0BlQx8Z+SYKk
546+
DVLdHJ1bhqra2+1cprsFW6VPOn7hjaiCmoHqy/aJ4F3eeMtuCPOUG+In/b8swaXV
547+
V/dPbimiizKaeg/BohAz+8j1I9khxNvn+05lvIuDAoGBAMevbLAXr8kb+Kcqsx4Y
548+
K4rK4vflM0vd5MbrH6OgVecQTZTAWAZzsxbgUYr4zafEtliwOQENC5ui2SxVDhn8
549+
3Pf62RErRQqv9PDdAhGTHmJQvgvoSAzpgyOb0E3bahK+4KJU8u4D0cz4MU3la+KW
550+
zt5kA2bwbJNgzNsO5aaT7TeBAoGBALxyJbu4Ry8ADV6JARrTEY/68FoVz81bVQHp
551+
9BnWO6mvOi4SQRHfdmp5A/Anc0eG843NTI68tyqx/jm/JRpu9cYIRHL1P27aKyPj
552+
8cTjDXI3S77pEuL3M4H9u635zI8HWbkFGr13l0bwfPPUvkG2ZGvqZBNPtRVZMsfg
553+
LdBP73oHAoGAdiwCHndHuylxNeL3rB6GYdfBh/gHMidb5v+tDrvzQuryb/CH3Sby
554+
rWDh2D/KVWeil1fn00/fIIt11dR1vQ9r7/X+hlzZq0xZbbKogPeXgvgmO34wSyha
555+
8ar7jKsQwVsE/FAqryItE93Mw0ogheEUTrDxD1vEe4xYRi8Jk+pJKDY=
556+
-----END RSA PRIVATE KEY-----
557+
`)
558+
559+
var pair2CA = []byte(`
560+
-----BEGIN CERTIFICATE-----
561+
MIIC0jCCAbqgAwIBAgIBADANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw93ZWJo
562+
b29rLWNlcnQtY2EwHhcNMTgwNzEwMjMwMDMzWhcNMjgwNzA3MjMwMDMzWjAaMRgw
563+
FgYDVQQDEw93ZWJob29rLWNlcnQtY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
564+
ggEKAoIBAQCqHWHCyD33VaZ1WpPFFymAmypXQL1S/ZCmNygDgni7IRpseA70H0bb
565+
Wp2KRO7rp/ggtIGVNqj1R99GLf4w22oN5I2ENHL2BSEIccFG0KCovHuec/2I6gAk
566+
ZpMZROwp9TUL207ArB13oNyY6XBWIDOriPdC2oXj5JHkge9895FgjuBxN80xzjs+
567+
KpACRBa6iJy8xuCqrxc57zFcfKLxi5rdRAznhAuuCsPfOndZANZhknDv9lSyXll+
568+
uJVBo4+p62i8lz3+6TxO0NgAw7Ddw3N8lxq2WiGX5eUu6Goha7skG6OZrIAkQeHs
569+
O9aIPGouLNYIAQjl4xtsB1JLGKi40KgNAgMBAAGjIzAhMA4GA1UdDwEB/wQEAwIC
570+
pDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAlP5qFvH3G9JXF
571+
GxHm3nhcwBtez/NjbohhtoiwxY8vqEas3JtD5TKujew5m774ddNZUL29yr9Bumz3
572+
HxTMT9WF7WV3pORRqQ23phjEgkl2kAoQMaCca5bLOUq7g/aEna66Ep3AcSbbaONG
573+
VntKif6kU79jx40NS8fvqcKOYEFYDCk5xmGH//xf8l0Mt3CKI0DrWUTiVfImsYEy
574+
VrQIySVlmWA0awlOB4/fB7/3slf1nBWXY1tiIOQpc6K4mbJjHcSekp5T8GrR38Se
575+
Vvnwc7+eaaZECqlPF108hrIShJoDW0BvnY23Y1vJlMHb7BPjTu7rlu4+aHvn2HX4
576+
KkYt/5rj
577+
-----END CERTIFICATE-----
578+
`)
579+
580+
var _ = Describe("validate cert", func() {
581+
Context("invalid pair", func() {
582+
It("should detect it", func() {
583+
certs := generator.Artifacts{
584+
CACert: pair1CA,
585+
Cert: pair1Cert,
586+
Key: pair2Key,
587+
}
588+
valid, err := validCert(&certs, "example.com", 6*month)
589+
Expect(err).NotTo(HaveOccurred())
590+
Expect(valid).To(BeFalse())
591+
})
592+
})
593+
594+
Context("CA not matching", func() {
595+
It("should detect it", func() {
596+
certs := generator.Artifacts{
597+
CACert: pair2CA,
598+
Cert: pair1Cert,
599+
Key: pair1Key,
600+
}
601+
valid, err := validCert(&certs, "example.com", 6*month)
602+
Expect(err).NotTo(HaveOccurred())
603+
Expect(valid).To(BeFalse())
604+
})
605+
})
606+
607+
Context("DNS name not matching", func() {
608+
It("should detect it", func() {
609+
certs := generator.Artifacts{
610+
CACert: pair1CA,
611+
Cert: pair1Cert,
612+
Key: pair1Key,
613+
}
614+
valid, err := validCert(&certs, "foo.com", 6*month)
615+
Expect(err).NotTo(HaveOccurred())
616+
Expect(valid).To(BeFalse())
617+
})
618+
})
619+
620+
Context("gen a cert valid for 1 year", func() {
621+
var certs *generator.Artifacts
622+
var err error
623+
BeforeEach(func(done Done) {
624+
gen := &generator.SelfSignedCertGenerator{}
625+
certs, err = gen.Generate("example.com")
626+
Expect(err).NotTo(HaveOccurred())
627+
close(done)
628+
}, 10)
629+
It("expiration detection should work", func() {
630+
valid, err := validCert(certs, "example.com", 11*month)
631+
Expect(err).NotTo(HaveOccurred())
632+
Expect(valid).To(BeTrue())
633+
634+
valid, err = validCert(certs, "example.com", 13*month)
635+
Expect(err).NotTo(HaveOccurred())
636+
Expect(valid).To(BeFalse())
637+
})
638+
})
639+
})

0 commit comments

Comments
 (0)