mirror of
https://github.com/thib8956/nginx-proxy
synced 2025-07-01 14:25:46 +00:00
TESTS: replace old test suite with the new one
get rid of Bats definitively
This commit is contained in:
Thomas LEVEIL
81
test/certs/README.md
Normal file
81
test/certs/README.md
Normal file
@ -0,0 +1,81 @@
|
||||
create_server_certificate.sh
|
||||
============================
|
||||
|
||||
`create_server_certificate.sh` is a script helping with issuing server certificates that can be used to provide TLS on web servers.
|
||||
|
||||
It also creates a Certificate Authority (CA) root key and certificate. This CA root certificate can be used to validate the server certificates it generates.
|
||||
|
||||
For instance, with _curl_:
|
||||
|
||||
curl --cacert /somewhere/ca-root.crt https://www.example.com/
|
||||
|
||||
or with _wget_:
|
||||
|
||||
wget --certificate=/somewhere/ca-root.crt https://www.example.com/
|
||||
|
||||
or with the python _requests_ module:
|
||||
|
||||
import requests
|
||||
r = requests.get("https://www.example.com", verify="/somewhere/ca-root.crt")
|
||||
|
||||
Usage
|
||||
-----
|
||||
|
||||
### Simple domain
|
||||
|
||||
Create a server certificate for domain `www.example.com`:
|
||||
|
||||
./create_server_certificate.sh www.example.com
|
||||
|
||||
Will produce:
|
||||
- `www.example.com.key`
|
||||
- `www.example.com.crt`
|
||||
|
||||
|
||||
### Multiple domains
|
||||
|
||||
Create a server certificate for main domain `www.example.com` and alternative domains `example.com`, `foo.com` and `bar.com`:
|
||||
|
||||
./create_server_certificate.sh www.example.com foo.com bar.com
|
||||
|
||||
Will produce:
|
||||
- `www.example.com.key`
|
||||
- `www.example.com.crt`
|
||||
|
||||
### Wildcard domain
|
||||
|
||||
Create a server certificate for wildcard domain `*.example.com`:
|
||||
|
||||
./create_server_certificate.sh "*.example.com"
|
||||
|
||||
Note that you need to use quotes around the domain string or the shell would expand `*`.
|
||||
|
||||
Will produce:
|
||||
- `*.example.com.key`
|
||||
- `*.example.com.crt`
|
||||
|
||||
Again, to prevent your shell from expanding `*`, use quotes. i.e.: `cat "*.example.com.crt"`.
|
||||
|
||||
Such a server certificate would be valid for domains:
|
||||
- `foo.example.com`
|
||||
- `bar.example.com`
|
||||
|
||||
but not for domains:
|
||||
- `example.com`
|
||||
- `foo.bar.example.com`
|
||||
|
||||
|
||||
### Wildcard domain on multiple levels
|
||||
|
||||
While you can technically create a server certificate for wildcard domain `*.example.com` and alternative name `*.*.example.com`, client implementations generally do not support multiple wildcards in a domain name.
|
||||
|
||||
For instance, a python script using urllib3 would fail to validate domain `foo.bar.example.com` presenting a certificate with name `*.*.example.com`. It is advised to stay away from producing such certificates.
|
||||
|
||||
If you want to give it a try:
|
||||
|
||||
./create_server_certificate.sh "*.example.com" "*.*.example.com"
|
||||
|
||||
Such a server certificate would be valid for domains:
|
||||
- `foo.example.com`
|
||||
- `bar.example.com`
|
||||
- `foo.bar.example.com`
|
||||
21
test/certs/ca-root.crt
Normal file
21
test/certs/ca-root.crt
Normal file
@ -0,0 +1,21 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDZDCCAkygAwIBAgIJAJmW6Ju6iJNNMA0GCSqGSIb3DQEBCwUAMD8xHzAdBgNV
|
||||
BAoMFm5naW54LXByb3h5IHRlc3Qgc3VpdGUxHDAaBgNVBAMME3d3dy5uZ2lueC1w
|
||||
cm94eS50bGQwHhcNMTcwMTEwMDAwODUxWhcNMjcwMTA4MDAwODUxWjA/MR8wHQYD
|
||||
VQQKDBZuZ2lueC1wcm94eSB0ZXN0IHN1aXRlMRwwGgYDVQQDDBN3d3cubmdpbngt
|
||||
cHJveHkudGxkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAndjE3OPr
|
||||
48hIOQigk/HejrowsQDLNfkkc6vej0J983rJitGTgBfxqq27fOPfqhE5bi1M5JDk
|
||||
KkrOrSitxCJLgpq+4Ls9/RXg8skZFHRAQbNwuKBehaDkPdamJ0i3dv6e4kZy41oI
|
||||
RqxQ/MKdminC4LShFZvPoKeh9ae7w1MgB2/4E68LO66bYiHlLNL7ENViSHhLyCmt
|
||||
qIE7kdV9jgn2NuVJ37m6/6SNQ3GBiIjEW+ooRQ3HEVKBCismcwq80+BD5VS/yW18
|
||||
KqX8m4sBM+IgZbcOqrV+APMbGvd8iNJgQSSQC/r0Wscgt7UeggVYKDazjDSPvLUE
|
||||
FUN5wEmydkP2AQIDAQABo2MwYTAdBgNVHQ4EFgQUJL59pHomt+8dUNxv8HgrYjKf
|
||||
OA8wHwYDVR0jBBgwFoAUJL59pHomt+8dUNxv8HgrYjKfOA8wDwYDVR0TAQH/BAUw
|
||||
AwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggEBABALxY96YqsZ
|
||||
CL2crzY0FIGhfjLE7P3mtUGklUpFu7xyI6mGUyL1nJYSnHB5IEV6QLhVVUE/CojI
|
||||
crXorQWBDkx26AgCt/eIOdvPYC0JDeXiIhH6sld3yH7JGwGqJkfXaUUfUkuwMae7
|
||||
mMIEG9e6vfSh/YNTRxs0KBjBcXHHl5K+Dz4h9r14OqnQFqVFZaR6T6td44tDDNhn
|
||||
beW8iIfCWRqDsnvIcJzLa2QR4onmJSw5DaSeFFaKefhdHEzEBZntLfyFbjRYHT/O
|
||||
+BRdewhg6rSDkGLcL8n/ZnRLOa+xmegjQ/Op94OmWO3TfXOITJAtkaO2YVZoyek8
|
||||
T6ckVovq4zU=
|
||||
-----END CERTIFICATE-----
|
||||
27
test/certs/ca-root.key
Normal file
27
test/certs/ca-root.key
Normal file
@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpQIBAAKCAQEAndjE3OPr48hIOQigk/HejrowsQDLNfkkc6vej0J983rJitGT
|
||||
gBfxqq27fOPfqhE5bi1M5JDkKkrOrSitxCJLgpq+4Ls9/RXg8skZFHRAQbNwuKBe
|
||||
haDkPdamJ0i3dv6e4kZy41oIRqxQ/MKdminC4LShFZvPoKeh9ae7w1MgB2/4E68L
|
||||
O66bYiHlLNL7ENViSHhLyCmtqIE7kdV9jgn2NuVJ37m6/6SNQ3GBiIjEW+ooRQ3H
|
||||
EVKBCismcwq80+BD5VS/yW18KqX8m4sBM+IgZbcOqrV+APMbGvd8iNJgQSSQC/r0
|
||||
Wscgt7UeggVYKDazjDSPvLUEFUN5wEmydkP2AQIDAQABAoIBAQCDM4zetix6lx1B
|
||||
GuSuVFrTc/vJBInkgQRFiVRi67fZS/R+CJl73WsonWO7+YUNzWdZJxpE2hJs/OUx
|
||||
lSBqaL8u/gUuszRhS3BBHdpU4BQRCF/ndpVaqVNN+z78ZDrrE9Vo63nPdCRw6gYf
|
||||
MnzhiVjMghdq6Kn6NZwvno45WrzCsIbrrQ4zU+S2PhG8MTA53jzqqQ8mUSJX0lAl
|
||||
6b9+1aWA0d0Jnk3M3doaFU/Dlnz3n6kkx0AdqNe8bdsFrPfwsrF+dwGx04SGgLmK
|
||||
V2OjIDFYYGtiHp3PJ9IYIA32ij+UloSDDZ2BxXkma8Zilw04ytY5l8tlk2ZDWTD9
|
||||
U2MXxjmBAoGBAMmmI19I/asTPjljlqzrOsrdRkklJvnCHgy/yw9u3nMfkJ0lLGAp
|
||||
mZoCqJIEsAqlLGM5bOjKy3KQ3n2SBX3mz7/RajnpJRTnNLeJIPAAXHN9TDyKcWRo
|
||||
Los6xHN7YMSLYKs4HMihXp9Yu4Ms88/8nO/01nufjN0rTgFnWdL0WfxJAoGBAMhk
|
||||
Qm92ukMmbrXSrV0WF+eFooHwgPmUWZ1oZY5ZHmO3FCuSBHiICGrWKmdbcG6H5zmZ
|
||||
oFZ0unsvk2Yjl+/+tntxr/dwp6Q+chsqkLms8GE76NWEO8qn4hQNywkFgpKlPci3
|
||||
n5IqpuQ2DpJ1PAQkwgZD/5rSscNidNMezXO5Uvv5AoGBALR291kjXcJpKlr6AbMn
|
||||
oipD9c8obMVBMNuAGh7pvjORoD7DMf+tu0XV8z8a6uHcCOmUTx/XvlP9yuDeegO/
|
||||
OVYV+NdzDDi04r0PAGdKK3NAQ6Y60Fhn1J/OLFqdpHDBu/X/9eKoaKJ7KvWumVUe
|
||||
YuVtXTauB8c4JkujTwQ4ov/hAoGAHxvhbGhkFhSbT0K7gx3w7BJE3iM2AojTOKqC
|
||||
SYzwOM6tJO5wHz4PAHbq8kyxsZcLgFenGoTYhlMmcM7JwYorThKiHKmyfL7s++ap
|
||||
vQlp785bIPp8RcO2RyK1CFuAn79jTgujjA9vBTKXJIlqncIPFOXtgl1/FzPrqvK3
|
||||
NmXoyhECgYEAje9hM9RYO0jbfmTZoQh+onMRz34SM9XWLH+NQGgfvsGtjeRnrUKK
|
||||
GuWQz/GQGJLy/Uc1KHIdrfPDjvQhZXmPL1v7pNfCrqyj+EnKCNDPPnYq5Zq4WLsB
|
||||
x1hKPH0LmfEBkXOiFGrD3h3KAuBK5nb0/EFBDR4JuMaySC5CpbOds9o=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
183
test/certs/create_server_certificate.sh
Executable file
183
test/certs/create_server_certificate.sh
Executable file
@ -0,0 +1,183 @@
|
||||
#!/bin/bash
|
||||
set -u
|
||||
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
||||
|
||||
if [[ "$#" -eq 0 ]]; then
|
||||
cat <<-EOF
|
||||
|
||||
To generate a server certificate, provide the domain name as a parameter:
|
||||
$(basename $0) www.my-domain.tdl
|
||||
$(basename $0) www.my-domain.tdl alternate.domain.tld
|
||||
|
||||
You can also create certificates for wildcard domains:
|
||||
$(basename $0) '*.my-domain.tdl'
|
||||
|
||||
EOF
|
||||
exit 0
|
||||
else
|
||||
DOMAIN="$1"
|
||||
ALTERNATE_DOMAINS="DNS:$( echo "$@" | sed 's/ /,DNS:/g')"
|
||||
fi
|
||||
|
||||
|
||||
###############################################################################
|
||||
# Create a nginx container (which conveniently provides the `openssl` command)
|
||||
###############################################################################
|
||||
|
||||
CONTAINER=$(docker run -d -v $DIR:/work -w /work -e SAN="$ALTERNATE_DOMAINS" nginx:1.11.8)
|
||||
# Configure openssl
|
||||
docker exec $CONTAINER bash -c '
|
||||
mkdir -p /ca/{certs,crl,private,newcerts} 2>/dev/null
|
||||
echo 1000 > /ca/serial
|
||||
touch /ca/index.txt
|
||||
cat > /ca/openssl.cnf <<-"OESCRIPT"
|
||||
[ ca ]
|
||||
# `man ca`
|
||||
default_ca = CA_default
|
||||
|
||||
[ CA_default ]
|
||||
# Directory and file locations.
|
||||
dir = /ca
|
||||
certs = $dir/certs
|
||||
crl_dir = $dir/crl
|
||||
new_certs_dir = $dir/newcerts
|
||||
database = $dir/index.txt
|
||||
serial = $dir/serial
|
||||
RANDFILE = $dir/private/.rand
|
||||
|
||||
# The root key and root certificate.
|
||||
private_key = /work/ca-root.key
|
||||
certificate = /work/ca-root.crt
|
||||
|
||||
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||
default_md = sha256
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
default_days = 10000
|
||||
preserve = no
|
||||
policy = policy_loose
|
||||
|
||||
[ policy_loose ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ req ]
|
||||
# Options for the `req` tool (`man req`).
|
||||
default_bits = 2048
|
||||
distinguished_name = req_distinguished_name
|
||||
string_mask = utf8only
|
||||
|
||||
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||
default_md = sha256
|
||||
|
||||
# Extension to add when the -x509 option is used.
|
||||
x509_extensions = v3_ca
|
||||
|
||||
[ req_distinguished_name ]
|
||||
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
|
||||
countryName = Country Name (2 letter code)
|
||||
stateOrProvinceName = State or Province Name
|
||||
localityName = Locality Name
|
||||
0.organizationName = Organization Name
|
||||
organizationalUnitName = Organizational Unit Name
|
||||
commonName = Common Name
|
||||
emailAddress = Email Address
|
||||
|
||||
[ v3_ca ]
|
||||
# Extensions for a typical CA (`man x509v3_config`).
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer
|
||||
basicConstraints = critical, CA:true
|
||||
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
|
||||
|
||||
[ server_cert ]
|
||||
# Extensions for server certificates (`man x509v3_config`).
|
||||
basicConstraints = CA:FALSE
|
||||
nsCertType = server
|
||||
nsComment = server certificate generated for test purpose (nginx-proxy test suite)
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
keyUsage = critical, digitalSignature, keyEncipherment
|
||||
extendedKeyUsage = serverAuth
|
||||
|
||||
[ san_env ]
|
||||
subjectAltName=${ENV::SAN}
|
||||
OESCRIPT
|
||||
'
|
||||
|
||||
# shortcut for calling `openssl` inside the container
|
||||
function openssl {
|
||||
docker exec $CONTAINER openssl "$@"
|
||||
}
|
||||
|
||||
function exitfail {
|
||||
echo
|
||||
echo ERROR: "$@"
|
||||
docker rm -f $CONTAINER
|
||||
exit 1
|
||||
}
|
||||
|
||||
|
||||
###############################################################################
|
||||
# Setup Certificate authority
|
||||
###############################################################################
|
||||
|
||||
if ! [[ -f "$DIR/ca-root.key" ]]; then
|
||||
echo
|
||||
echo "> Create a Certificate Authority root key: $DIR/ca-root.key"
|
||||
openssl genrsa -out ca-root.key 2048
|
||||
[[ $? -eq 0 ]] || exitfail failed to generate CA root key
|
||||
fi
|
||||
|
||||
# Create a CA root certificate
|
||||
if ! [[ -f "$DIR/ca-root.crt" ]]; then
|
||||
echo
|
||||
echo "> Create a CA root certificate: $DIR/ca-root.crt"
|
||||
openssl req -config /ca/openssl.cnf \
|
||||
-key ca-root.key \
|
||||
-new -x509 -days 3650 -subj "/O=nginx-proxy test suite/CN=www.nginx-proxy.tld" -extensions v3_ca \
|
||||
-out ca-root.crt
|
||||
[[ $? -eq 0 ]] || exitfail failed to generate CA root certificate
|
||||
|
||||
# Verify certificate
|
||||
openssl x509 -noout -text -in ca-root.crt
|
||||
fi
|
||||
|
||||
|
||||
###############################################################################
|
||||
# create server key and certificate signed by the certificate authority
|
||||
###############################################################################
|
||||
|
||||
echo
|
||||
echo "> Create a host key: $DIR/$DOMAIN.key"
|
||||
openssl genrsa -out "$DOMAIN.key" 2048
|
||||
|
||||
echo
|
||||
echo "> Create a host certificate signing request"
|
||||
|
||||
SAN="$ALTERNATE_DOMAINS" openssl req -config /ca/openssl.cnf \
|
||||
-key "$DOMAIN.key" \
|
||||
-new -out "/ca/$DOMAIN.csr" -days 1000 -extensions san_env -subj "/CN=$DOMAIN"
|
||||
[[ $? -eq 0 ]] || exitfail failed to generate server certificate signing request
|
||||
|
||||
echo
|
||||
echo "> Create server certificate: $DIR/$DOMAIN.crt"
|
||||
SAN="$ALTERNATE_DOMAINS" openssl ca -config /ca/openssl.cnf -batch \
|
||||
-extensions server_cert \
|
||||
-extensions san_env \
|
||||
-in "/ca/$DOMAIN.csr" \
|
||||
-out "$DOMAIN.crt"
|
||||
[[ $? -eq 0 ]] || exitfail failed to generate server certificate
|
||||
|
||||
|
||||
# Verify host certificate
|
||||
#openssl x509 -noout -text -in "$DOMAIN.crt"
|
||||
|
||||
|
||||
docker rm -f $CONTAINER >/dev/null
|
||||
Reference in New Issue
Block a user