upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-04-20 22:01:49 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

REGTESTS: set_ssl_server_cert.vtc: check the Sha1 Fingerprint

Browse source 
Check the sha1 fingerprint once the certificate was changed with "show
ssl cert". This way the test is more reliable.
This commit is contained in:
William Lallemand 2021-01-28 14:59:19 +01:00
parent 8788c6ff13
commit 7e69637ac5
1 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
reg-tests/ssl/set_ssl_server_cert.vtc
View file

@ -59,12 +59,23 @@ client c1 -connect ${h1_clearlst_sock} {
expect resp.http.x-ssl == "Ok"
} -run
haproxy h1 -cli {
send "show ssl cert ${testdir}/client1.pem"
expect ~ ".*SHA1 FingerPrint: D9C3BAE37EA5A7EDB7B3C9BDD4DCB2FE58A412E4"
}
# Replace certificate with an expired one
shell {
printf "set ssl cert ${testdir}/client1.pem <<\n$(cat ${testdir}/client2_expired.pem)\n\n" | socat "${tmpdir}/h1/stats" -
echo "commit ssl cert ${testdir}/client1.pem" | socat "${tmpdir}/h1/stats" -
}
haproxy h1 -cli {
send "show ssl cert ${testdir}/client1.pem"
expect ~ ".*SHA1 FingerPrint: C625EB01A0A660294B9D7F44C5CEEE5AFC495BE4"
}
# The updated client certificate is an expired one so this request should fail
client c1 -connect ${h1_clearlst_sock} {
txreq
@ -79,6 +90,11 @@ shell {
echo "commit ssl cert ${testdir}/client1.pem" | socat "${tmpdir}/h1/stats" -
}
haproxy h1 -cli {
send "show ssl cert ${testdir}/client1.pem"
expect ~ ".*SHA1 FingerPrint: 992386628A40C9D49C89BAC0058B5D45D8575151"
}
# The updated client certificate is a revoked one so this request should fail
client c1 -connect ${h1_clearlst_sock} {
txreq