Skip to content

Commit b0f2ab7

Browse files
edewataedewata
committed
Add test for caTransportCert profile
1 parent 7d11506 commit b0f2ab7

2 files changed

Lines changed: 388 additions & 0 deletions

File tree

‎.github/workflows/ca-profile-caTransportCert-test.yml‎

Lines changed: 383 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,383 @@
1+
name: CA with caTransportCert profile
2+
# This test will perform the following operations:
3+
# - install CA
4+
# - enroll cert using PKCS10Client
5+
# - enroll cert using CRMFPopClient without POP
6+
# - enroll cert using CRMFPopClient with POP
7+
# - enroll cert using PKI CLI with PKCS #10 request
8+
# - enroll cert using PKI CLI with CRMF request without POP
9+
# - enroll cert using PKI CLI with CRMF request with POP
10+
# - remove CA
11+
12+
on: workflow_call
13+
14+
env:
15+
DS_IMAGE: ${{ vars.DS_IMAGE || 'quay.io/389ds/dirsrv' }}
16+
17+
jobs:
18+
test:
19+
name: Test
20+
runs-on: ubuntu-latest
21+
env:
22+
SHARED: /tmp/workdir/pki
23+
steps:
24+
- name: Clone repository
25+
uses: actions/checkout@v4
26+
27+
- name: Retrieve PKI images
28+
uses: actions/cache@v4
29+
with:
30+
key: pki-images-${{ github.sha }}
31+
path: pki-images.tar
32+
33+
- name: Load PKI images
34+
run: docker load --input pki-images.tar
35+
36+
- name: Create network
37+
run: docker network create example
38+
39+
- name: Set up DS container
40+
run: |
41+
tests/bin/ds-create.sh \
42+
--image=${{ env.DS_IMAGE }} \
43+
--hostname=ds.example.com \
44+
--network=example \
45+
--network-alias=ds.example.com \
46+
--password=Secret.123 \
47+
ds
48+
49+
- name: Set up PKI container
50+
run: |
51+
tests/bin/runner-init.sh \
52+
--hostname=pki.example.com \
53+
--network=example \
54+
--network-alias=pki.example.com \
55+
pki
56+
57+
docker exec pki dnf install -y dumpasn1
58+
59+
- name: Install CA
60+
run: |
61+
docker exec pki pkispawn \
62+
-f /usr/share/pki/server/examples/installation/ca.cfg \
63+
-s CA \
64+
-D pki_ds_url=ldap://ds.example.com:3389 \
65+
-v
66+
67+
- name: Set up CA admin
68+
run: |
69+
docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
70+
71+
docker exec pki pki nss-cert-import \
72+
--cert ca_signing.crt \
73+
--trust CT,C,C \
74+
ca_signing
75+
76+
docker exec pki pki pkcs12-import \
77+
--pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
78+
--pkcs12-password Secret.123
79+
80+
- name: Enroll cert using PKCS10Client
81+
run: |
82+
# generate PKCS #10 request
83+
docker exec pki PKCS10Client \
84+
-d /root/.dogtag/nssdb \
85+
-n "CN=test-PKCS10Client" \
86+
-o test-PKCS10Client.csr
87+
88+
docker exec pki cat test-PKCS10Client.csr
89+
90+
docker exec pki AtoB test-PKCS10Client.csr test-PKCS10Client.der
91+
92+
# ignore invalid PKCS #10 data
93+
docker exec pki dumpasn1 test-PKCS10Client.der || true
94+
95+
# issue cert
96+
docker exec pki pki \
97+
-n caadmin \
98+
ca-cert-issue \
99+
--profile caTransportCert \
100+
--csr-file test-PKCS10Client.csr \
101+
--output-file test-PKCS10Client.crt
102+
103+
# import cert
104+
docker exec pki pki nss-cert-import \
105+
--cert test-PKCS10Client.crt \
106+
test-PKCS10Client
107+
108+
docker exec pki pki nss-cert-show test-PKCS10Client | tee output
109+
110+
# normalize output
111+
sed \
112+
-e '/^ *Serial Number:/d' \
113+
-e '/^ *Not Valid Before:/d' \
114+
-e '/^ *Not Valid After:/d' \
115+
output > actual
116+
117+
# the cert should match the key (trust flags must be u,u,u)
118+
cat > expected << EOF
119+
Nickname: test-PKCS10Client
120+
Subject DN: CN=test-PKCS10Client
121+
Issuer DN: CN=CA Signing Certificate,OU=pki-tomcat,O=EXAMPLE
122+
Trust Flags: u,u,u
123+
EOF
124+
125+
diff expected actual
126+
127+
- name: Enroll cert using CRMFPopClient without POP
128+
run: |
129+
# generate CRMF request
130+
docker exec pki CRMFPopClient \
131+
-d /root/.dogtag/nssdb \
132+
-p "" \
133+
-n "CN=test-CRMFPopClient-without-POP" \
134+
-q POP_NONE \
135+
-o test-CRMFPopClient-without-POP.csr
136+
137+
docker exec pki cat test-CRMFPopClient-without-POP.csr
138+
139+
docker exec pki AtoB test-CRMFPopClient-without-POP.csr test-CRMFPopClient-without-POP.der
140+
docker exec pki dumpasn1 test-CRMFPopClient-without-POP.der
141+
142+
# issue cert
143+
docker exec pki pki \
144+
-n caadmin \
145+
ca-cert-issue \
146+
--request-type crmf \
147+
--profile caTransportCert \
148+
--subject CN=test-CRMFPopClient-without-POP \
149+
--csr-file test-CRMFPopClient-without-POP.csr \
150+
--output-file test-CRMFPopClient-without-POP.crt
151+
152+
# import cert
153+
docker exec pki pki nss-cert-import \
154+
--cert test-CRMFPopClient-without-POP.crt \
155+
test-CRMFPopClient-without-POP
156+
157+
docker exec pki pki nss-cert-show test-CRMFPopClient-without-POP | tee output
158+
159+
# normalize output
160+
sed \
161+
-e '/^ *Serial Number:/d' \
162+
-e '/^ *Not Valid Before:/d' \
163+
-e '/^ *Not Valid After:/d' \
164+
output > actual
165+
166+
# the cert should match the key (trust flags must be u,u,u)
167+
cat > expected << EOF
168+
Nickname: test-CRMFPopClient-without-POP
169+
Subject DN: CN=test-CRMFPopClient-without-POP
170+
Issuer DN: CN=CA Signing Certificate,OU=pki-tomcat,O=EXAMPLE
171+
Trust Flags: u,u,u
172+
EOF
173+
174+
diff expected actual
175+
176+
- name: Enroll cert using CRMFPopClient with POP
177+
run: |
178+
# generate CRMF request
179+
docker exec pki CRMFPopClient \
180+
-d /root/.dogtag/nssdb \
181+
-p "" \
182+
-n "CN=test-CRMFPopClient-with-POP" \
183+
-o test-CRMFPopClient-with-POP.csr
184+
185+
docker exec pki cat test-CRMFPopClient-with-POP.csr
186+
187+
docker exec pki AtoB test-CRMFPopClient-with-POP.csr test-CRMFPopClient-with-POP.der
188+
docker exec pki dumpasn1 test-CRMFPopClient-with-POP.der
189+
190+
# issue cert
191+
docker exec pki pki \
192+
-n caadmin \
193+
ca-cert-issue \
194+
--request-type crmf \
195+
--profile caTransportCert \
196+
--subject CN=test-CRMFPopClient-with-POP \
197+
--csr-file test-CRMFPopClient-with-POP.csr \
198+
--output-file test-CRMFPopClient-with-POP.crt
199+
200+
# import cert
201+
docker exec pki pki nss-cert-import \
202+
--cert test-CRMFPopClient-with-POP.crt \
203+
test-CRMFPopClient-with-POP
204+
205+
docker exec pki pki nss-cert-show test-CRMFPopClient-with-POP | tee output
206+
207+
# normalize output
208+
sed \
209+
-e '/^ *Serial Number:/d' \
210+
-e '/^ *Not Valid Before:/d' \
211+
-e '/^ *Not Valid After:/d' \
212+
output > actual
213+
214+
# the cert should match the key (trust flags must be u,u,u)
215+
cat > expected << EOF
216+
Nickname: test-CRMFPopClient-with-POP
217+
Subject DN: CN=test-CRMFPopClient-with-POP
218+
Issuer DN: CN=CA Signing Certificate,OU=pki-tomcat,O=EXAMPLE
219+
Trust Flags: u,u,u
220+
EOF
221+
222+
diff expected actual
223+
224+
- name: "Enroll cert using PKI CLI with PKCS #10 request"
225+
run: |
226+
# generate PKCS #10 request
227+
docker exec pki pki nss-cert-request \
228+
--subject "CN=test-PKI-CLI-PKCS10" \
229+
--csr test-PKI-CLI-PKCS10.csr
230+
231+
docker exec pki cat test-PKI-CLI-PKCS10.csr
232+
233+
docker exec pki AtoB test-PKI-CLI-PKCS10.csr test-PKI-CLI-PKCS10.der
234+
235+
# ignore invalid PKCS #10 data
236+
docker exec pki dumpasn1 test-PKI-CLI-PKCS10.der || true
237+
238+
# issue cert
239+
docker exec pki pki \
240+
-n caadmin \
241+
ca-cert-issue \
242+
--profile caTransportCert \
243+
--csr-file test-PKI-CLI-PKCS10.csr \
244+
--output-file test-PKI-CLI-PKCS10.crt
245+
246+
# import cert
247+
docker exec pki pki nss-cert-import \
248+
--cert test-PKI-CLI-PKCS10.crt \
249+
test-PKI-CLI-PKCS10
250+
251+
docker exec pki pki nss-cert-show test-PKI-CLI-PKCS10 | tee output
252+
253+
# normalize output
254+
sed \
255+
-e '/^ *Serial Number:/d' \
256+
-e '/^ *Not Valid Before:/d' \
257+
-e '/^ *Not Valid After:/d' \
258+
output > actual
259+
260+
# the cert should match the key (trust flags must be u,u,u)
261+
cat > expected << EOF
262+
Nickname: test-PKI-CLI-PKCS10
263+
Subject DN: CN=test-PKI-CLI-PKCS10
264+
Issuer DN: CN=CA Signing Certificate,OU=pki-tomcat,O=EXAMPLE
265+
Trust Flags: u,u,u
266+
EOF
267+
268+
diff expected actual
269+
270+
- name: Enroll cert using PKI CLI with CRMF request without POP
271+
run: |
272+
# generate CRMF request
273+
docker exec pki pki nss-cert-request \
274+
--type crmf \
275+
--subject "CN=test-PKI-CLI-CRMF-without-POP" \
276+
--csr test-PKI-CLI-CRMF-without-POP.csr
277+
278+
docker exec pki cat test-PKI-CLI-CRMF-without-POP.csr
279+
280+
docker exec pki AtoB test-PKI-CLI-CRMF-without-POP.csr test-PKI-CLI-CRMF-without-POP.der
281+
docker exec pki dumpasn1 test-PKI-CLI-CRMF-without-POP.der
282+
283+
# issue cert
284+
docker exec pki pki \
285+
-n caadmin \
286+
ca-cert-issue \
287+
--request-type crmf \
288+
--profile caTransportCert \
289+
--subject CN=test-PKI-CLI-CRMF-without-POP \
290+
--csr-file test-PKI-CLI-CRMF-without-POP.csr \
291+
--output-file test-PKI-CLI-CRMF-without-POP.crt
292+
293+
# import cert
294+
docker exec pki pki nss-cert-import \
295+
--cert test-PKI-CLI-CRMF-without-POP.crt \
296+
test-PKI-CLI-CRMF-without-POP
297+
298+
docker exec pki pki nss-cert-show test-PKI-CLI-CRMF-without-POP | tee output
299+
300+
# normalize output
301+
sed \
302+
-e '/^ *Serial Number:/d' \
303+
-e '/^ *Not Valid Before:/d' \
304+
-e '/^ *Not Valid After:/d' \
305+
output > actual
306+
307+
# the cert should match the key (trust flags must be u,u,u)
308+
cat > expected << EOF
309+
Nickname: test-PKI-CLI-CRMF-without-POP
310+
Subject DN: CN=test-PKI-CLI-CRMF-without-POP
311+
Issuer DN: CN=CA Signing Certificate,OU=pki-tomcat,O=EXAMPLE
312+
Trust Flags: u,u,u
313+
EOF
314+
315+
diff expected actual
316+
317+
- name: Enroll cert using PKI CLI with CRMF request with POP
318+
run: |
319+
# generate CRMF request
320+
docker exec pki pki nss-cert-request \
321+
--type crmf \
322+
--pop \
323+
--subject "CN=test-PKI-CLI-CRMF-with-POP" \
324+
--csr test-PKI-CLI-CRMF-with-POP.csr
325+
326+
docker exec pki cat test-PKI-CLI-CRMF-with-POP.csr
327+
328+
docker exec pki AtoB test-PKI-CLI-CRMF-with-POP.csr test-PKI-CLI-CRMF-with-POP.der
329+
docker exec pki dumpasn1 test-PKI-CLI-CRMF-with-POP.der
330+
331+
# issue cert
332+
docker exec pki pki \
333+
-n caadmin \
334+
ca-cert-issue \
335+
--request-type crmf \
336+
--profile caTransportCert \
337+
--subject CN=test-PKI-CLI-CRMF-with-POP \
338+
--csr-file test-PKI-CLI-CRMF-with-POP.csr \
339+
--output-file test-PKI-CLI-CRMF-with-POP.crt
340+
341+
# import cert
342+
docker exec pki pki nss-cert-import \
343+
--cert test-PKI-CLI-CRMF-with-POP.crt \
344+
test-PKI-CLI-CRMF-with-POP
345+
346+
docker exec pki pki nss-cert-show test-PKI-CLI-CRMF-with-POP | tee output
347+
348+
# normalize output
349+
sed \
350+
-e '/^ *Serial Number:/d' \
351+
-e '/^ *Not Valid Before:/d' \
352+
-e '/^ *Not Valid After:/d' \
353+
output > actual
354+
355+
# the cert should match the key (trust flags must be u,u,u)
356+
cat > expected << EOF
357+
Nickname: test-PKI-CLI-CRMF-with-POP
358+
Subject DN: CN=test-PKI-CLI-CRMF-with-POP
359+
Issuer DN: CN=CA Signing Certificate,OU=pki-tomcat,O=EXAMPLE
360+
Trust Flags: u,u,u
361+
EOF
362+
363+
diff expected actual
364+
365+
- name: Remove CA
366+
run: |
367+
docker exec pki pkidestroy -s CA -v
368+
369+
- name: Check for core dumps
370+
if: failure()
371+
run: |
372+
docker exec pki ls -l
373+
docker exec pki find / -path /proc -prune -o -name "hs_err_pid*.log" -exec cat {} \;
374+
375+
- name: Check PKI server systemd journal
376+
if: always()
377+
run: |
378+
docker exec pki journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service
379+
380+
- name: Check CA debug log
381+
if: always()
382+
run: |
383+
docker exec pki find /var/lib/pki/pki-tomcat/logs/ca -name "debug.*" -exec cat {} \;

‎.github/workflows/ca-profile-tests.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,11 @@ jobs:
2828
needs: build
2929
uses: ./.github/workflows/ca-profile-caStorageCert-test.yml
3030

31+
ca-profile-caTransportCert-test:
32+
name: CA with caTransportCert profile
33+
needs: build
34+
uses: ./.github/workflows/ca-profile-caTransportCert-test.yml
35+
3136
ca-profile-custom-test:
3237
name: CA with custom profile
3338
needs: build

0 commit comments

Comments
 (0)