Skip to content

Commit c5566fc

Browse files
fmarco76fmarco76
committed
Add CI test for multiple server certificates
1 parent e36794e commit c5566fc

2 files changed

Lines changed: 182 additions & 0 deletions

File tree

‎.github/workflows/tomcat-https-multi-certificate-test.yml‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
name: Tomcat HTTPS with multiple certificates
2+
3+
on: workflow_call
4+
5+
env:
6+
NAMESPACE: ${{ vars.REGISTRY_NAMESPACE || 'dogtagpki' }}
7+
8+
jobs:
9+
test:
10+
name: Test
11+
runs-on: ubuntu-latest
12+
env:
13+
SHARED: /tmp/workdir/pki
14+
steps:
15+
- name: Install dependencies
16+
run: |
17+
sudo apt-get update
18+
sudo apt-get -y install xmlstarlet
19+
20+
- name: Clone repository
21+
uses: actions/checkout@v4
22+
23+
- name: Retrieve JSS images
24+
uses: actions/cache@v4
25+
with:
26+
key: jss-images-${{ github.sha }}
27+
path: jss-images.tar
28+
29+
- name: Load JSS images
30+
run: docker load --input jss-images.tar
31+
32+
- name: Create network
33+
run: docker network create example
34+
35+
- name: Set up JSS container
36+
run: |
37+
tests/bin/runner-init.sh \
38+
--hostname=server.example.com \
39+
--network=example \
40+
--network-alias=server.example.com \
41+
server
42+
43+
- name: Import LDAP SDK packages
44+
run: |
45+
docker create --name=ldapjdk-dist quay.io/$NAMESPACE/ldapjdk-dist:latest
46+
docker cp ldapjdk-dist:/root/RPMS/. /tmp/RPMS/
47+
docker rm -f ldapjdk-dist
48+
49+
- name: Import PKI packages
50+
run: |
51+
docker create --name=pki-dist quay.io/$NAMESPACE/pki-dist:latest
52+
docker cp pki-dist:/root/RPMS/. /tmp/RPMS/
53+
docker rm -f pki-dist
54+
55+
- name: Install packages
56+
run: |
57+
docker cp /tmp/RPMS/. server:/root/RPMS/
58+
docker exec server bash -c "dnf install -y /root/RPMS/*"
59+
60+
- name: Create Tomcat
61+
run: |
62+
docker exec server pki-server create -v
63+
64+
- name: Create NSS database in Tomcat
65+
run: |
66+
docker exec server pki-server nss-create --no-password
67+
68+
- name: Create RSA SSL server cert
69+
run: |
70+
docker exec server pki \
71+
-d /var/lib/pki/pki-tomcat/alias \
72+
nss-cert-request \
73+
--subject "CN=server.example.com" \
74+
--ext /usr/share/pki/server/certs/sslserver.conf \
75+
--csr sslserver-RSA.csr
76+
77+
docker exec server pki \
78+
-d /var/lib/pki/pki-tomcat/alias \
79+
nss-cert-issue \
80+
--csr sslserver-RSA.csr \
81+
--ext /usr/share/pki/server/certs/sslserver.conf \
82+
--cert sslserver-RSA.crt
83+
84+
docker exec server pki \
85+
-d /var/lib/pki/pki-tomcat/alias \
86+
nss-cert-import \
87+
--cert sslserver-RSA.crt \
88+
sslserver-RSA
89+
90+
- name: Create EC SSL server cert
91+
run: |
92+
docker exec server pki \
93+
-d /var/lib/pki/pki-tomcat/alias \
94+
nss-cert-request \
95+
--key-type EC \
96+
--subject "CN=server.example.com" \
97+
--ext /usr/share/pki/server/certs/sslserver.conf \
98+
--csr sslserver-EC.csr
99+
100+
docker exec server pki \
101+
-d /var/lib/pki/pki-tomcat/alias \
102+
nss-cert-issue \
103+
--csr sslserver-EC.csr \
104+
--ext /usr/share/pki/server/certs/sslserver.conf \
105+
--cert sslserver-EC.crt
106+
107+
docker exec server pki \
108+
-d /var/lib/pki/pki-tomcat/alias \
109+
nss-cert-import \
110+
--cert sslserver-EC.crt \
111+
sslserver-EC
112+
113+
- name: Create HTTPS connector
114+
run: |
115+
docker exec server pki-server jss-enable
116+
117+
docker exec server pki-server http-connector-add \
118+
--port 8443 \
119+
--scheme https \
120+
--secure true \
121+
--sslEnabled true \
122+
--sslProtocol SSL \
123+
--sslImpl org.dogtagpki.jss.tomcat.JSSImplementation \
124+
Secure
125+
126+
- name: Add HTTPS connector certificates
127+
run: |
128+
docker exec server pki-server http-connector-cert-add \
129+
--keyAlias sslserver-EC \
130+
--keystoreType pkcs11 \
131+
--keystoreProvider Mozilla-JSS \
132+
EC
133+
134+
docker exec server pki-server http-connector-cert-add \
135+
--keyAlias sslserver-RSA \
136+
--keystoreType pkcs11 \
137+
--keystoreProvider Mozilla-JSS \
138+
RSA
139+
140+
docker exec server cat /etc/pki/pki-tomcat/server.xml
141+
142+
- name: Start Tomcat
143+
run: |
144+
docker exec server pki-server start --wait -v
145+
146+
- name: Check connection using RSA certificate
147+
run: |
148+
echo "Hello" | \
149+
docker exec server openssl s_client -sigalgs 'RSA-PSS+SHA256' \
150+
server.example.com:8443 | tee output
151+
152+
echo " a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256" > expected
153+
grep "a:PKEY" output > actual
154+
diff expected actual
155+
156+
- name: Check connection using EC certificate
157+
run: |
158+
echo "Hello" | \
159+
docker exec server openssl s_client -sigalgs 'ECDSA+SHA256' \
160+
server.example.com:8443 | tee output
161+
162+
echo " a:PKEY: id-ecPublicKey, 256 (bit); sigalg: ecdsa-with-SHA256" > expected
163+
grep "a:PKEY" output > actual
164+
diff expected actual
165+
166+
- name: Stop Tomcat
167+
run: |
168+
docker exec server pki-server stop --wait -v
169+
170+
- name: Remove Tomcat
171+
run: |
172+
docker exec server pki-server remove -v
173+
174+
- name: Check PKI server systemd journal
175+
if: always()
176+
run: |
177+
docker exec server journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

‎.github/workflows/tomcat-tests.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,3 +44,8 @@ jobs:
4444
name: Tomcat HTTPS with specific ciphers
4545
needs: build
4646
uses: ./.github/workflows/tomcat-https-ciphers-test.yml
47+
48+
tomcat-https-multi-certificate-test:
49+
name: Tomcat HTTPS with multiple certificates
50+
needs: build
51+
uses: ./.github/workflows/tomcat-https-multi-certificate-test.yml

0 commit comments

Comments
 (0)