Changeset f828974 in mod_gnutls

Timestamp:

Jul 15, 2019, 3:26:28 PM (9 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

master

Children:

7cfc02b

Parents:

c3aebe5

git-author:

Fiona Klute <fiona.klute@…> (07/15/19 15:21:17)

git-committer:

Fiona Klute <fiona.klute@…> (07/15/19 15:26:28)

Message:

Test suite: Build & use certificate chain for the authority/subca/server ID

Location:

test

Files:

• Makefile.am (modified) (1 diff)
• test_ca.mk (modified) (1 diff)
• tests/00_basic/apache.conf (modified) (1 diff)

test/Makefile.am

@@ -171 +171 @@
         echo "unique_subject = no" > $@
 
-# build certificate chain file for server
-check_DATA += authority/server/x509-chain.pem
-MOSTLYCLEANFILES += authority/server/x509-chain.pem
-%/x509-chain.pem: %/x509.pem authority/x509.pem
-        cat $< authority/x509.pem > $@
+# Build certificate chain files. Note that intermediate tokens must be
+# listed explicitly, or the dependency chain will be broken because
+# the higher level pattern matches, too.
+chain_tokens = authority/server/x509-chain.pem \
+        authority/subca/x509-chain.pem \
+        authority/subca/server/x509-chain.pem
+check_DATA += $(chain_tokens)
+MOSTLYCLEANFILES += $(chain_tokens)
 endif
 

test/test_ca.mk

@@ -58 +58 @@
 # special rule for root CAs
 root_cert_rule = certtool --outfile $@ --generate-self-signed --load-privkey $(dir $@)secret.key --template $<
+root_chain_rule = cp $< $@
 authority/x509.pem rogueca/x509.pem: %/x509.pem: %/template %/secret.key
         $(root_cert_rule)
+authority/x509-chain.pem rogueca/x509-chain.pem: %/x509-chain.pem: %/x509.pem
+        $(root_chain_rule)
 
 # generic rule for building non-root certificates, with the CA in the
 # parent directory
 cert_rule = certtool --outfile $@ --generate-certificate --load-ca-certificate $(dir $@)../x509.pem --load-ca-privkey $(dir $@)../secret.key --load-privkey $(dir $@)secret.key --template $<
+chain_rule = cat $< $(dir $@)../x509-chain.pem > $@
 
 # certificates signed by the test root CA
 %/x509.pem: %/template %/secret.key authority/secret.key authority/x509.pem
         $(cert_rule)
+%/x509-chain.pem: %/x509.pem authority/x509-chain.pem
+        $(chain_rule)
 
 # certificates signed by the test sub CA
 authority/subca/%/x509.pem: authority/subca/%/template authority/subca/%/secret.key authority/subca/x509.pem
         $(cert_rule)
+authority/subca/%/x509-chain.pem: authority/subca/%/x509.pem authority/subca/x509-chain.pem
+        $(chain_rule)
 
 # certificates signed by rogue CA (for error cases)

test/tests/00_basic/apache.conf

@@ -6 +6 @@
  ServerName ${TEST_HOST}
  GnuTLSEnable On
- GnuTLSCertificateFile  authority/server/x509.pem
- GnuTLSKeyFile          authority/server/secret.key
+ GnuTLSCertificateFile  authority/subca/server/x509-chain.pem
+ GnuTLSKeyFile          authority/subca/server/secret.key
 </VirtualHost>