diff options
| author | Jeremy Harris <jgh146exb@wizmail.org> | 2022-11-24 18:05:44 +0000 |
|---|---|---|
| committer | Jeremy Harris <jgh146exb@wizmail.org> | 2022-11-24 18:23:35 +0000 |
| commit | b577156a5877f5cbe0ac263219fb6d686aaf620c (patch) | |
| tree | 7ff64a3a2b9e9ad7b1407a0bfb67a17622328697 | |
| parent | 415c5379af11bf8777af1a082a336ad7c5369525 (diff) | |
Testsuite: avoid generating leaf certs expiring after signer expiry
| -rwxr-xr-x | test/aux-fixed/exim-ca/README.regenerate | 6 | ||||
| -rwxr-xr-x | test/aux-fixed/exim-ca/genall | 20 |
2 files changed, 18 insertions, 8 deletions
diff --git a/test/aux-fixed/exim-ca/README.regenerate b/test/aux-fixed/exim-ca/README.regenerate index d87512cfb..f31a5f6f0 100755 --- a/test/aux-fixed/exim-ca/README.regenerate +++ b/test/aux-fixed/exim-ca/README.regenerate @@ -5,6 +5,8 @@ and dnszones-src/db.example.com (the commands are next to each one). The script "tlsa_regenerate" automates this. Also, because of the certs changes, the following testcase outputs will change: -2102 -5720 +2002 (GnuTLS) +2102 (OpenSSL) +5710 (GnuTLS) +5720 (OpenSSL) 5800 diff --git a/test/aux-fixed/exim-ca/genall b/test/aux-fixed/exim-ca/genall index 878c6aba0..25e46c7cf 100755 --- a/test/aux-fixed/exim-ca/genall +++ b/test/aux-fixed/exim-ca/genall @@ -15,6 +15,14 @@ echo use - date -u 110112342019 echo hit return when ready read junk +# Calc number of months from then to (about) Nov 2037. +# We're sticking to a 2038 cutoff for now, to maintain support for 32b systems, +# but will have to give that up in only a few years. +# +tgt_secs=`date -d 'Nov 25 2037' +%s` +now_secs=`date +%s` +diff_months=$(( ($tgt_secs - $now_secs) / 60 / 60 / 24 / 31 )) + # Main suite: RSA certs for tld in com org net do @@ -41,14 +49,14 @@ do # create server leaf certs # -m <months> - clica $V -D $idir -p password -s 101 -S server1.$iname -m 301 \ + clica $V -D $idir -p password -s 101 -S server1.$iname -m $diff_months \ -8 alternatename.server1.example.$tld,alternatename2.server1.example.$tld,*.test.ex - clica $V -D $idir -p password -s 102 -S revoked1.$iname -m 301 + clica $V -D $idir -p password -s 102 -S revoked1.$iname -m $diff_months clica $V -D $idir -p password -s 103 -S expired1.$iname -m 1 - clica $V -D $idir -p password -s 201 -S server2.$iname -m 301 \ + clica $V -D $idir -p password -s 201 -S server2.$iname -m $diff_months \ -3 "CN=clica CA rsa,O=example.$tld" -8 '*.test.ex' - clica $V -D $idir -p password -s 202 -S revoked2.$iname -m 301 + clica $V -D $idir -p password -s 202 -S revoked2.$iname -m $diff_months clica $V -D $idir -p password -s 203 -S expired2.$iname -m 1 #### @@ -195,7 +203,7 @@ done # Create one EC leaf cert in the RSA cert tree. It will have an EC pubkey but be signed using its parent # therefore its parent's algo, RSA. -clica $V -D example.com -p password -k ec -q nistp521 -s 1101 -S server1_ec.example.com -m 301 -8 'server1.example.com,*.test.ex' +clica $V -D example.com -p password -k ec -q nistp521 -s 1101 -S server1_ec.example.com -m $diff_months -8 'server1.example.com,*.test.ex' SDIR=example.com/server1_ec.example.com SPFX=$SDIR/server1_ec.example.com openssl ec -in $SPFX.key -passin file:$SDIR/pwdfile -out $SPFX.unlocked.key @@ -225,7 +233,7 @@ do # create server certs # -m <months> - clica $V -D $idir -p password -s 2101 -S server1.$iname -m 301 \ + clica $V -D $idir -p password -s 2101 -S server1.$iname -m $diff_months \ -k ec -q nistp521 \ -8 server1.example.$tld,alternatename.server1.example.$tld,alternatename2.server1.example.$tld,*.test.ex |