Generate more certs/identities, and use them for better multi-cert test coverage #10747

sam-github · 2017-01-11T22:43:42Z

test: cover tls multi-identity option mixtures
test: confirm tls server suite default is its own
test: add independent multi-alg crypto identities
test: rename agent1-pfx.pem to agent1.pfx

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
tests and/or benchmarks are included
commit message follows commit guidelines

Affected core subsystem(s)

tls

sam-github · 2017-01-11T22:49:09Z

Will rebase onto #10389 once it lands.

sam-github · 2017-01-12T20:02:22Z

Rebased onto #10771 so that tests can pass. Will rebase again once #10771 merges.

sam-github · 2017-01-12T20:10:39Z

@nodejs/crypto

sam-github · 2017-01-19T20:13:31Z

@shigeki @indutny @nodejs/crypto

bnoordhuis

Are ca3, ca4 and ca6 used anywhere?

bnoordhuis · 2017-01-20T12:21:45Z

test/fixtures/keys/Makefile

+	cat ca4-cert.pem >> agent8-cert.pem
+
+agent8-verify: agent8-cert.pem ca4-cert.pem
+	openssl verify -CAfile ca4-cert.pem agent8-cert.pem


Target should be .PHONY.

bnoordhuis · 2017-01-20T12:23:36Z

test/fixtures/keys/Makefile

+		-inkey ec8-key.pem \
+		-certfile ca6-cert.pem \
+		-out ec8.pfx \
+		-password pass:sample


You could make the recipes a little more DRY by using $@, $< and $^ more.

test/fixtures/keys/ca4.cnf

test/fixtures/keys/ca5.cnf

test/fixtures/keys/ca6.cnf

bnoordhuis · 2017-01-20T12:27:25Z

test/parallel/test-tls-honorcipherorder.js

-      if (cb) cb();
-    });
-  });
+      const msg = fmt(


Can you use util.format here? Saves the casual reader from having to look up what fmt() is.

bnoordhuis · 2017-01-20T12:28:01Z

test/parallel/test-tls-honorcipherorder.js

-    ciphers: 'AES256-SHA256:AES128-GCM-SHA256:AES128-SHA256:' +
+    ciphers: 'AES256-SHA256:' +
+             'AES128-GCM-SHA256:' +
+             'AES128-SHA256:' +


Stylistic change.

silverwind · 2017-02-14T17:02:54Z

Are there any matching cert + intermediate + key files in here? Asking so I can test #7230 (comment).

sam-github · 2017-02-14T17:07:51Z

@silverwind 5c700f9

sam-github · 2017-02-14T17:10:23Z

@silverwind bf43a60a383fa5fce1051532c4e499c4b1df4c07 has the tests you are looking for, I believe, but this PR is partially broken at the moment, I am in process of rebasing (master had an agent8 and agent9 added to it, so I need to move my numbered certs forward, which I'm in process of doing right now).

silverwind · 2017-02-14T17:23:31Z

Hmm, can't find a fitting case there, but this should be a failing example:

cert: [agent10-cert, ca4-cert]
key: agent10-key

sam-github · 2017-02-14T17:54:43Z

@silverwind

I think I see what is happening, you are trying to provide the certs a+b+c of a cert chain as cert: [a, b, c]. This is invalid usage, not documented, and doesn't surprise me it doesn't work (though honestly, it wouldn't surprise me if it had worked, either, ossl is a bit weird). Also, I think you haven't noticed that the PEM files built by the Makefile are chains (they have multiple certs in the single PEM file if there are intermediates).

Pre-existing test with pre-existing agent6 cert:

https://github.com/sam-github/node/blob/d125ee843b015ec9751562945426f620021ba19c/test/parallel/test-tls-multi-key.js#L80-L97

This PR adds tests for mixed algorithm identies, where the mixed algs have intermediate certs:

node/test/parallel/test-tls-cert-chains-concat.js

Lines 18 to 21 in ac602a2

    
           server: { 
        
             cert: keys.agent6.cert, 
        
             key: keys.agent6.key, 
        
           },

Your example:

cert: [agent10-cert, ca4-cert]
key: agent10-key

is invalid usage. agent10-cert.pem is a CHAIN, it already contains ca4-cert.pem, as did the pre-existing cert that had an intermediate cert, agent6:

Docs say:

Optional cert chains in PEM format. One cert chain should be provided per private key. Each cert chain should consist of the PEM formatted certificate for a provided private key, followed by the PEM formatted intermediate certificates (if any), in order, and not including the root CA (the root CA must be pre-known to the peer, see ca).

Your example above has two identities, one is agent10+ca4, and the other is just ca4. This is weird, because ca4 is a sub-chain of the first identity, and also, because they are both RSA, and OpenSSL doesn't permit multiple identities of the same algorithm, because it doesn't know which one to pick (unless you use SNI callback, when it picks by the server name).

silverwind · 2017-02-14T18:09:19Z

Sorry, for agent10-cert I actually meant just the first cert, not the whole chain in that file. Let's call the individual certs agent10-cert and agent10-int to avoid confusion.

So the interesting part is that it works if I concatenate agent10-cert and agent10-int into a single file, but not if I provide them individually in the form [agent10-cert, agent10-int]. I think this should be fixable.

sam-github · 2017-02-14T18:39:01Z

So the interesting part is that it works if I concatenate agent10-cert and agent10-int into a single file, but not if I provide them individually in the form [agent10-cert, agent10-int]. I think this should be fixable.

Exactly. That is the documented behaviour, so lets not hijack this PR to discuss it further, now that we agree what is happening. Open another issue if you think there is a problem and we can discuss there.

shigeki · 2017-02-23T15:15:15Z

One thing I would note is that it would be extremely helpful to have some documentation around these to help folks understand how and where to use the keys, how and where they are already used, etc.

I agree. I also would like to change file names and cert attributes to see its use and purpose for ease.

sam-github · 2017-03-06T23:06:23Z

@shigeki PTAL

sam-github · 2017-04-03T16:37:05Z

@shigeki any more comments I can address?

sam-github · 2017-05-24T18:28:09Z

@shigeki ping

sam-github · 2017-06-14T16:04:48Z

@shigeki I have responded to all comments, how can I move this forward?

addressed comments, no replies to request for more comments

sam-github · 2017-07-21T16:52:48Z

ci: https://ci.nodejs.org/job/node-test-pull-request/9285/

BridgeAR · 2017-08-26T07:17:45Z

@sam-github would you be so kind and rebase? I guess it is otherwise ready?

BridgeAR · 2017-09-08T01:50:10Z

New CI https://ci.nodejs.org/job/node-test-pull-request/9990/

BridgeAR · 2017-09-08T01:50:58Z

@mhdawson @bnoordhuis would you be so kind and reconfirm your LG?

mhdawson

LGTM

BridgeAR · 2017-09-09T19:42:24Z

@sam-github the CI is dark red. Seems like some tests need some additional work.

PFX is not PEM, its binary DER. Use the same .pfx extension as test/fixtures/test_cert.pfx does.

agent6 was the only cert that had a chain (an intermediate certificate), and there were no non-RSA certs other than a single self-signed one. This makes it impossible to test cert-chain scenarios with multiple identities which require chains to prove chain completion, and multi-algorithm because OpenSSL doesn't support multiple identities unless they are multi-algorithm. PFX files were also missing for most identities, making it difficult to test multi-PFX and PFX interactions with cert-chain+key and CA options. New server cert chains: - ECC: ca5 signs ca6 signs ec10, CN=agent10.example.com - RSA: ca2 signs ca4 signs agent10, CN=agent10.example.com PFX added for: - agent6 - agent10 - ec10

Prove that cert and key options do not have to be ordered, and that the pfx option can be used at the same time as the cert/key option (which was claimed to be impossible by some pre-existing documentation).

When honorCipherOrder is not explicitly set, it defaults to true, cover this condition in the test. Also, run all tests in parallel, instead of sequentially.

nodejs-github-bot added test Issues and PRs related to the tests. dont-land-on-v7.x labels Jan 11, 2017

sam-github force-pushed the generate-more-certs branch from 22660fb to 616ba33 Compare January 11, 2017 22:48

nodejs-github-bot added the dont-land-on-v7.x label Jan 11, 2017

mscdex added tls Issues and PRs related to the tls subsystem. and removed dont-land-on-v7.x labels Jan 11, 2017

sam-github force-pushed the generate-more-certs branch from 616ba33 to 9358f42 Compare January 12, 2017 19:16

nodejs-github-bot added the dont-land-on-v7.x label Jan 12, 2017

sam-github force-pushed the generate-more-certs branch from 9358f42 to 750bb7b Compare January 12, 2017 20:02

nodejs-github-bot added the dont-land-on-v7.x label Jan 12, 2017

sam-github force-pushed the generate-more-certs branch from 750bb7b to 9f585b4 Compare January 13, 2017 19:46

nodejs-github-bot added the dont-land-on-v7.x label Jan 13, 2017

bnoordhuis requested changes Jan 20, 2017

View reviewed changes

targos removed the dont-land-on-v7.x label Jan 28, 2017

sam-github mentioned this pull request Feb 13, 2017

doc: clarify tls.createServer's {cert, ca} #7230

Closed

2 tasks

sam-github force-pushed the generate-more-certs branch from ea714d5 to fefefcb Compare February 14, 2017 17:00

sam-github force-pushed the generate-more-certs branch from fefefcb to b979858 Compare February 14, 2017 17:15

sam-github force-pushed the generate-more-certs branch from b979858 to d125ee8 Compare February 14, 2017 17:28

sam-github force-pushed the generate-more-certs branch from 8165817 to 01da330 Compare February 14, 2017 18:56

sam-github force-pushed the generate-more-certs branch 3 times, most recently from e089bd0 to 3ed5993 Compare March 6, 2017 23:04

sam-github force-pushed the generate-more-certs branch from 3ed5993 to bb8c327 Compare March 20, 2017 15:42

refack force-pushed the master branch from 16073c0 to fbe946b Compare April 14, 2017 04:11

sam-github force-pushed the generate-more-certs branch from bb8c327 to 912d645 Compare April 17, 2017 20:27

sam-github force-pushed the generate-more-certs branch from 912d645 to 2089d22 Compare June 14, 2017 16:03

sam-github force-pushed the generate-more-certs branch from 2089d22 to 9f90b7b Compare July 21, 2017 16:51

sam-github force-pushed the generate-more-certs branch from 9f90b7b to e1e40ad Compare September 7, 2017 20:58

sam-github mentioned this pull request Sep 7, 2017

seems to not account for when a review has been dismissed nodejs/node-review#14

Closed

mhdawson approved these changes Sep 8, 2017

View reviewed changes

sam-github added 4 commits September 11, 2017 10:51

test: rename agent1-pfx.pem to agent1.pfx

89d57b4

PFX is not PEM, its binary DER. Use the same .pfx extension as test/fixtures/test_cert.pfx does.

test: cover tls multi-identity option mixtures

c4d269f

Prove that cert and key options do not have to be ordered, and that the pfx option can be used at the same time as the cert/key option (which was claimed to be impossible by some pre-existing documentation).

test: confirm tls server suite default is its own

64d61e9

When honorCipherOrder is not explicitly set, it defaults to true, cover this condition in the test. Also, run all tests in parallel, instead of sequentially.

sam-github force-pushed the generate-more-certs branch from e1e40ad to 64d61e9 Compare September 11, 2017 17:51

sam-github closed this Sep 19, 2017

This was referenced Nov 14, 2018

TLS certificate object documentation and support for EC certificates #24358

Closed

generate more certs, and more test coverage using them #24374

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Generate more certs/identities, and use them for better multi-cert test coverage #10747

Generate more certs/identities, and use them for better multi-cert test coverage #10747

sam-github commented Jan 11, 2017

sam-github commented Jan 11, 2017

sam-github commented Jan 12, 2017

sam-github commented Jan 12, 2017

sam-github commented Jan 19, 2017 •

edited

Loading

bnoordhuis left a comment

bnoordhuis Jan 20, 2017

bnoordhuis Jan 20, 2017

bnoordhuis Jan 20, 2017

bnoordhuis Jan 20, 2017

silverwind commented Feb 14, 2017

sam-github commented Feb 14, 2017

sam-github commented Feb 14, 2017

silverwind commented Feb 14, 2017 •

edited

Loading

sam-github commented Feb 14, 2017

silverwind commented Feb 14, 2017

sam-github commented Feb 14, 2017

shigeki commented Feb 23, 2017

sam-github commented Mar 6, 2017

sam-github commented Apr 3, 2017

sam-github commented May 24, 2017

sam-github commented Jun 14, 2017

sam-github commented Jul 21, 2017

BridgeAR commented Aug 26, 2017

BridgeAR commented Sep 8, 2017

BridgeAR commented Sep 8, 2017

mhdawson left a comment

BridgeAR commented Sep 9, 2017

Generate more certs/identities, and use them for better multi-cert test coverage #10747

Generate more certs/identities, and use them for better multi-cert test coverage #10747

Conversation

sam-github commented Jan 11, 2017

Checklist

Affected core subsystem(s)

sam-github commented Jan 11, 2017

sam-github commented Jan 12, 2017

sam-github commented Jan 12, 2017

sam-github commented Jan 19, 2017 • edited Loading

bnoordhuis left a comment

Choose a reason for hiding this comment

bnoordhuis Jan 20, 2017

Choose a reason for hiding this comment

bnoordhuis Jan 20, 2017

Choose a reason for hiding this comment

bnoordhuis Jan 20, 2017

Choose a reason for hiding this comment

bnoordhuis Jan 20, 2017

Choose a reason for hiding this comment

silverwind commented Feb 14, 2017

sam-github commented Feb 14, 2017

sam-github commented Feb 14, 2017

silverwind commented Feb 14, 2017 • edited Loading

sam-github commented Feb 14, 2017

silverwind commented Feb 14, 2017

sam-github commented Feb 14, 2017

shigeki commented Feb 23, 2017

sam-github commented Mar 6, 2017

sam-github commented Apr 3, 2017

sam-github commented May 24, 2017

sam-github commented Jun 14, 2017

sam-github commented Jul 21, 2017

BridgeAR commented Aug 26, 2017

BridgeAR commented Sep 8, 2017

BridgeAR commented Sep 8, 2017

mhdawson left a comment

Choose a reason for hiding this comment

BridgeAR commented Sep 9, 2017

sam-github commented Jan 19, 2017 •

edited

Loading

silverwind commented Feb 14, 2017 •

edited

Loading