William Lallemand | 9c1aa0a | 2019-12-19 11:25:19 +0100 | [diff] [blame^] | 1 | #REGTEST_TYPE=slow |
| 2 | |
| 3 | # This reg-test uses the "set ssl cert" command to update a certificate over the CLI. |
| 4 | # It requires socat and curl to upload and validate that the certificate was well updated |
| 5 | |
| 6 | # If this test does not work anymore: |
| 7 | # - Check that you have socat and curl |
| 8 | # - Check that the curl -v option still return the SSL CN |
| 9 | |
| 10 | varnishtest "Test the 'set ssl cert' feature of the CLI" |
| 11 | #REQUIRE_OPTIONS=OPENSSL |
| 12 | feature ignore_unknown_macro |
| 13 | |
| 14 | |
| 15 | haproxy h1 -conf { |
| 16 | global |
| 17 | tune.ssl.default-dh-param 2048 |
| 18 | tune.ssl.capture-cipherlist-size 1 |
| 19 | stats socket "${tmpdir}/h1/stats" level admin |
| 20 | |
| 21 | listen frt |
| 22 | mode http |
| 23 | ${no-htx} option http-use-htx |
| 24 | bind "fd@${frt}" ssl crt ${testdir}/common.pem |
| 25 | http-request redirect location / |
| 26 | } -start |
| 27 | |
| 28 | |
| 29 | haproxy h1 -cli { |
| 30 | send "show ssl cert ${testdir}/common.pem" |
| 31 | expect ~ ".*SHA1 FingerPrint: 2195C9F0FD58470313013FC27C1B9CF9864BD1C6" |
| 32 | } |
| 33 | |
| 34 | shell { |
| 35 | HOST=${h1_frt_addr} |
| 36 | if [ "${h1_frt_addr}" = "::1" ] ; then |
| 37 | HOST="\[::1\]" |
| 38 | fi |
| 39 | curl -v -i -k https://$HOST:${h1_frt_port} 2>&1 | grep CN=www.test1.com |
| 40 | } |
| 41 | |
| 42 | shell { |
| 43 | echo -e "set ssl cert ${testdir}/common.pem <<\n$(cat ${testdir}/ecdsa.pem)\n" | socat "${tmpdir}/h1/stats" - |
| 44 | echo "commit ssl cert ${testdir}/common.pem" | socat "${tmpdir}/h1/stats" - |
| 45 | } |
| 46 | |
| 47 | haproxy h1 -cli { |
| 48 | send "show ssl cert ${testdir}/common.pem" |
| 49 | expect ~ ".*SHA1 FingerPrint: A490D069DBAFBEE66DE434BEC34030ADE8BCCBF1" |
| 50 | } |
| 51 | |
| 52 | shell { |
| 53 | HOST=${h1_frt_addr} |
| 54 | if [ "${h1_frt_addr}" = "::1" ] ; then |
| 55 | HOST="\[::1\]" |
| 56 | fi |
| 57 | curl -v -i -k https://$HOST:${h1_frt_port} 2>&1 | grep CN=localhost |
| 58 | } |