cloudflare / cloudflare/cfssl

Tests failure due to outdated certificates

Open
#1,200 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
9.5k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

While running test in `signer/remote`, the tests fail with:

```
2021/08/01 19:10:17 [INFO] 127.0.0.1:38086 - "POST /api/v1/cfssl/info" 200
2021/08/01 19:10:17 http: TLS handshake error from 127.0.0.1:59762: remote error: tls: bad certificate
--- FAIL: TestRemoteTLSInfo (0.00s)
remote_test.go:312: https://127.0.0.1:43659
remote_test.go:115: remote is: https://127.0.0.1:43659
remote_test.go:129: remote info failed: {"code":7400,"message":"failed POST to https://127.0.0.1:43659/api/v1/cfssl/info: Post \"https://127.0.0.1:43659/api/v1/cfssl/info\": x509: certificate has expired or is not yet valid: current time 2021-08-01T19:10:17+02:00 is after 2021-05-19T22:39:00Z"}
remote_test.go:317: Finalizing test server.
2021/08/01 19:10:17 http: TLS handshake error from 127.0.0.1:37096: remote error: tls: bad certificate
--- FAIL: TestRemoteMutualTLSInfo (0.01s)
remote_test.go:312: https://127.0.0.1:38167
remote_test.go:115: remote is: https://127.0.0.1:38167
remote_test.go:129: remote info failed: {"code":7400,"message":"failed POST to https://127.0.0.1:38167/api/v1/cfssl/info: Post \"https://127.0.0.1:38167/api/v1/cfssl/info\": x509: certificate has expired or is not yet valid: current time 2021-08-01T19:10:17+02:00 is after 2021-05-19T22:39:00Z"}
remote_test.go:317: Finalizing test server.
2021/08/01 19:10:17 [INFO] signature request received
2021/08/01 19:10:17 [INFO] signed certificate with serial number 458879
2021/08/01 19:10:17 [INFO] wrote response
2021/08/01 19:10:17 [INFO] 127.0.0.1:56288 - "POST /api/v1/cfssl/sign" 200
2021/08/01 19:10:17 [INFO] signature request received
2021/08/01 19:10:17 [INFO] signed certificate with serial number 458879
2021/08/01 19:10:17 [INFO] wrote response
2021/08/01 19:10:17 [INFO] 127.0.0.1:56290 - "POST /api/v1/cfssl/sign" 200
2021/08/01 19:10:17 [INFO] signature request received
2021/08/01 19:10:17 [INFO] signed certificate with serial number 458879
2021/08/01 19:10:17 [INFO] wrote response
2021/08/01 19:10:17 [INFO] 127.0.0.1:56292 - "POST /api/v1/cfssl/sign" 200
2021/08/01 19:10:17 [INFO] signature request received
2021/08/01 19:10:17 [INFO] signed certificate with serial number 458879
2021/08/01 19:10:17 [INFO] wrote response
2021/08/01 19:10:17 [INFO] 127.0.0.1:56294 - "POST /api/v1/cfssl/sign" 200
2021/08/01 19:10:17 [INFO] signature request received
2021/08/01 19:10:17 [INFO] signed certificate with serial number 458879
2021/08/01 19:10:17 [INFO] wrote response
2021/08/01 19:10:17 [INFO] 127.0.0.1:56296 - "POST /api/v1/cfssl/sign" 200
2021/08/01 19:10:17 [INFO] signature request received
2021/08/01 19:10:17 [INFO] signed certificate with serial number 458879
2021/08/01 19:10:17 [INFO] wrote response
2021/08/01 19:10:17 [INFO] 127.0.0.1:56298 - "POST /api/v1/cfssl/sign" 200
2021/08/01 19:10:17 http: TLS handshake error from 127.0.0.1:42976: remote error: tls: bad certificate
--- FAIL: TestRemoteTLSSign (0.00s)
remote_test.go:306: https://127.0.0.1:41327
remote_test.go:202: Expected no error. Got {"code":7400,"message":"failed POST to https://127.0.0.1:41327/api/v1/cfssl/sign: Post \"https://127.0.0.1:41327/api/v1/cfssl/sign\": x509: certificate has expired or is not yet valid: current time 2021-08-01T19:10:17+02:00 is after 2021-05-19T22:39:00Z"}. Param rsa 2048
remote_test.go:317: Finalizing test server.
2021/08/01 19:10:17 http: TLS handshake error from 127.0.0.1:55042: remote error: tls: bad certificate
--- FAIL: TestRemoteMutualTLSSign (0.01s)
remote_test.go:306: https://127.0.0.1:34553
remote_test.go:202: Expected no error. Got {"code":7400,"message":"failed POST to https://127.0.0.1:34553/api/v1/cfssl/sign: Post \"https://127.0.0.1:34553/api/v1/cfssl/sign\": x509: certificate has expired or is not yet valid: current time 2021-08-01T19:10:17+02:00 is after 2021-05-19T22:39:00Z"}. Param rsa 2048
remote_test.go:317: Finalizing test server.
2021/08/01 19:10:17 [INFO] signature request received
2021/08/01 19:10:17 [INFO] signed certificate with serial number 1
2021/08/01 19:10:17 [INFO] wrote response
2021/08/01 19:10:17 [INFO] 127.0.0.1:52642 - "POST /api/v1/cfssl/sign" 200
FAIL
exit status 1
FAIL github.com/cloudflare/cfssl/signer/remote 0.108s
```

Contributor guide

Open the contributing guide

Research direction

Start in signer/remote/remote_test.go and run the signer/remote tests to reproduce the expired-certificate failures. Update the test certificate data identified while tracing those failures, then confirm the remote TLS and mutual-TLS tests pass with currently valid certificates.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security, testing-qa
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.