Skip to content

Commit 3a3e325

Browse files
aarongableaarongable
authored
Give throwaway test certs reasonable validity intervals (#7128)
Add a new clock argument to the test-only ThrowAwayCert function, and use that clock to generate reasonable notBefore and notAfter timestamps in the resulting throwaway test cert. This is necessary to easily test functions which rely on the expiration timestamp of the certificate, such as upcoming work about computing CRL shards. Part of #7094
1 parent 5b3c84d commit 3a3e325

File tree

3 files changed

+30
-20
lines changed

3 files changed

+30
-20
lines changed

‎ra/ra_test.go‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -312,7 +312,7 @@ func initAuthorities(t *testing.T) (*DummyValidationAuthority, sapb.StorageAutho
312312

313313
fc := clock.NewFake()
314314
// Set to some non-zero time.
315-
fc.Set(time.Date(2015, 3, 4, 5, 0, 0, 0, time.UTC))
315+
fc.Set(time.Date(2020, 3, 4, 5, 0, 0, 0, time.UTC))
316316

317317
dbMap, err := sa.DBMapForTest(vars.DBConnSA)
318318
if err != nil {
@@ -1086,7 +1086,7 @@ func TestEarlyOrderRateLimiting(t *testing.T) {
10861086
test.AssertEquals(t, bErr.RetryAfter, rateLimitDuration)
10871087

10881088
// The err should be the expected rate limit error
1089-
expected := "too many certificates already issued for \"early-ratelimit-example.com\". Retry after 2015-03-04T05:05:00Z: see https://letsencrypt.org/docs/rate-limits/"
1089+
expected := "too many certificates already issued for \"early-ratelimit-example.com\". Retry after 2020-03-04T05:05:00Z: see https://letsencrypt.org/docs/rate-limits/"
10901090
test.AssertEquals(t, bErr.Error(), expected)
10911091
}
10921092

@@ -3850,7 +3850,7 @@ func TestRevokeCertByApplicant_Subscriber(t *testing.T) {
38503850
ra.OCSP = &mockOCSPA{}
38513851
ra.purger = &mockPurger{}
38523852

3853-
_, cert := test.ThrowAwayCert(t, 1)
3853+
_, cert := test.ThrowAwayCert(t, clk, 1)
38543854
ic, err := issuance.NewCertificate(cert)
38553855
test.AssertNotError(t, err, "failed to create issuer cert")
38563856
ra.issuersByNameID = map[issuance.IssuerNameID]*issuance.Certificate{
@@ -3904,7 +3904,7 @@ func TestRevokeCertByApplicant_Controller(t *testing.T) {
39043904
ra.OCSP = &mockOCSPA{}
39053905
ra.purger = &mockPurger{}
39063906

3907-
_, cert := test.ThrowAwayCert(t, 1)
3907+
_, cert := test.ThrowAwayCert(t, clk, 1)
39083908
ic, err := issuance.NewCertificate(cert)
39093909
test.AssertNotError(t, err, "failed to create issuer cert")
39103910
ra.issuersByNameID = map[issuance.IssuerNameID]*issuance.Certificate{
@@ -3948,7 +3948,11 @@ func TestRevokeCertByKey(t *testing.T) {
39483948
digest, err := core.KeyDigest(k.Public())
39493949
test.AssertNotError(t, err, "core.KeyDigest failed")
39503950

3951-
template := x509.Certificate{SerialNumber: big.NewInt(257)}
3951+
template := x509.Certificate{
3952+
SerialNumber: big.NewInt(257),
3953+
NotBefore: clk.Now(),
3954+
NotAfter: clk.Now().Add(6 * 24 * time.Hour),
3955+
}
39523956
der, err := x509.CreateCertificate(rand.Reader, &template, &template, k.Public(), k)
39533957
test.AssertNotError(t, err, "x509.CreateCertificate failed")
39543958
cert, err := x509.ParseCertificate(der)

‎sa/sa_test.go‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -322,11 +322,11 @@ func findIssuedName(ctx context.Context, dbMap db.OneSelector, name string) (str
322322
}
323323

324324
func TestAddSerial(t *testing.T) {
325-
sa, _, cleanUp := initSA(t)
325+
sa, clk, cleanUp := initSA(t)
326326
defer cleanUp()
327327

328328
reg := createWorkingRegistration(t, sa)
329-
serial, testCert := test.ThrowAwayCert(t, 1)
329+
serial, testCert := test.ThrowAwayCert(t, clk, 1)
330330

331331
_, err := sa.AddSerial(context.Background(), &sapb.AddSerialRequest{
332332
RegID: reg.Id,
@@ -378,7 +378,7 @@ func TestGetSerialMetadata(t *testing.T) {
378378
defer cleanUp()
379379

380380
reg := createWorkingRegistration(t, sa)
381-
serial, _ := test.ThrowAwayCert(t, 1)
381+
serial, _ := test.ThrowAwayCert(t, clk, 1)
382382

383383
_, err := sa.GetSerialMetadata(context.Background(), &sapb.Serial{Serial: serial})
384384
test.AssertError(t, err, "getting nonexistent serial should have failed")
@@ -415,7 +415,7 @@ func TestAddPrecertificate(t *testing.T) {
415415

416416
// Create a throw-away self signed certificate with a random name and
417417
// serial number
418-
serial, testCert := test.ThrowAwayCert(t, 1)
418+
serial, testCert := test.ThrowAwayCert(t, clk, 1)
419419

420420
// Add the cert as a precertificate
421421
regID := reg.Id
@@ -455,11 +455,11 @@ func TestAddPrecertificate(t *testing.T) {
455455
}
456456

457457
func TestAddPrecertificateNoOCSP(t *testing.T) {
458-
sa, _, cleanUp := initSA(t)
458+
sa, clk, cleanUp := initSA(t)
459459
defer cleanUp()
460460

461461
reg := createWorkingRegistration(t, sa)
462-
_, testCert := test.ThrowAwayCert(t, 1)
462+
_, testCert := test.ThrowAwayCert(t, clk, 1)
463463

464464
regID := reg.Id
465465
issuedTime := time.Date(2018, 4, 1, 7, 0, 0, 0, time.UTC)
@@ -479,8 +479,9 @@ func TestAddPreCertificateDuplicate(t *testing.T) {
479479

480480
reg := createWorkingRegistration(t, sa)
481481

482-
_, testCert := test.ThrowAwayCert(t, 1)
482+
_, testCert := test.ThrowAwayCert(t, clk, 1)
483483
issuedTime := clk.Now()
484+
484485
_, err := sa.AddPrecertificate(ctx, &sapb.AddCertificateRequest{
485486
Der: testCert.Raw,
486487
IssuedNS: issuedTime.UnixNano(),
@@ -501,14 +502,14 @@ func TestAddPreCertificateDuplicate(t *testing.T) {
501502
}
502503

503504
func TestAddPrecertificateIncomplete(t *testing.T) {
504-
sa, _, cleanUp := initSA(t)
505+
sa, clk, cleanUp := initSA(t)
505506
defer cleanUp()
506507

507508
reg := createWorkingRegistration(t, sa)
508509

509510
// Create a throw-away self signed certificate with a random name and
510511
// serial number
511-
_, testCert := test.ThrowAwayCert(t, 1)
512+
_, testCert := test.ThrowAwayCert(t, clk, 1)
512513

513514
// Add the cert as a precertificate
514515
regID := reg.Id
@@ -525,11 +526,11 @@ func TestAddPrecertificateIncomplete(t *testing.T) {
525526
}
526527

527528
func TestAddPrecertificateKeyHash(t *testing.T) {
528-
sa, _, cleanUp := initSA(t)
529+
sa, clk, cleanUp := initSA(t)
529530
defer cleanUp()
530531
reg := createWorkingRegistration(t, sa)
531532

532-
serial, testCert := test.ThrowAwayCert(t, 1)
533+
serial, testCert := test.ThrowAwayCert(t, clk, 1)
533534
_, err := sa.AddPrecertificate(ctx, &sapb.AddCertificateRequest{
534535
Der: testCert.Raw,
535536
RegID: reg.Id,
@@ -609,7 +610,7 @@ func TestAddCertificateDuplicate(t *testing.T) {
609610

610611
reg := createWorkingRegistration(t, sa)
611612

612-
_, testCert := test.ThrowAwayCert(t, 1)
613+
_, testCert := test.ThrowAwayCert(t, clk, 1)
613614

614615
issuedTime := clk.Now()
615616
_, err := sa.AddCertificate(ctx, &sapb.AddCertificateRequest{

‎test/certs.go‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ import (
1313
"math/big"
1414
"os"
1515
"testing"
16+
"time"
17+
18+
"github.com/jmhodges/clock"
1619
)
1720

1821
// LoadSigner loads a PEM private key specified by filename or returns an error.
@@ -62,12 +65,12 @@ func LoadSigner(filename string) (crypto.Signer, error) {
6265
// parsed certificate and the random serial in string form or aborts the test.
6366
// The certificate returned from this function is the bare minimum needed for
6467
// most tests and isn't a robust example of a complete end entity certificate.
65-
func ThrowAwayCert(t *testing.T, nameCount int) (string, *x509.Certificate) {
68+
func ThrowAwayCert(t *testing.T, clk clock.Clock, nameCount int) (string, *x509.Certificate) {
6669
var serialBytes [16]byte
6770
_, _ = rand.Read(serialBytes[:])
6871
sn := big.NewInt(0).SetBytes(serialBytes[:])
6972

70-
return ThrowAwayCertWithSerial(t, nameCount, sn, nil)
73+
return ThrowAwayCertWithSerial(t, clk, nameCount, sn, nil)
7174
}
7275

7376
// ThrowAwayCertWithSerial is a small test helper function that creates a
@@ -77,7 +80,7 @@ func ThrowAwayCert(t *testing.T, nameCount int) (string, *x509.Certificate) {
7780
// but will appear to be issued from issuer if provided.
7881
// The certificate returned from this function is the bare minimum needed for
7982
// most tests and isn't a robust example of a complete end entity certificate.
80-
func ThrowAwayCertWithSerial(t *testing.T, nameCount int, sn *big.Int, issuer *x509.Certificate) (string, *x509.Certificate) {
83+
func ThrowAwayCertWithSerial(t *testing.T, clk clock.Clock, nameCount int, sn *big.Int, issuer *x509.Certificate) (string, *x509.Certificate) {
8184
k, err := rsa.GenerateKey(rand.Reader, 512)
8285
AssertNotError(t, err, "rsa.GenerateKey failed")
8386

@@ -91,6 +94,8 @@ func ThrowAwayCertWithSerial(t *testing.T, nameCount int, sn *big.Int, issuer *x
9194
template := &x509.Certificate{
9295
SerialNumber: sn,
9396
DNSNames: names,
97+
NotBefore: clk.Now(),
98+
NotAfter: clk.Now().Add(6 * 24 * time.Hour),
9499
IssuingCertificateURL: []string{"http://localhost:4001/acme/issuer-cert/1234"},
95100
}
96101

0 commit comments

Comments
 (0)