| import os |
| import re |
| import time |
| |
| import pytest |
| |
| from .md_conf import MDConf |
| |
| # set the environment variables |
| # SECTIGO_EAB="$kid $hmac" for |
| # SECTIGO_TLD="<your registered dns name>" |
| # these tests to become active |
| # |
| |
| DEMO_ACME = "https://acme.demo.sectigo.com/" |
| DEMO_TLD = None |
| |
| EABS = [ |
| {'kid': '0123', 'hmac': 'abcdef'}, |
| ] |
| |
| |
| def missing_eab(): |
| global EABS |
| if len(EABS) == 1 and 'SECTIGO_EAB' in os.environ: |
| m = re.match(r'^\s*(\S+)\s+(\S+)\s*$', os.environ['SECTIGO_EAB']) |
| if m: |
| EABS.append({'kid': m.group(1), 'hmac': m.group(2)}) |
| return len(EABS) == 1 |
| |
| |
| def missing_tld(): |
| global DEMO_TLD |
| if 'SECTIGO_TLD' in os.environ: |
| DEMO_TLD = os.environ['SECTIGO_TLD'] |
| return DEMO_TLD is None |
| |
| |
| @pytest.mark.skipif(condition=missing_tld(), reason="env var SECTIGO_TLD not set") |
| @pytest.mark.skipif(condition=missing_eab(), reason="env var SECTIGO_EAB not set") |
| class TestSectigo: |
| |
| @pytest.fixture(autouse=True, scope='class') |
| def _class_scope(self, env, acme): |
| acme.start(config='eab') |
| env.check_acme() |
| env.clear_store() |
| MDConf(env).install() |
| assert env.apache_restart() == 0, f'{env.apachectl_stderr}' |
| |
| @pytest.fixture(autouse=True, scope='function') |
| def _method_scope(self, env, request): |
| env.clear_store() |
| self.test_domain = env.get_request_domain(request) |
| |
| def test_md_751_001(self, env): |
| # valid config, expect cert with correct chain |
| domain = f"test1.{DEMO_TLD}" |
| domains = [domain] |
| conf = MDConf(env) |
| conf.start_md(domains) |
| conf.add(f"MDCertificateAuthority {DEMO_ACME}") |
| conf.add("MDCACertificateFile none") |
| conf.add(f"MDExternalAccountBinding {EABS[1]['kid']} {EABS[1]['hmac']}") |
| conf.end_md() |
| conf.add_vhost(domains=domains) |
| conf.install() |
| assert env.apache_restart() == 0, f'{env.apachectl_stderr}' |
| assert env.await_completion(domains) |
| r = env.curl_get(f"https://{domain}:{env.https_port}", options=[ |
| "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem" |
| ]) |
| assert r.response['status'] == 200 |
| |
| def test_md_751_002(self, env): |
| # without EAB set |
| domain = f"test1.{DEMO_TLD}" |
| domains = [domain] |
| conf = MDConf(env) |
| conf.start_md(domains) |
| conf.add(f"MDCertificateAuthority {DEMO_ACME}") |
| conf.add("MDCACertificateFile none") |
| conf.end_md() |
| conf.add_vhost(domains=domains) |
| conf.install() |
| assert env.apache_restart() == 0, f'{env.apachectl_stderr}' |
| assert env.await_error(domain) |
| md = env.get_md_status(domain) |
| assert md['renewal']['errors'] > 0 |
| assert md['renewal']['last']['problem'] == 'urn:ietf:params:acme:error:externalAccountRequired' |
| |
| def test_md_751_003(self, env): |
| # with wrong EAB set |
| domain = f"test1.{DEMO_TLD}" |
| domains = [domain] |
| conf = MDConf(env) |
| conf.start_md(domains) |
| conf.add(f"MDCertificateAuthority {DEMO_ACME}") |
| conf.add("MDCACertificateFile none") |
| conf.add(f"MDExternalAccountBinding xxxxxx aaaaaaaaaaaaasdddddsdasdsadsadsadasdsadsa") |
| conf.end_md() |
| conf.add_vhost(domains=domains) |
| conf.install() |
| assert env.apache_restart() == 0, f'{env.apachectl_stderr}' |
| assert env.await_error(domain) |
| md = env.get_md_status(domain) |
| assert md['renewal']['errors'] > 0 |
| assert md['renewal']['last']['problem'] == 'urn:ietf:params:acme:error:unauthorized' |
| |
| def test_md_751_004(self, env): |
| # valid config, get cert, add dns name, renew cert |
| domain = f"test1.{DEMO_TLD}" |
| domain2 = f"test2.{DEMO_TLD}" |
| domains = [domain] |
| conf = MDConf(env) |
| conf.start_md(domains) |
| conf.add(f"MDCertificateAuthority {DEMO_ACME}") |
| conf.add("MDCACertificateFile none") |
| conf.add(f"MDExternalAccountBinding {EABS[1]['kid']} {EABS[1]['hmac']}") |
| conf.end_md() |
| conf.add_vhost(domains=domains) |
| conf.install() |
| assert env.apache_restart() == 0, f'{env.apachectl_stderr}' |
| assert env.await_completion(domains) |
| r = env.curl_get(f"https://{domain}:{env.https_port}", options=[ |
| "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem" |
| ]) |
| assert r.response['status'] == 200 |
| r = env.curl_get(f"https://{domain2}:{env.https_port}", options=[ |
| "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem" |
| ]) |
| assert r.exit_code != 0 |
| md1 = env.get_md_status(domain) |
| acct1 = md1['ca']['account'] |
| # add the domain2 to the dns names |
| domains = [domain, domain2] |
| conf = MDConf(env) |
| conf.start_md(domains) |
| conf.add(f"MDCertificateAuthority {DEMO_ACME}") |
| conf.add("MDCACertificateFile none") |
| conf.add(f"MDExternalAccountBinding {EABS[1]['kid']} {EABS[1]['hmac']}") |
| conf.end_md() |
| conf.add_vhost(domains=domains) |
| conf.install() |
| assert env.apache_restart() == 0, f'{env.apachectl_stderr}' |
| assert env.await_completion(domains) |
| r = env.curl_get(f"https://{domain2}:{env.https_port}", options=[ |
| "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem" |
| ]) |
| assert r.response['status'] == 200 |
| md2 = env.get_md_status(domain) |
| acct2 = md2['ca']['account'] |
| assert acct2 == acct1, f"ACME account was not reused: {acct1} became {acct2}" |
| |
| def test_md_751_020(self, env): |
| # valid config, get cert, check OCSP status |
| domain = f"test1.{DEMO_TLD}" |
| domains = [domain] |
| conf = MDConf(env) |
| conf.add("MDStapling on") |
| conf.start_md(domains) |
| conf.add(f""" |
| MDCertificateAuthority {DEMO_ACME} |
| MDCACertificateFile none |
| MDExternalAccountBinding {EABS[1]['kid']} {EABS[1]['hmac']} |
| """) |
| conf.end_md() |
| conf.add_vhost(domains=domains) |
| conf.install() |
| assert env.apache_restart() == 0, f'{env.apachectl_stderr}' |
| assert env.await_completion(domains) |
| r = env.curl_get(f"https://{domain}:{env.https_port}", options=[ |
| "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem" |
| ]) |
| assert r.response['status'] == 200 |
| time.sleep(1) |
| for domain in domains: |
| stat = env.await_ocsp_status(domain, |
| ca_file=f"{env.test_dir}/data/sectigo-demo-root.pem") |
| assert stat['ocsp'] == "successful (0x0)" |
| assert stat['verify'] == "0 (ok)" |
