Gitweb:
https://git.exim.org/exim.git/commitdiff/b577156a5877f5cbe0ac263219fb6d686aaf620c
Commit: b577156a5877f5cbe0ac263219fb6d686aaf620c
Parent: 415c5379af11bf8777af1a082a336ad7c5369525
Author: Jeremy Harris <jgh146exb@???>
AuthorDate: Thu Nov 24 18:05:44 2022 +0000
Committer: Jeremy Harris <jgh146exb@???>
CommitDate: Thu Nov 24 18:23:35 2022 +0000
Testsuite: avoid generating leaf certs expiring after signer expiry
---
test/aux-fixed/exim-ca/README.regenerate | 6 ++++--
test/aux-fixed/exim-ca/genall | 20 ++++++++++++++------
2 files changed, 18 insertions(+), 8 deletions(-)
diff --git a/test/aux-fixed/exim-ca/README.regenerate b/test/aux-fixed/exim-ca/README.regenerate
index d87512cfb..f31a5f6f0 100755
--- a/test/aux-fixed/exim-ca/README.regenerate
+++ b/test/aux-fixed/exim-ca/README.regenerate
@@ -5,6 +5,8 @@ and dnszones-src/db.example.com (the commands are next to each one).
The script "tlsa_regenerate" automates this.
Also, because of the certs changes, the following testcase outputs will change:
-2102
-5720
+2002 (GnuTLS)
+2102 (OpenSSL)
+5710 (GnuTLS)
+5720 (OpenSSL)
5800
diff --git a/test/aux-fixed/exim-ca/genall b/test/aux-fixed/exim-ca/genall
index 878c6aba0..25e46c7cf 100755
--- a/test/aux-fixed/exim-ca/genall
+++ b/test/aux-fixed/exim-ca/genall
@@ -15,6 +15,14 @@ echo use - date -u 110112342019
echo hit return when ready
read junk
+# Calc number of months from then to (about) Nov 2037.
+# We're sticking to a 2038 cutoff for now, to maintain support for 32b systems,
+# but will have to give that up in only a few years.
+#
+tgt_secs=`date -d 'Nov 25 2037' +%s`
+now_secs=`date +%s`
+diff_months=$(( ($tgt_secs - $now_secs) / 60 / 60 / 24 / 31 ))
+
# Main suite: RSA certs
for tld in com org net
do
@@ -41,14 +49,14 @@ do
# create server leaf certs
# -m <months>
- clica $V -D $idir -p password -s 101 -S server1.$iname -m 301 \
+ clica $V -D $idir -p password -s 101 -S server1.$iname -m $diff_months \
-8 alternatename.server1.example.$tld,alternatename2.server1.example.$tld,*.test.ex
- clica $V -D $idir -p password -s 102 -S revoked1.$iname -m 301
+ clica $V -D $idir -p password -s 102 -S revoked1.$iname -m $diff_months
clica $V -D $idir -p password -s 103 -S expired1.$iname -m 1
- clica $V -D $idir -p password -s 201 -S server2.$iname -m 301 \
+ clica $V -D $idir -p password -s 201 -S server2.$iname -m $diff_months \
-3 "CN=clica CA rsa,O=example.$tld" -8 '*.test.ex'
- clica $V -D $idir -p password -s 202 -S revoked2.$iname -m 301
+ clica $V -D $idir -p password -s 202 -S revoked2.$iname -m $diff_months
clica $V -D $idir -p password -s 203 -S expired2.$iname -m 1
####
@@ -195,7 +203,7 @@ done
# Create one EC leaf cert in the RSA cert tree. It will have an EC pubkey but be signed using its parent
# therefore its parent's algo, RSA.
-clica $V -D example.com -p password -k ec -q nistp521 -s 1101 -S server1_ec.example.com -m 301 -8 'server1.example.com,*.test.ex'
+clica $V -D example.com -p password -k ec -q nistp521 -s 1101 -S server1_ec.example.com -m $diff_months -8 'server1.example.com,*.test.ex'
SDIR=example.com/server1_ec.example.com
SPFX=$SDIR/server1_ec.example.com
openssl ec -in $SPFX.key -passin file:$SDIR/pwdfile -out $SPFX.unlocked.key
@@ -225,7 +233,7 @@ do
# create server certs
# -m <months>
- clica $V -D $idir -p password -s 2101 -S server1.$iname -m 301 \
+ clica $V -D $idir -p password -s 2101 -S server1.$iname -m $diff_months \
-k ec -q nistp521 \
-8 server1.example.$tld,alternatename.server1.example.$tld,alternatename2.server1.example.$tld,*.test.ex
