Merge pull request #12273 from ptabor/2020-09-07-fix-grpc-proxy-tests

testing/e2e,grpcproxy: Fix: go test --tags "cluster_proxy" -v ./tests/e2e/...

etcdmain/grpc_proxy.go

@@ -181,7 +181,11 @@ func startGRPCProxy(cmd *cobra.Command, args []string) {
 	}
 	grpclog.SetLoggerV2(gl)
 
-	tlsinfo := newTLS(grpcProxyListenCA, grpcProxyListenCert, grpcProxyListenKey)
+	// The proxy itself (ListenCert) can have not-empty CN.
+	// The empty CN is required for grpcProxyCert.
+	// Please see https://github.com/etcd-io/etcd/issues/11970#issuecomment-687875315  for more context.
+	tlsinfo := newTLS(grpcProxyListenCA, grpcProxyListenCert, grpcProxyListenKey, false)
+
 	if tlsinfo == nil && grpcProxyListenAutoTLS {
 		host := []string{"https://" + grpcProxyListenAddr}
 		dir := filepath.Join(grpcProxyDataDir, "fixtures", "proxy")
@@ -320,7 +324,7 @@ func newClientCfg(lg *zap.Logger, eps []string) (*clientv3.Config, error) {
 		cfg.MaxCallRecvMsgSize = grpcMaxCallRecvMsgSize
 	}
 
-	tls := newTLS(grpcProxyCA, grpcProxyCert, grpcProxyKey)
+	tls := newTLS(grpcProxyCA, grpcProxyCert, grpcProxyKey, true)
 	if tls == nil && grpcProxyInsecureSkipTLSVerify {
 		tls = &transport.TLSInfo{}
 	}
@@ -339,11 +343,11 @@ func newClientCfg(lg *zap.Logger, eps []string) (*clientv3.Config, error) {
 	return &cfg, nil
 }
 
-func newTLS(ca, cert, key string) *transport.TLSInfo {
+func newTLS(ca, cert, key string, requireEmptyCN bool) *transport.TLSInfo {
 	if ca == "" && cert == "" && key == "" {
 		return nil
 	}
-	return &transport.TLSInfo{TrustedCAFile: ca, CertFile: cert, KeyFile: key, EmptyCN: true}
+	return &transport.TLSInfo{TrustedCAFile: ca, CertFile: cert, KeyFile: key, EmptyCN: requireEmptyCN}
 }
 
 func mustListenCMux(lg *zap.Logger, tlsinfo *transport.TLSInfo) cmux.CMux {

integration/fixtures/ca.crt

@@ -1,22 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIDrjCCApagAwIBAgIUOl7DCgSvqQKhiihYrZDiBKNpQX4wDQYJKoZIhvcNAQEL
+MIIDrjCCApagAwIBAgIUb9uSXkXCq2x822QXvNdvkf/3ClkwDQYJKoZIhvcNAQEL
 BQAwbzEMMAoGA1UEBhMDVVNBMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
 Ew1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKEwRldGNkMRYwFAYDVQQLEw1ldGNkIFNl
-Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0xOTEwMDgyMTE5MDBaFw0yOTEwMDUyMTE5
+Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0yMDA5MDcwOTQzMDBaFw0zMDA5MDUwOTQz
 MDBaMG8xDDAKBgNVBAYTA1VTQTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UE
 BxMNU2FuIEZyYW5jaXNjbzENMAsGA1UEChMEZXRjZDEWMBQGA1UECxMNZXRjZCBT
 ZWN1cml0eTELMAkGA1UEAxMCY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQDBNhwKD8oqOwNSDMZR+K6l6ocyXZzZPAIbv7co34xtjt25c8PPKz8FiBSU
-M4YeZpzsSp7n7WSSSzVWqFTRBZzvjIrBzLu4CfxMKuUrQX1/BPYgbSxQO+5YKPzO
-yaBMhIAEtW+WYsaa6PpWyL65L4giKpVoLS/UFTEBsf+lO6pwFpX2EJnIylLbpwEd
-pAXIgVFsodHlP9Zc2tR1TqYetmJ6/A/p5sSZpgLy1y2+Mg4VTMKvs2kNAoh/+lEu
-WPe204eMpkBXhukulOiJkVKNdhnCkLslt8ZaMWWqBvD9d94lXycMQ9wnGakPNc4W
-5VX3rbLOGOX7xK37BCsh5HGodIrZAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAP
-BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRlB76vjaZyFLrEUGm6DQfyjmN6PjAN
-BgkqhkiG9w0BAQsFAAOCAQEAD0cRNBQqOPNAUmKCH9xCr4TZFoE+P5aNePU39Jyp
-qpJ1HjKI93zBk9aN5udDGPFhm2/iaKx6DuABbxCz0LwNhLiKP6UbHV8F2fTJJ5bo
-crXvD0CEpor+Quh995lbq9bv29+zcDVw+Hw0QainBdHWkdw6RAgmbFnJxETDDz8z
-VQ0DET3T736oxpEZ4DKQlbzK5LSgZH2lyPEEvzci4QjTZf5X/nitdx7fAdMFFPQ0
-lI4l7nIuge5LTR0isEfWHx7Orx6l8dzkofG3fz5BjHCI4JInVlWq3MNNSybDI4pI
-GFxeuE/U8K6kIixT8qCAh6Naq9/xuxFkffLmMKfZXoYLCg==
+AoIBAQCQfDHia502Omwu1BkWB6yO4tQ2pMUkJccU6NWV1jhEJotXr6Nl84u4Z5Mf
+EUUKNJ9frS928RXnL9bWepk1iyILHECOTZbQvolEy4u9xkuddovDvYr3Id7AopkX
+z08OKPdclxTrcRPP5MUtYJ2Z7nwAYBamRMIl/oTXiDNf406V0dP9fk3MHs5DcDa5
+FpFXUII5fM3rHCv6UtwYJ++H1imy1LfpYyOd+/71Mk082/5EtHr35O/LG/ySTozp
+bi6pkNVhy6aylNdsGml03dQNzam8G19KW+W01c9EOI00SgZxanK2JxUQisAbXUba
+fseHa7eKMTdlr7wZe6Cw2s1x2ROBAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAP
+BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTRTZxGpVyNLLwH02fkOEb3hsqgEzAN
+BgkqhkiG9w0BAQsFAAOCAQEAa7LXcHHXKRSxNv3+InYyi5/5pMjHO+v22s8/+3cJ
+qIIdUgCDrtoxLalyhpRbMYOGWfIjM3bUGW+I03AGzMwQDlmz01vP5UDv6toMswFE
+5F32sDbJw08qIngFOUmz629fi4/D5XOVzDBBh8Nw6ZAd5RJLbutNb+R/dnZYh+Cf
+Uwv4iY3qksXlNXLoGUc41Fi8rNBwVsx2R2dF3qKGoKoQV+8aMiCvYObHptIS5DZe
+T0pgg6RRTH3QeVEFUKNn4L0TDTm4NrqdSXysOFG6YhSI+Yp3gXLSWmH9XJLOKS64
+KgAUhYSWjzQ2TAiZD7cKzSvaWg29j9QlA4Bx6DnAvJLNrg==
 -----END CERTIFICATE-----

integration/fixtures/client-ca-csr-nocn.json

@@ -0,0 +1,20 @@
+{
+  "key": {
+    "algo": "rsa",
+    "size": 2048
+  },
+  "names": [
+    {
+      "O": "etcd",
+      "OU": "etcd Security",
+      "L": "San Francisco",
+      "ST": "California",
+      "C": "USA"
+    }
+  ],
+  "CN": "",
+  "hosts": [
+    "127.0.0.1",
+    "localhost"
+  ]
+}

integration/fixtures/client-nocn.crt

@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIID/DCCAuSgAwIBAgIUWFc9bqAgLYdNGvkVaddwlCvrGskwDQYJKoZIhvcNAQEL
+BQAwbzEMMAoGA1UEBhMDVVNBMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
+Ew1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKEwRldGNkMRYwFAYDVQQLEw1ldGNkIFNl
+Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0yMDA5MDcwOTQzMDBaFw0zMDA5MDUwOTQz
+MDBaMGIxDDAKBgNVBAYTA1VTQTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UE
+BxMNU2FuIEZyYW5jaXNjbzENMAsGA1UEChMEZXRjZDEWMBQGA1UECxMNZXRjZCBT
+ZWN1cml0eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKtllzAymU7Q
+/TVdZwqP84zXC2btrq8I0nXRQ3dx5MyATb8/RGRgIYLUc3k9w5OvS3Eo6Tloxz2L
+BzZ2Y/aJibfzVl/mKbGrQYYGD/iGKDLv+iJ7+uOLf/eqERDe4K41OIJRfGD/a9Y8
+XXBIxYrtayfjv1gbonWjgwdcrEX3vsDWZ5cWK7BBoaBuL0lUPJgU0QCSBQqKC8EO
+2KXVjnSZglywRDDPa4vZrmSdpGeci9b1jj3CeBjcVjbEmgQxLZ83W1ASe74+IBtH
+fHtNSGNF5/joxqeF0X3Ve+luzhRyHUd3k2bfVXZJ+vEAymabY680Hvp5mfYPKUIu
+NL5gF6bfZ68CAwEAAaOBnDCBmTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYI
+KwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFLtGYQh2
+/fZo6O14SmcaAIiTVgHOMB8GA1UdIwQYMBaAFNFNnEalXI0svAfTZ+Q4RveGyqAT
+MBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATANBgkqhkiG9w0BAQsFAAOCAQEA
+EYaGSg5EaDBNte90AkjcP/NPbK22mE4aOUDMoNXMCmjmT4LVUhxV9MnwPmfAIvzz
+GHLZsVTZPt91ex3lzf/mKV5CPbAnpn29U7tTHkgGaUhXuVN1/U7SEIEygApuvPTX
+tYdY5vCTIRdlylNjYm29tQFIY/+L4og5lxFnfbjVyr3QPxHPB/9T7j0Tl5ppDjoL
+zOhWe6PSUI0hVDpEwL70JH6CvqdS/5VjcToPwUw6YtUXNc2SvgJZK1biaSiJMnLf
+k+ao0d/33BfZMzY2TTzX3UUNhcRk6plv1ljtyQiXsIOeUpNptQ/SdPVZlOI0biMW
+Lo+BNaBpRERregCuiuuVnw==
+-----END CERTIFICATE-----

integration/fixtures/client-nocn.key.insecure

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAq2WXMDKZTtD9NV1nCo/zjNcLZu2urwjSddFDd3HkzIBNvz9E
+ZGAhgtRzeT3Dk69LcSjpOWjHPYsHNnZj9omJt/NWX+YpsatBhgYP+IYoMu/6Inv6
+44t/96oREN7grjU4glF8YP9r1jxdcEjFiu1rJ+O/WBuidaODB1ysRfe+wNZnlxYr
+sEGhoG4vSVQ8mBTRAJIFCooLwQ7YpdWOdJmCXLBEMM9ri9muZJ2kZ5yL1vWOPcJ4
+GNxWNsSaBDEtnzdbUBJ7vj4gG0d8e01IY0Xn+OjGp4XRfdV76W7OFHIdR3eTZt9V
+dkn68QDKZptjrzQe+nmZ9g8pQi40vmAXpt9nrwIDAQABAoIBAAZjRmO29wy/cDht
+bzovDEIq/5NJ93ExkHpwnqWUepT+kSc4Cen9xTH1jgouOZxG87ZXcn2/wHE0PcQT
+XH1jOd0/te/kCZjEC7CdiDnYciYX2Igxe7PATrghv/oTfGcxt5XvyIVq749v94GI
+TMh1OcGmVMrJWOAuhGMhWpBO/+5634pt/GwbE8xAimMpOLtk5G/wHM9yWEPu3fVK
+fhz57gvlZXwWtSAsNgvGnRYw5FABJ+TxskM8TJmnWkeea6kmg7IhRQpXIPoxYyGJ
+P9d6xGNBoPzLoXcZfQUL/E3m93gN51P4bCQ7O2sIX9WKbnuFQ5B27zQtitnT0JCZ
+TwHyD+ECgYEA1hJE5x5LuNRS5Tq8miGmo2YPg+zYQ+5gQNwAbdae8s1G+HnKbdS0
+U3RUcLa/RD/F0cvNpUC8FIQNTBFX9+vfek3kB37AiGDgRJHmRD+yudhympbj9RvM
+iw2zQzr56V8nHBY3gS7Gq6EgZqN+9JCtHof2cBa6EnBGPVfpZ6UtMKECgYEAzPeV
+EdUKGHOcZsEFYfCFkY7sSOD+KlDcMmuCEzRgpNrhhqwmxSFWEbrQ11+Il5/WL58e
+x1J8ZwQAarjeAHMGCbZaxWmN6Owz08XvwSQWasHeRqR0jiuJywSbsg94lUY87mSl
+7k8FJ4+fhp7fAzjBr9LwM448TGRPKe2T6yVFpk8CgYBtNMqzwM/OTXqweCNo2cvh
+xZoaqgO1u/Cchd8uKXPS14fiEHeFSiJoBItjKMcwMPxgx4B0Ui7gpHEIIjznPAw4
+n225qR7dM9aVBH0cygYKKvJkDJ/kFbdmJKoTnQ2K0UDpYigUneE6Ayu9UKDecMPw
+NFoy2lU4PNCIUMXAWxJPoQKBgA8aSxymQvksQ6D6pgfibiUcj+KK2Y+Kp777VvlN
+SbW7/xQqSS0LWMkzp8HG40yw1Vpq8hyjwlDg5Zr3hjwoPZCnpCaZsYAxL1xyYEkt
+/IzfPh6cbY4wPRX9f+9t3me5ZjH2rpdRsUKJ/aowuKQHIZZwB4z09RJ37bFcNSMF
+ew1XAoGBAM9lh717yxLq7my60R68AKpvACOz3fyhGDDJdQT8h3b4UcO9C8luOtIS
+LRVZHkv9O4uCLh+XHik87qc9ntxDIGElikjymey19xWjuk8HQSYAyWbw5SHdDsth
+1W8QacI9KLlHAujZwi1VB9HuUnGhtlLt6IW5sZxFItiV0OxJZX79
+-----END RSA PRIVATE KEY-----

integration/fixtures/gencerts.sh

@@ -1,74 +1,59 @@
 #!/bin/bash
 
+set -e
+
 if ! [[ "$0" =~ "./gencerts.sh" ]]; then
   echo "must be run from 'fixtures'"
   exit 255
 fi
 
 if ! which cfssl; then
   echo "cfssl is not installed"
+  echo "use: go install -mod mod github.com/cloudflare/cfssl/cmd/cfssl github.com/cloudflare/cfssl/cmd/cfssljson"
   exit 255
 fi
 
 cfssl gencert --initca=true ./ca-csr.json | cfssljson --bare ./ca
 mv ca.pem ca.crt
+
 if which openssl >/dev/null; then
   openssl x509 -in ca.crt -noout -text
 fi
 
+# gencert [config_file.json] [cert-name]
+function gencert {
+  cfssl gencert \
+    --ca ./ca.crt \
+    --ca-key ./ca-key.pem \
+    --config ./gencert.json \
+    $1 | cfssljson --bare ./$2
+  mv $2.pem $2.crt
+  mv $2-key.pem $2.key.insecure
+}
+
 # generate DNS: localhost, IP: 127.0.0.1, CN: example.com certificates
-cfssl gencert \
-  --ca ./ca.crt \
-  --ca-key ./ca-key.pem \
-  --config ./gencert.json \
-  ./server-ca-csr.json | cfssljson --bare ./server
-mv server.pem server.crt
-mv server-key.pem server.key.insecure
+gencert ./server-ca-csr.json server
+
+#generates certificate that does not contain CN, to be used for proxy -> server connections.
+gencert ./client-ca-csr-nocn.json client-nocn
 
 # generate DNS: localhost, IP: 127.0.0.1, CN: example.com certificates (ECDSA)
-cfssl gencert \
-  --ca ./ca.crt \
-  --ca-key ./ca-key.pem \
-  --config ./gencert.json \
-  ./server-ca-csr-ecdsa.json | cfssljson --bare ./server-ecdsa
-mv server-ecdsa.pem server-ecdsa.crt
-mv server-ecdsa-key.pem server-ecdsa.key.insecure
+gencert ./server-ca-csr-ecdsa.json server-ecdsa
 
 # generate IP: 127.0.0.1, CN: example.com certificates
-cfssl gencert \
-  --ca ./ca.crt \
-  --ca-key ./ca-key.pem \
-  --config ./gencert.json \
-  ./server-ca-csr-ip.json | cfssljson --bare ./server-ip
-mv server-ip.pem server-ip.crt
-mv server-ip-key.pem server-ip.key.insecure
+gencert ./server-ca-csr-ip.json server-ip
 
 # generate IPv6: [::1], CN: example.com certificates
-cfssl gencert \
-  --ca ./ca.crt \
-  --ca-key ./ca-key.pem \
-  --config ./gencert.json \
-  ./server-ca-csr-ipv6.json | cfssljson --bare ./server-ip
-mv server-ip.pem server-ipv6.crt
-mv server-ip-key.pem server-ipv6.key.insecure
+gencert ./server-ca-csr-ipv6.json server-ipv6
 
 # generate DNS: localhost, IP: 127.0.0.1, CN: example2.com certificates
-cfssl gencert \
-  --ca ./ca.crt \
-  --ca-key ./ca-key.pem \
-  --config ./gencert.json \
-  ./server-ca-csr2.json | cfssljson --bare ./server2
-mv server2.pem server2.crt
-mv server2-key.pem server2.key.insecure
+gencert ./server-ca-csr2.json server2
 
 # generate DNS: localhost, IP: 127.0.0.1, CN: "" certificates
-cfssl gencert \
-  --ca ./ca.crt \
-  --ca-key ./ca-key.pem \
-  --config ./gencert.json \
-  ./server-ca-csr3.json | cfssljson --bare ./server3
-mv server3.pem server3.crt
-mv server3-key.pem server3.key.insecure
+gencert ./server-ca-csr3.json server3
+
+# generate wildcard certificates DNS: *.etcd.local
+gencert ./server-ca-csr-wildcard.json server-wildcard
 
 # generate revoked certificates and crl
 cfssl gencert --ca ./ca.crt \
@@ -80,14 +65,4 @@ mv server-revoked-key.pem server-revoked.key.insecure
 grep serial revoked.stderr | awk ' { print $9 } ' >revoke.txt
 cfssl gencrl revoke.txt ca.crt ca-key.pem | base64 --decode >revoke.crl
 
-# generate wildcard certificates DNS: *.etcd.local
-cfssl gencert \
-  --ca ./ca.crt \
-  --ca-key ./ca-key.pem \
-  --config ./gencert.json \
-  ./server-ca-csr-wildcard.json | cfssljson --bare ./server-wildcard
-mv server-wildcard.pem server-wildcard.crt
-mv server-wildcard-key.pem server-wildcard.key.insecure
-
-
 rm -f *.csr *.pem *.stderr *.txt

integration/fixtures/server-ecdsa.crt

@@ -1,20 +1,20 @@
 -----BEGIN CERTIFICATE-----
-MIIDRzCCAi+gAwIBAgIUKgQJ/CMaFxc4JcwwGyiT/7KpedIwDQYJKoZIhvcNAQEL
+MIIDRzCCAi+gAwIBAgIUB3isF3kQsriRjeCMKua3xOUB77IwDQYJKoZIhvcNAQEL
 BQAwbzEMMAoGA1UEBhMDVVNBMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
 Ew1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKEwRldGNkMRYwFAYDVQQLEw1ldGNkIFNl
-Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0xOTEwMDgyMTE5MDBaFw0yOTEwMDUyMTE5
+Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0yMDA5MDcwOTQzMDBaFw0zMDA5MDUwOTQz
 MDBaMHgxDDAKBgNVBAYTA1VTQTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UE
 BxMNU2FuIEZyYW5jaXNjbzENMAsGA1UEChMEZXRjZDEWMBQGA1UECxMNZXRjZCBT
 ZWN1cml0eTEUMBIGA1UEAxMLZXhhbXBsZS5jb20wWTATBgcqhkjOPQIBBggqhkjO
-PQMBBwNCAARXbc8naiFZ3Y2LujrnDCScVNRks/TR+aXPmnuPGjDxbuHxSSbC8Q2z
-iTvCkgsIcsifmUIEQcI4v3Kbkj3qMF1so4GcMIGZMA4GA1UdDwEB/wQEAwIFoDAd
+PQMBBwNCAAQF47/Y6WfdmYcvwZtMyMutdxMwQsEKTkd0GEWcdD1e7nOARzPr3Esk
++Y2U0BsDWaE7LmRUfEX87LugdAjuMq8Mo4GcMIGZMA4GA1UdDwEB/wQEAwIFoDAd
 BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNV
-HQ4EFgQU3z1DifT82BfoU5DfMe08meeYmSUwHwYDVR0jBBgwFoAUZQe+r42mchS6
-xFBpug0H8o5jej4wGgYDVR0RBBMwEYIJbG9jYWxob3N0hwR/AAABMA0GCSqGSIb3
-DQEBCwUAA4IBAQAE3bhZcJuGrnMGMgebCFMuAXvoF9twYIHXpxNOg6u0HTIWOsMB
-njEJW/rfZFE/RAJ6JdOMNE2bq2LbJ8dUA25PX3uz6V4omm9B3EvEG9Hh3J+C77XQ
-P+ofiUd+j06SdewoxrmmQmjZZdotpFUQG3EEncs+v94jsamwGNLdq4yWDjFdmyuC
-hqzSkD48aGqP2Q93wfv8uIiCEmJS1vITTm2LxssCLfiYGortpCx32/DWme8nUlni
-1U/pRTx8Brx00dMeruTGjCCpwb8k453oNV6u0D1LsQ9y5DuyEwmZtBEHBN1kVPro
-yYW3/b1jcmZk8W9GXqcXy16LbWmpvJmTHPsj
+HQ4EFgQUeYoyZnP2SfEDN9H7OYSffcxdBnQwHwYDVR0jBBgwFoAU0U2cRqVcjSy8
+B9Nn5DhG94bKoBMwGgYDVR0RBBMwEYIJbG9jYWxob3N0hwR/AAABMA0GCSqGSIb3
+DQEBCwUAA4IBAQARYwN9/699uwgqdCcd7j8ZnkJfEBOiggOJKcCQV8kd7eoKUP3p
+bfgbp5/cEAiI/3hNyZYuu+NxOYecyv2M/lls1NrSOX6+boHpYfijtZ8xVrBNVrY4
+OhkubObn1zmPcnqO+E2BbIPIQjcFmZhwJp/C0nlugDWbBqBq2nyASVay8MWjHqhk
+VqMNrMYNr7+1U+NCDe+XTkDC9y6N3+MRN9LMWARQT8zagxsFN/g7HHl8MfE3xhiT
++SNID26wqDrVlNscnLZo+MS5m6llBJeQQNLkKQc399b/Em522+cPJ6XGfpQdixSU
+HpTFDAqspwdlWu6GDwE3uc5sdSX84kzU2e/E
 -----END CERTIFICATE-----

integration/fixtures/server-ecdsa.key.insecure

@@ -1,5 +1,5 @@
 -----BEGIN EC PRIVATE KEY-----
-MHcCAQEEIK3K2gimOw2P0pZ4soFAopriuORuqpRptllFXNRhCRV0oAoGCCqGSM49
-AwEHoUQDQgAEV23PJ2ohWd2Ni7o65wwknFTUZLP00fmlz5p7jxow8W7h8UkmwvEN
-s4k7wpILCHLIn5lCBEHCOL9ym5I96jBdbA==
+MHcCAQEEIM4bArwMGk+ocE/MPTlkzHvqYruDZcIwGRgG9oTbmrzeoAoGCCqGSM49
+AwEHoUQDQgAEBeO/2Oln3ZmHL8GbTMjLrXcTMELBCk5HdBhFnHQ9Xu5zgEcz69xL
+JPmNlNAbA1mhOy5kVHxF/Oy7oHQI7jKvDA==
 -----END EC PRIVATE KEY-----

integration/fixtures/server-ip.crt

@@ -1,24 +1,24 @@
 -----BEGIN CERTIFICATE-----
-MIIEBzCCAu+gAwIBAgIUSvxuG1lgImYpnaK4sPaCiMAd0lgwDQYJKoZIhvcNAQEL
+MIIEBzCCAu+gAwIBAgIUNT/vFvJiTMq0dBPYDHPF2ziOP4UwDQYJKoZIhvcNAQEL
 BQAwbzEMMAoGA1UEBhMDVVNBMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
 Ew1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKEwRldGNkMRYwFAYDVQQLEw1ldGNkIFNl
-Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0xOTEwMDgyMTE5MDBaFw0yOTEwMDUyMTE5
+Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0yMDA5MDcwOTQzMDBaFw0zMDA5MDUwOTQz
 MDBaMHgxDDAKBgNVBAYTA1VTQTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UE
 BxMNU2FuIEZyYW5jaXNjbzENMAsGA1UEChMEZXRjZDEWMBQGA1UECxMNZXRjZCBT
 ZWN1cml0eTEUMBIGA1UEAxMLZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUA
-A4IBDwAwggEKAoIBAQC7mJOiyqWfmNM5ptQZ22plotVfgoBf9fHTzMw/ap2Vl0/0
-4V3GEyYCdPt6V87GWzjBSO9GAmlISBQQybMieZTaTm8KKW2066iJDKseBCv9m4nS
-mHv0oDqp3SHsZQ2xHis4lbi7ws2thdqpmjw4Dv96SUiCJUjhcBX4kBMRcOGgk1RF
-ENIOInTSKlAiwNF1NSnhj8wMNw7mjw90jpAGAuPuuiQ7+AYHJBJqtT9mRikR8ppw
-isjEE6kslCCg2RC45AiF4LXNp7A7Xwm6P34XJ6T9PJUh/r3pa0xHRuI2zQLaW8Z/
-b6NYkUGMbHR7AY/+2JzOfnnnQcSB8EYC9bHadvHnAgMBAAGjgZEwgY4wDgYDVR0P
+A4IBDwAwggEKAoIBAQC4tXMtvn0addMj/GIZCOkn9Pmz6pJ4OajBsE2ffE8pssoe
+2zsijFsQdjxZNZO9oEnuQxhK8lKx3sMvNWN56wZaUmZeCUXOOQQon1HHsnNupGHE
+76gPTQFuWQHszWy2sTgcxiGxe8RPJDbHYQLEkRIdfd41Pr9m2+giSO54Q35fY61J
+SgQmXO+rJJi++pa7Q//HYFNwj36fu0lO9M4WpEfHVAQYuYgSbr+4Qu79j8eb2T8N
+oKjHkYHpdfDSSSJQJzTYWPsU8OwD1nabbVlQwV8/H/fHZXfzT+USd8QES9SjC2RP
+ILcgpR3B5NtYsfL61UtYFrEBwi4O2iMu6X+3CD6rAgMBAAGjgZEwgY4wDgYDVR0P
 AQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMB
-Af8EAjAAMB0GA1UdDgQWBBSPaFA2Jh7s/IJN/Yw/QFFR4pO3nDAfBgNVHSMEGDAW
-gBRlB76vjaZyFLrEUGm6DQfyjmN6PjAPBgNVHREECDAGhwR/AAABMA0GCSqGSIb3
-DQEBCwUAA4IBAQAO2EnUXDlZAzOJLmkzQQF/d88PjvzspFtBfj/jCGzK6bpjeZwq
-oM1fQOkjuFeNvVLA3WHVT0XEpZEM8lwAr/YwnBWMFlNd3Vb2Cho5VaQq0nVfhYoB
-tpzoWcf0Qx4cALesQZ3y2EnXePpzky1R4MfHqulYrmZKSBQsERob/7YgSBk+ucV9
-OHLzYxm4OvYvDoR54REq+vgZ3ohoDmBrNNv9OmUHLIrUi+nBpBgnww85Dc7cKB27
-EEKxqIfCNTeHSemvzfK/1M6manQX6eyGe48nOwQMV/ocfY6SeA7RABT0l/UsbeMp
-g/b2RU+liZ3e8FziW4/1VTt1pmFAN/2hnb0v
+Af8EAjAAMB0GA1UdDgQWBBR7yTFFaeONzBupvYwuDZjzDBnpMTAfBgNVHSMEGDAW
+gBTRTZxGpVyNLLwH02fkOEb3hsqgEzAPBgNVHREECDAGhwR/AAABMA0GCSqGSIb3
+DQEBCwUAA4IBAQAoaU4r6LWkz6cJRyKYt+VDc6a57mf3Ld3iq1au0yb9xVDPSGf2
+TnY+HpmQQMxL9nlOyd6yGijzdi1OOmw/GezfoC75+Dr/08ePdqNav07N5QqBsw11
+nGwS4XrzZkiopEvhBWd+bLw2CdncnmJJxByc3Lpl+AP0h6yjpcwn95pFEaYLPEg+
+ZVEb1y/z7NvbDEIl40SNVG7Ms2hMTjjr0Noh7QGrhif40GvbF9l1iPCZlV6+z/w3
+T4ojo/Ul970vmALCPo05qXttubYB0nWHCWm5LZtYGIF/3ag5dGo0Zue5cpF6+fzF
+lRCnby+d4FJYUAp1vKrD8mub1sbMfmf88f7d
 -----END CERTIFICATE-----