Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

test: update certificates and private keys #22184

Closed
wants to merge 5 commits into from
Closed

Conversation

indutny
Copy link
Member

@indutny indutny commented Aug 7, 2018

The certificates in test fixtures were set to expire in 999 days since
they were generated. That time has passed, and they have to be reissued.
Bump expiration time to 9999 days for all of them to prevent this from
happening again in near future.

Fix: #22182

Checklist
  • make -j4 test (UNIX), or vcbuild test (Windows) passes
  • tests and/or benchmarks are included
  • documentation is changed or added
  • commit message follows commit guidelines

The certificates in test fixtures were set to expire in 999 days since
they were generated. That time has passed, and they have to be reissued.
Bump expiration time to 9999 days for all of them to prevent this from
happening again in near future.

Fix: #22182
@nodejs-github-bot nodejs-github-bot added the test Issues and PRs related to the tests. label Aug 7, 2018
@indutny
Copy link
Member Author

indutny commented Aug 7, 2018

cc @MylesBorins @nodejs/crypto @bnoordhuis

@@ -27,6 +27,7 @@ ca3-key.pem:
ca3-csr.pem: ca3.cnf ca3-key.pem
openssl req -new \
-extensions v3_ca \
-days 9999 \
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gosh, this slipped my quick review. It isn't really necessary, since the days are set in ca3.cnf.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we remove it or just leave it?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed.

@MylesBorins
Copy link
Contributor

@MylesBorins
Copy link
Contributor

@indutny no bueno

test.parallel/test-crypto-sign-verify
test.parallel/test-tls-cert-chains-concat
test.parallel/test-tls-cert-chains-in-ca
test.parallel/test-tls-multi-pfx
test.parallel/test-tls-peer-certificate

all failing

https://ci.nodejs.org/job/node-test-commit-linux/20522/nodes=alpine-latest-x64/

@indutny
Copy link
Member Author

indutny commented Aug 8, 2018

Should be fixed now.

@MylesBorins
Copy link
Contributor

Copy link
Contributor

@MylesBorins MylesBorins left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

we should fast track this as it is breaking lots of things

Copy link
Contributor

@MylesBorins MylesBorins left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😅

@devsnek devsnek added the fast-track PRs that do not need to wait for 48 hours to land. label Aug 8, 2018
@jasnell
Copy link
Member

jasnell commented Aug 8, 2018

I wonder if we shouldn't look at potentially dynamically generating these every so often

@MylesBorins
Copy link
Contributor

MylesBorins commented Aug 8, 2018

one last ci with sn extra 9... giving us 273 years to figure this out instead of 27

https://ci.nodejs.org/job/node-test-pull-request/16264/

@jasnell
Copy link
Member

jasnell commented Aug 8, 2018

Ah yes, good ole Node.js 557.0.0

@MylesBorins
Copy link
Contributor

@indutny
Copy link
Member Author

indutny commented Aug 8, 2018

21:53:31     AssertionError [ERR_ASSERTION]: 5 2 agent3 rejected, but should NOT have been
21:53:31         at ChildProcess.<anonymous> (/home/iojs/build/workspace/node-test-binary-arm/test/parallel/test-tls-server-verify.js:232:14)
21:53:31         at ChildProcess.emit (events.js:182:13)
21:53:31         at Process.ChildProcess._handle.onexit (internal/child_process.js:240:12)

@MylesBorins
Copy link
Contributor

@mhdawson and I dug in a bunch and it seems like the failures on arm are infra related... potentially during setup

@rvagg can you dig into this?

One more ci: https://ci.nodejs.org/job/node-test-pull-request/16265/

landing if green

Copy link
Member

@Trott Trott left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rubber-stamp LGTM if CI is green. +1 to fast-tracking

@Trott
Copy link
Member

Trott commented Aug 8, 2018

parallel/test-tls-server-verify still failing on Raspberry Pi...

@MylesBorins
Copy link
Contributor

oops... I did the status file wrong

re-running arm https://ci.nodejs.org/job/node-test-commit-arm-fanned/2721/

@rvagg
Copy link
Member

rvagg commented Aug 8, 2018

Diagnosis & fix nodejs/build#1432
New CI run @ https://ci.nodejs.org/job/node-test-binary-arm/2612/ looking green.

@Trott
Copy link
Member

Trott commented Aug 8, 2018

Manually kicked off a node-daily-master now that this has landed just to make sure I didn't get confused and we still have a problem or something: https://ci.nodejs.org/job/node-daily-master/1247/

MylesBorins pushed a commit that referenced this pull request Aug 8, 2018
The certificates in test fixtures were set to expire in 999 days since
they were generated. That time has passed, and they have to be reissued.
Bump expiration time to 99999 days for all of them to prevent this from
happening again in near future.

PR-URL: #22184
Fixes: #22182
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>
@Trott
Copy link
Member

Trott commented Aug 8, 2018

Custom suites failed to git clone again. Re-running (again): https://ci.nodejs.org/job/node-test-commit-custom-suites/524/ (Not that it's relevant, since in node-daily-master, I'm pretty sure it only runs the internet suite.)

@MylesBorins
Copy link
Contributor

MylesBorins commented Aug 8, 2018

Backporting to all staging branches

v11.x-staging 6efbe1a
v10.x-staging: a6b9ee9
v8.x-staging: 50ccfec
v6.x-staging: 14b46d0

@Trott
Copy link
Member

Trott commented Aug 8, 2018

Unrelated flaky on LinuxONE, re-running: https://ci.nodejs.org/job/node-test-commit-linuxone/3652/

@Trott
Copy link
Member

Trott commented Aug 8, 2018

Custom suites passed.

@Trott Trott mentioned this pull request Aug 8, 2018
2 tasks
@Trott
Copy link
Member

Trott commented Aug 8, 2018

LinuxONE passed.

@Trott
Copy link
Member

Trott commented Aug 8, 2018

Argh, the --worker custom suite run also failed. Re-run: https://ci.nodejs.org/job/node-test-commit-custom-suites/528/

@Trott
Copy link
Member

Trott commented Aug 8, 2018

--worker custom suite re-run passed.

MylesBorins pushed a commit that referenced this pull request Aug 8, 2018
The certificates in test fixtures were set to expire in 999 days since
they were generated. That time has passed, and they have to be reissued.
Bump expiration time to 99999 days for all of them to prevent this from
happening again in near future.

PR-URL: #22184
Fixes: #22182
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>
MylesBorins pushed a commit that referenced this pull request Aug 8, 2018
The certificates in test fixtures were set to expire in 999 days since
they were generated. That time has passed, and they have to be reissued.
Bump expiration time to 99999 days for all of them to prevent this from
happening again in near future.

PR-URL: #22184
Fixes: #22182
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>
@MylesBorins MylesBorins deleted the fix/ci-certs branch August 8, 2018 14:30
MylesBorins pushed a commit that referenced this pull request Aug 9, 2018
The certificates in test fixtures were set to expire in 999 days since
they were generated. That time has passed, and they have to be reissued.
Bump expiration time to 99999 days for all of them to prevent this from
happening again in near future.

PR-URL: #22184
Fixes: #22182
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>
@MylesBorins MylesBorins mentioned this pull request Aug 17, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
fast-track PRs that do not need to wait for 48 hours to land. test Issues and PRs related to the tests.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

parallel/test-tls-server-verify broken by crl in testing fixtures being expired
7 participants