Repository navigation
test(coderd/notifications/dispatch/smtptest): renew the expired TLS test certificate - #30922
Draft
ibetitsmike wants to merge 1 commit into
Draft
ibetitsmike wants to merge 1 commit into
ibetitsmike wants to merge 1 commit into
Conversation
…est certificate The SMTP test server certificate expired on 2026-10-18 at 13:36:08Z, 825 days after it was issued, so the TLS cases of TestSMTP fail. Re-sign the committed server.csr with the committed CA, valid until 2034-07-12, a day before the CA expires. The key pair, subject, and extensions are unchanged, and the serial is the next one in ca.srl. generate.sh now issues the server certificate for 3649 days, a day less than the CA.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Renews the SMTP test server certificate in
coderd/notifications/dispatch/smtptest/fixtures. It expired on 2026-10-18 at 13:36:08Z, so the TLS cases ofTestSMTP(TLS:_self-signed,TLS:_self-signed_+_SNI,PLAIN_auth_and_TLS) fail intest-go-pg-17andtest-go-race-pgon every PR.What changed
server.crt: the committedserver.csr, re-signed with the committed CA (ca.crt,ca.key) andv3_ext.conf. It is valid until 2034-07-12, a day before the CA expires. The key pair, subject, and extensions (SANsmyserver.local,www.myserver.local,127.0.0.1) are unchanged. Only the serial, the validity, and the signature differ.ca.srl: the next serial, which the new certificate uses.generate.sh: it issued the server certificate for 825 days, and 2024-07-15 plus 825 days is 2026-10-18. It now uses 3649 days, a day less than the CA's 3650.The command, run in the fixtures directory:
With OpenSSL 3.0.2,
-CAserial ca.srlissued a random serial and leftca.srlunchanged, so the command sets the next serial explicitly.Review focus
Re-signing keeps the CA and the server key, so no other fixture or test changes. The one choice is the validity: about 7.7 years, ending a day before the CA.
Validation
mainopenssl x509 -noout -datesnotAfter=Oct 18 13:36:08 2026 GMTnotAfter=Jul 12 14:24:37 2034 GMTopenssl verify -CAfile ca.crt server.crtcertificate has expiredserver.crt: OKgo test ./coderd/notifications/dispatch/... -run TestSMTP -count=1x509: certificate has expired or is not yet validgo test ./coderd/notifications/... -count=1passes, includingnotifications_test.go, the other user ofsmtptest. A text diff of the old and new certificates (openssl x509 -noout -text) shows only the serial, the dates, and the signature.