Skip to content

Commit

Permalink
Adjust testGetSslCertificates to run in FIPS (#40046)
Browse files Browse the repository at this point in the history
As discovered in #40041, when parsing certificates from files, the
SUN Security Provider normalizes DNs from parsed certificates by
adding spaces between RDNs, while the BouncyCastle one (which we
use in FIPS tests) does not.

We could proceed to normalize the DNs in the same manner in this
test by using i.e. the Unbound LDAP SDK but since the goal of this
test is to validate that we do get to read these exact certificates
from our trust sources and not to validate subject DNs, this commit
changes the test to check the serial number instead

Resolves: #40041
  • Loading branch information
jkakavas committed Mar 14, 2019
1 parent a07d76a commit b97ad90
Showing 1 changed file with 9 additions and 10 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -964,7 +964,6 @@ public void onFailure(Exception e) {
}

public void testGetSslCertificates() throws Exception {
assumeFalse("Awaits fix: https://github.com/elastic/elasticsearch/issues/40041", inFipsJvm());
RestHighLevelClient client = highLevelClient();
{
//tag::get-certificates-execute
Expand All @@ -980,39 +979,39 @@ public void testGetSslCertificates() throws Exception {
assertThat(certificates.size(), Matchers.equalTo(9));
final Iterator<CertificateInfo> it = certificates.iterator();
CertificateInfo c = it.next();
assertThat(c.getSubjectDn(), Matchers.equalTo("CN=testnode-client-profile"));
assertThat(c.getSerialNumber(), Matchers.equalTo("c0ea4216e8ff0fd8"));
assertThat(c.getPath(), Matchers.equalTo("testnode.jks"));
assertThat(c.getFormat(), Matchers.equalTo("jks"));
c = it.next();
assertThat(c.getSubjectDn(), Matchers.equalTo("CN=Elasticsearch Test Node, OU=elasticsearch, O=org"));
assertThat(c.getSerialNumber(), Matchers.equalTo("b8b96c37e332cccb"));
assertThat(c.getPath(), Matchers.equalTo("testnode.crt"));
assertThat(c.getFormat(), Matchers.equalTo("PEM"));
c = it.next();
assertThat(c.getSubjectDn(), Matchers.equalTo("CN=OpenLDAP, OU=Elasticsearch, O=Elastic, L=Mountain View, ST=CA, C=US"));
assertThat(c.getSerialNumber(), Matchers.equalTo("d3850b2b1995ad5f"));
assertThat(c.getPath(), Matchers.equalTo("testnode.jks"));
assertThat(c.getFormat(), Matchers.equalTo("jks"));
c = it.next();
assertThat(c.getSubjectDn(), Matchers.equalTo("CN=Elasticsearch Test Node, OU=elasticsearch, O=org"));
assertThat(c.getSerialNumber(), Matchers.equalTo("b8b96c37e332cccb"));
assertThat(c.getPath(), Matchers.equalTo("testnode.jks"));
assertThat(c.getFormat(), Matchers.equalTo("jks"));
c = it.next();
assertThat(c.getSubjectDn(), Matchers.equalTo("CN=Elasticsearch Test Client, OU=elasticsearch, O=org"));
assertThat(c.getSerialNumber(), Matchers.equalTo("b9d497f2924bbe29"));
assertThat(c.getPath(), Matchers.equalTo("testnode.jks"));
assertThat(c.getFormat(), Matchers.equalTo("jks"));
c = it.next();
assertThat(c.getSubjectDn(), Matchers.equalTo("CN=ad-ELASTICSEARCHAD-CA, DC=ad, DC=test, DC=elasticsearch, DC=com"));
assertThat(c.getSerialNumber(), Matchers.equalTo("580db8ad52bb168a4080e1df122a3f56"));
assertThat(c.getPath(), Matchers.equalTo("testnode.jks"));
assertThat(c.getFormat(), Matchers.equalTo("jks"));
c = it.next();
assertThat(c.getSubjectDn(), Matchers.equalTo("CN=Elasticsearch Test Node"));
assertThat(c.getSerialNumber(), Matchers.equalTo("7268203b"));
assertThat(c.getPath(), Matchers.equalTo("testnode.jks"));
assertThat(c.getFormat(), Matchers.equalTo("jks"));
c = it.next();
assertThat(c.getSubjectDn(), Matchers.equalTo("CN=samba4"));
assertThat(c.getSerialNumber(), Matchers.equalTo("3151a81eec8d4e34c56a8466a8510bcfbe63cc31"));
assertThat(c.getPath(), Matchers.equalTo("testnode.jks"));
assertThat(c.getFormat(), Matchers.equalTo("jks"));
c = it.next();
assertThat(c.getSubjectDn(), Matchers.equalTo("CN=Elasticsearch Test Node"));
assertThat(c.getSerialNumber(), Matchers.equalTo("223c736a"));
assertThat(c.getPath(), Matchers.equalTo("testnode.jks"));
assertThat(c.getFormat(), Matchers.equalTo("jks"));
}
Expand Down

0 comments on commit b97ad90

Please sign in to comment.