From b97ad90cfb545d6eee00eaae971f34da7534163d Mon Sep 17 00:00:00 2001 From: Ioannis Kakavas Date: Thu, 14 Mar 2019 20:23:54 +0200 Subject: [PATCH] Adjust testGetSslCertificates to run in FIPS (#40046) As discovered in #40041, when parsing certificates from files, the SUN Security Provider normalizes DNs from parsed certificates by adding spaces between RDNs, while the BouncyCastle one (which we use in FIPS tests) does not. We could proceed to normalize the DNs in the same manner in this test by using i.e. the Unbound LDAP SDK but since the goal of this test is to validate that we do get to read these exact certificates from our trust sources and not to validate subject DNs, this commit changes the test to check the serial number instead Resolves: #40041 --- .../SecurityDocumentationIT.java | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/client/rest-high-level/src/test/java/org/elasticsearch/client/documentation/SecurityDocumentationIT.java b/client/rest-high-level/src/test/java/org/elasticsearch/client/documentation/SecurityDocumentationIT.java index c11c62c1147eb..f9c521aca2e04 100644 --- a/client/rest-high-level/src/test/java/org/elasticsearch/client/documentation/SecurityDocumentationIT.java +++ b/client/rest-high-level/src/test/java/org/elasticsearch/client/documentation/SecurityDocumentationIT.java @@ -964,7 +964,6 @@ public void onFailure(Exception e) { } public void testGetSslCertificates() throws Exception { - assumeFalse("Awaits fix: https://github.com/elastic/elasticsearch/issues/40041", inFipsJvm()); RestHighLevelClient client = highLevelClient(); { //tag::get-certificates-execute @@ -980,39 +979,39 @@ public void testGetSslCertificates() throws Exception { assertThat(certificates.size(), Matchers.equalTo(9)); final Iterator it = certificates.iterator(); CertificateInfo c = it.next(); - assertThat(c.getSubjectDn(), Matchers.equalTo("CN=testnode-client-profile")); + assertThat(c.getSerialNumber(), Matchers.equalTo("c0ea4216e8ff0fd8")); assertThat(c.getPath(), Matchers.equalTo("testnode.jks")); assertThat(c.getFormat(), Matchers.equalTo("jks")); c = it.next(); - assertThat(c.getSubjectDn(), Matchers.equalTo("CN=Elasticsearch Test Node, OU=elasticsearch, O=org")); + assertThat(c.getSerialNumber(), Matchers.equalTo("b8b96c37e332cccb")); assertThat(c.getPath(), Matchers.equalTo("testnode.crt")); assertThat(c.getFormat(), Matchers.equalTo("PEM")); c = it.next(); - assertThat(c.getSubjectDn(), Matchers.equalTo("CN=OpenLDAP, OU=Elasticsearch, O=Elastic, L=Mountain View, ST=CA, C=US")); + assertThat(c.getSerialNumber(), Matchers.equalTo("d3850b2b1995ad5f")); assertThat(c.getPath(), Matchers.equalTo("testnode.jks")); assertThat(c.getFormat(), Matchers.equalTo("jks")); c = it.next(); - assertThat(c.getSubjectDn(), Matchers.equalTo("CN=Elasticsearch Test Node, OU=elasticsearch, O=org")); + assertThat(c.getSerialNumber(), Matchers.equalTo("b8b96c37e332cccb")); assertThat(c.getPath(), Matchers.equalTo("testnode.jks")); assertThat(c.getFormat(), Matchers.equalTo("jks")); c = it.next(); - assertThat(c.getSubjectDn(), Matchers.equalTo("CN=Elasticsearch Test Client, OU=elasticsearch, O=org")); + assertThat(c.getSerialNumber(), Matchers.equalTo("b9d497f2924bbe29")); assertThat(c.getPath(), Matchers.equalTo("testnode.jks")); assertThat(c.getFormat(), Matchers.equalTo("jks")); c = it.next(); - assertThat(c.getSubjectDn(), Matchers.equalTo("CN=ad-ELASTICSEARCHAD-CA, DC=ad, DC=test, DC=elasticsearch, DC=com")); + assertThat(c.getSerialNumber(), Matchers.equalTo("580db8ad52bb168a4080e1df122a3f56")); assertThat(c.getPath(), Matchers.equalTo("testnode.jks")); assertThat(c.getFormat(), Matchers.equalTo("jks")); c = it.next(); - assertThat(c.getSubjectDn(), Matchers.equalTo("CN=Elasticsearch Test Node")); + assertThat(c.getSerialNumber(), Matchers.equalTo("7268203b")); assertThat(c.getPath(), Matchers.equalTo("testnode.jks")); assertThat(c.getFormat(), Matchers.equalTo("jks")); c = it.next(); - assertThat(c.getSubjectDn(), Matchers.equalTo("CN=samba4")); + assertThat(c.getSerialNumber(), Matchers.equalTo("3151a81eec8d4e34c56a8466a8510bcfbe63cc31")); assertThat(c.getPath(), Matchers.equalTo("testnode.jks")); assertThat(c.getFormat(), Matchers.equalTo("jks")); c = it.next(); - assertThat(c.getSubjectDn(), Matchers.equalTo("CN=Elasticsearch Test Node")); + assertThat(c.getSerialNumber(), Matchers.equalTo("223c736a")); assertThat(c.getPath(), Matchers.equalTo("testnode.jks")); assertThat(c.getFormat(), Matchers.equalTo("jks")); }