Skip to content

tests: fix ssl generation #3365

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 14, 2025
Merged

tests: fix ssl generation #3365

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 36 additions & 7 deletions tests/Dockerfile-dind-certs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,17 +7,46 @@ RUN mkdir /tmp/certs
VOLUME /certs

WORKDIR /tmp/certs

# ---- CA (with proper v3_ca) ----
RUN openssl genrsa -aes256 -passout pass:foobar -out ca-key.pem 4096
RUN echo "[req]\nprompt=no\ndistinguished_name = req_distinguished_name\n[req_distinguished_name]\ncountryName=AU" > /tmp/config
RUN openssl req -new -x509 -passin pass:foobar -config /tmp/config -days 365 -key ca-key.pem -sha256 -out ca.pem
RUN openssl genrsa -out server-key.pem -passout pass:foobar 4096
COPY <<'EOF' /tmp/ca.cnf
[req]
prompt = no
distinguished_name = req_distinguished_name
x509_extensions = v3_ca

[req_distinguished_name]
countryName = AU

[v3_ca]
basicConstraints = critical, CA:TRUE
keyUsage = critical, keyCertSign, cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
EOF
RUN openssl req -new -x509 -passin pass:foobar -config /tmp/ca.cnf -days 365 -key ca-key.pem -sha256 -out ca.pem

# ---- Server cert (SAN + KU/EKU) ----
RUN openssl genrsa -out server-key.pem 4096
RUN openssl req -subj "/CN=docker" -sha256 -new -key server-key.pem -out server.csr
RUN echo subjectAltName = DNS:docker,DNS:localhost > extfile.cnf
RUN openssl x509 -req -days 365 -passin pass:foobar -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extfile extfile.cnf
COPY <<'EOF' /tmp/server-ext.cnf
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = DNS:docker, DNS:localhost
EOF
RUN openssl x509 -req -days 365 -passin pass:foobar -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extfile /tmp/server-ext.cnf

# ---- Client cert (KU/EKU) ----
RUN openssl genrsa -out key.pem 4096
RUN openssl req -passin pass:foobar -subj '/CN=client' -new -key key.pem -out client.csr
RUN echo extendedKeyUsage = clientAuth > extfile.cnf
RUN openssl x509 -req -passin pass:foobar -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile extfile.cnf
COPY <<'EOF' /tmp/client-ext.cnf
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature
extendedKeyUsage = clientAuth
EOF
RUN openssl x509 -req -passin pass:foobar -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile /tmp/client-ext.cnf
RUN chmod -v 0400 ca-key.pem key.pem server-key.pem
RUN chmod -v 0444 ca.pem server-cert.pem cert.pem

Expand Down