Update ct_helper #7821
Update ct_helper #7821
Conversation
Since ct_helper removes erl_make_certs some tests needed to be updated to use public_key:pkix_test_data/1 instead.
essen
force-pushed
the
lh-update-ct-helper
branch
from
924ce52 to
53c6d19
Compare
|
|
||
| TestDataTrusted = public_key:pkix_test_data(#{ | ||
| root => [], | ||
| intermediaries => [[{key, KeyInter}]], |
There was a problem hiding this comment.
Looking at public_key:chain_opts() I think this should be intermediates. It looks like it's also expecting the dec key:
| intermediaries => [[{key, KeyInter}]], | |
| intermediates => [[{key, KeyInterDec}]], |
This will also add a new cert to the cacerts list on L340
There was a problem hiding this comment.
Hah, this explains a few things I didn't understand.
| [CertInter, RootCA] = proplists:get_value(cacerts, TestDataTrusted), | ||
|
|
||
| TestDataUntrusted = public_key:pkix_test_data(#{ | ||
| root => [#{cert => CertInter, key => KeyInter}], |
There was a problem hiding this comment.
It looks like this is expecting a proplist or a map: https://github.com/erlang/otp/blob/e599897f91ca5f05b4d868c6776efad7e6c1ad8d/lib/public_key/src/pubkey_cert.erl#L505-L523. (pubkey_cert:root_cert/2 tries to get the key out of this with proplists:get/3.)
It also looks like this one expects the dec key:
| root => [#{cert => CertInter, key => KeyInter}], | |
| root => [{cert, CertInter}, {key, KeyInterDec}], |
Or alternatively I think this should work:
| root => [#{cert => CertInter, key => KeyInter}], | |
| root => #{cert => CertInter, key => KeyInterDec}, |
There was a problem hiding this comment.
The map is correct, just not fully documented. It's how you can pass the root certificate from pkix_test_root_cert. Interesting I didn't get a crash because of the list though.
|
Pushed a commit with the fixes. Noticed the root CA is returned twice in |
the-mikedavis
left a comment
the-mikedavis
left a comment
There was a problem hiding this comment.
Looks great, thanks for updating this!
Update ct_helper (backport #7821)
Since ct_helper removes erl_make_certs some tests needed to be updated to use public_key:pkix_test_data/1 instead.
Special care must be taken during review around the long chain test since we expect the trusted and untrusted certificates to be using the same chain (they are issued by the same intermediary certificate).