tests: Enable client certificate verification in the TLS tests #8211
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Add an option in the python test server to enable client certificate verification, since it was assumed to be on by some tests, but it wasn't. - Enable osquery_remote_transports_remotetransportstlstests-test on Windows, since it was incorrectly skipped. - Format test_http_server.py using black.
Smjert
force-pushed
the
stefano/tests/mtls-tests
branch
from
f2022e3 to
fb2504d
Compare
directionless
previously approved these changes
Dec 6, 2023
|
I think there's some differences in python 3.12 here on the CI. I was testing locally via Windows and it was working, but I do have python 3.10. |
Since TLS 1.3 and newer OpenSSL versions the strict check requires for certificates to have a key usage. Our test certificates did not - regenerate them. Also use the non deprecated flag in the server to select the protocol versions.
directionless
approved these changes
Dec 13, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add an option in the python test server to enable client certificate
verification, since it was assumed to be on by some tests,
but it wasn't.
Enable osquery_remote_transports_remotetransportstlstests-test
on Windows, since it was incorrectly skipped.
Format test_http_server.py using black.
Use the non deprecated flag in the server
to select the protocol versions
Regenerate test certificates to support strict checks with TLS 1.3 and OpenSSL 3.x