Skip to content

Commit 2f3e5da

Browse files
timkimbertimkimber
committed
Improved test script (http01 and dns01)
1 parent 5296a07 commit 2f3e5da

11 files changed

Lines changed: 263 additions & 24 deletions

‎dns_scripts/dns_add_challtestsrv‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/usr/bin/env bash
2+
# Simple script to update the challtestserv mock DNS server when testing DNS responses
3+
4+
fulldomain="${1}"
5+
token="${2}"
6+
7+
curl -X POST -d "{\"host\":\"_acme-challenge.${fulldomain}.\", \"value\": \"${token}\"}" http://10.30.50.3:8055/set-txt

‎dns_scripts/dns_del_challtestsrv‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/usr/bin/env bash
2+
# Simple script to update the challtestserv mock DNS server when testing DNS responses
3+
4+
fulldomain="${1}"
5+
6+
curl -X POST -d "{\"host\":\"_acme-challenge.${fulldomain}.\"}" http://10.30.50.3:8055/clear-txt

‎docker-compose.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ services:
33
pebble:
44
image: letsencrypt/pebble:latest
55
# TODO enable -strict
6-
command: pebble -config /test/config/pebble-config.json
6+
command: pebble -config /test/config/pebble-config.json -dnsserver 10.30.50.3:8053
77
environment:
88
# with Go 1.13.x which defaults TLS 1.3 to on
99
GODEBUG: "tls13=1"
@@ -13,10 +13,18 @@ services:
1313
networks:
1414
acmenet:
1515
ipv4_address: 10.30.50.2
16+
challtestsrv:
17+
image: letsencrypt/pebble-challtestsrv:latest
18+
command: pebble-challtestsrv -defaultIPv6 "" -defaultIPv4 10.30.50.3
19+
ports:
20+
- 8055:8055 # HTTP Management API
21+
networks:
22+
acmenet:
23+
ipv4_address: 10.30.50.3
1624
getssl:
1725
build:
1826
context: .
19-
dockerfile: test/Dockerfile
27+
dockerfile: test/Dockerfile-ubuntu
2028
container_name: getssl
2129
volumes:
2230
- .:/getssl

‎getssl‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -288,7 +288,8 @@ check_challenge_completion() { # checks with the ACME server if our challenge is
288288
fi
289289
else # APIv2
290290
if [[ -n "$code" ]] && [[ ! "$code" == '200' ]] ; then
291-
error_exit "$domain:Challenge error: $code"
291+
detail=$(json_get "$response" detail)
292+
error_exit "$domain:Challenge error: $code:Detail: $detail"
292293
fi
293294
fi
294295

@@ -1323,7 +1324,6 @@ set_server_type() { # uses SERVER_TYPE to set REMOTE_PORT and REMOTE_EXTRA
13231324
REMOTE_PORT=636
13241325
elif [[ ${SERVER_TYPE} =~ ^[0-9]+$ ]]; then
13251326
REMOTE_PORT=${SERVER_TYPE}
1326-
REMOTE_EXTRA="CUSTOM-HTTP-PORT"
13271327
else
13281328
info "${DOMAIN}: unknown server type \"$SERVER_TYPE\" in SERVER_TYPE"
13291329
config_errors=true
@@ -2282,11 +2282,7 @@ for d in $alldomains; do
22822282
done
22832283
umask "$ORIG_UMASK"
22842284

2285-
if [[ "$REMOTE_EXTRA" = "CUSTOM-HTTP-PORT" ]]; then
2286-
wellknown_url="${CHALLENGE_CHECK_TYPE}://${d}:${REMOTE_PORT}/.well-known/acme-challenge/$token"
2287-
else
2288-
wellknown_url="${CHALLENGE_CHECK_TYPE}://${d}/.well-known/acme-challenge/$token"
2289-
fi
2285+
wellknown_url="${CHALLENGE_CHECK_TYPE}://${d}/.well-known/acme-challenge/$token"
22902286
debug wellknown_url "$wellknown_url"
22912287

22922288
if [[ "$SKIP_HTTP_TOKEN_CHECK" == "true" ]]; then
@@ -2522,13 +2518,17 @@ fi
25222518
if [[ ${CHECK_REMOTE} == "true" ]]; then
25232519
sleep "$CHECK_REMOTE_WAIT"
25242520
# shellcheck disable=SC2086
2521+
debug openssl s_client -servername "${DOMAIN}" -connect "${DOMAIN}:${REMOTE_PORT}" ${REMOTE_EXTRA}
2522+
25252523
CERT_REMOTE=$(echo \
25262524
| openssl s_client -servername "${DOMAIN}" -connect "${DOMAIN}:${REMOTE_PORT}" ${REMOTE_EXTRA} 2>/dev/null \
25272525
| openssl x509 -noout -fingerprint 2>/dev/null)
25282526
CERT_LOCAL=$(openssl x509 -noout -fingerprint < "$CERT_FILE" 2>/dev/null)
25292527
if [[ "$CERT_LOCAL" == "$CERT_REMOTE" ]]; then
25302528
info "${DOMAIN} - certificate installed OK on server"
25312529
else
2530+
debug Fingerprint on server ${CERT_REMOTE}
2531+
debug Fingerprint in file ${CERT_LOCAL}
25322532
error_exit "${DOMAIN} - certificate obtained but certificate on server is different from the new certificate"
25332533
fi
25342534
fi

‎test/Dockerfile-rhel6‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
FROM roboxes/rhel6
2+
# FROM centos:centos6
3+
# bionic = latest 18 version
4+
5+
# Update and install required software
6+
RUN yum -y update
7+
RUN yum -y install epel-release
8+
RUN yum -y install git curl dnsutils wget # nginx-light
9+
10+
WORKDIR /root
11+
#RUN mkdir /etc/nginx/pki
12+
#RUN mkdir /etc/nginx/pki/private
13+
#COPY ./test/test-config/nginx-ubuntu-sites-enabled-default /etc/nginx/sites-enabled/default
14+
15+
# BATS (Bash Automated Testings)
16+
# RUN git clone https://github.com/bats-core/bats-core.git
17+
# RUN bats-core/install.sh /usr/local
18+
19+
EXPOSE 80 443
20+
21+
# Run eternal loop - for testing
22+
CMD ["/bin/bash", "-c", "while :; do sleep 10; done"]
23+
24+
# with Pebble
25+
# docker-compose -f "docker-compose.yml" up -d --build
26+
# docker exec -it getssl /bin/bash
27+
# /getssl/test/run-test.sh

test/Dockerfile renamed to test/Dockerfile-ubuntu

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,28 @@
1-
FROM ubuntu:bionic
1+
FROM ubuntu:xenial
22
# bionic = latest 18 version
33

44
# Update and install required software
55
RUN apt-get update
66
# TODO work out why default version of awk fails
7-
RUN apt-get install -y git curl dnsutils wget linux-libc-dev make gcc binutils nginx-light gawk
7+
RUN apt-get install -y git curl dnsutils wget gawk nginx-light # linux-libc-dev make gcc binutils
88
RUN apt-get install -y vim dos2unix # for debugging
99
# TODO test with drill, dig, host
1010

1111
WORKDIR /root
1212
RUN mkdir /etc/nginx/pki
1313
RUN mkdir /etc/nginx/pki/private
14-
COPY ./test/test-config/nginx-ubuntu-sites-enabled-default /etc/nginx/sites-enabled/default
14+
COPY ./test/test-config/nginx-ubuntu-no-ssl /etc/nginx/sites-enabled/default
1515

1616
# BATS (Bash Automated Testings)
1717
# RUN git clone https://github.com/bats-core/bats-core.git
1818
# RUN bats-core/install.sh /usr/local
1919

20-
COPY test/test-config/getssl-ubuntu.cfg getssl.cfg
21-
2220
EXPOSE 80 443
2321

2422
# Run eternal loop - for testing
2523
CMD ["/bin/bash", "-c", "while :; do sleep 10; done"]
2624

2725
# with Pebble
28-
# docker-compose -f "test\docker-compose.yml" up -d --build
29-
# docker exec -it test_getssl /bin/bash
26+
# docker-compose -f "docker-compose.yml" up -d --build
27+
# docker exec -it getssl /bin/bash
3028
# /getssl/test/run-test.sh

‎test/run-test.sh‎

Lines changed: 42 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,47 @@
1-
#! /bin/sh
1+
#! /bin/bash
2+
3+
set -e
4+
5+
# Test setup
6+
rm -r /root/.getssl
27

38
wget --no-clobber https://raw.githubusercontent.com/letsencrypt/pebble/master/test/certs/pebble.minica.pem
4-
export CURL_CA_BUNDLE=/root/pebble.minica.pem
9+
# cat /etc/pki/tls/certs/ca-bundle.crt /root/pebble.minica.pem > /root/pebble-ca-bundle.crt
10+
cat /etc/ssl/certs/ca-certificates.crt /root/pebble.minica.pem > /root/pebble-ca-bundle.crt
11+
export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
12+
13+
curl -X POST -d '{"host":"getssl", "addresses":["10.30.50.4"]}' http://10.30.50.3:8055/add-a
14+
15+
# Test #1 - http-01 verification
16+
echo Test \#1 - http-01 verification
517

6-
service nginx start
18+
cp /getssl/test/test-config/nginx-ubuntu-no-ssl /etc/nginx/sites-enabled/default
19+
service nginx restart
720
/getssl/getssl -c getssl
8-
cp getssl.cfg /root/.getssl/getssl
21+
cp /getssl/test/test-config/getssl-http01.cfg /root/.getssl/getssl/getssl.cfg
22+
/getssl/getssl -f getssl
23+
24+
# Test #2 - http-01 forced renewal
25+
echo Test \#2 - http-01 forced renewal
26+
27+
sleep 5 # There's a race condition if renew too soon (authlink returns "valid" instead of "pending")
28+
/getssl/getssl getssl -f
29+
30+
# Test cleanup
31+
32+
rm -r /root/.getssl
33+
34+
# Test #3 - dns-01 verification
35+
echo Test \#3 - dns-01 verification
36+
37+
cp /getssl/test/test-config/nginx-ubuntu-no-ssl /etc/nginx/sites-enabled/default
38+
service nginx restart
39+
/getssl/getssl -c getssl
40+
cp /getssl/test/test-config/getssl-dns01.cfg /root/.getssl/getssl/getssl.cfg
941
/getssl/getssl getssl
42+
43+
# Test #4 - dns-01 forced renewal
44+
echo Test \#4 - dns-01 forced renewal
45+
46+
sleep 5 # There's a race condition if renew too soon (authlink returns "valid" instead of "pending")
47+
/getssl/getssl getssl -f

‎test/test-config/getssl-dns01.cfg‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Uncomment and modify any variables you need
2+
# see https://github.com/srvrco/getssl/wiki/Config-variables for details
3+
# see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
4+
#
5+
# The staging server is best for testing
6+
#CA="https://acme-staging.api.letsencrypt.org"
7+
# This server issues full certificates, however has rate limits
8+
#CA="https://acme-v01.api.letsencrypt.org"
9+
CA="https://pebble:14000/dir"
10+
11+
VALIDATE_VIA_DNS=true
12+
DNS_ADD_COMMAND="/getssl/dns_scripts/dns_add_challtestsrv"
13+
DNS_DEL_COMMAND="/getssl/dns_scripts/dns_del_challtestsrv"
14+
# AUTH_DNS_SERVER=10.30.50.3
15+
16+
#PRIVATE_KEY_ALG="rsa"
17+
18+
# Additional domains - this could be multiple domains / subdomains in a comma separated list
19+
# Note: this is Additional domains - so should not include the primary domain.
20+
SANS=""
21+
22+
# Acme Challenge Location. The first line for the domain, the following ones for each additional domain.
23+
# If these start with ssh: then the next variable is assumed to be the hostname and the rest the location.
24+
# An ssh key will be needed to provide you with access to the remote server.
25+
# Optionally, you can specify a different userid for ssh/scp to use on the remote server before the @ sign.
26+
# If left blank, the username on the local server will be used to authenticate against the remote server.
27+
# If these start with ftp: then the next variables are ftpuserid:ftppassword:servername:ACL_location
28+
# These should be of the form "/path/to/your/website/folder/.well-known/acme-challenge"
29+
# where "/path/to/your/website/folder/" is the path, on your web server, to the web root for your domain.
30+
ACL=('/var/www/html/.well-known/acme-challenge')
31+
# 'ssh:server5:/var/www/getssltest.hopto.org/web/.well-known/acme-challenge'
32+
# 'ssh:sshuserid@server5:/var/www/getssltest.hopto.org/web/.well-known/acme-challenge'
33+
# 'ftp:ftpuserid:ftppassword:getssltest.hopto.org:/web/.well-known/acme-challenge')
34+
35+
#Set USE_SINGLE_ACL="true" to use a single ACL for all checks
36+
USE_SINGLE_ACL="false"
37+
38+
# Location for all your certs, these can either be on the server (full path name)
39+
# or using ssh /sftp as for the ACL
40+
DOMAIN_CERT_LOCATION="/etc/nginx/pki/server.crt"
41+
DOMAIN_KEY_LOCATION="/etc/nginx/pki/private/server.key"
42+
CA_CERT_LOCATION="/etc/nginx/pki/chain.crt"
43+
DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
44+
DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
45+
46+
# The command needed to reload apache / nginx or whatever you use
47+
RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl /etc/nginx/sites-enabled/default && service nginx restart"
48+
49+
# Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,
50+
# smtps_deprecated, smtps, smtp_submission, xmpp, xmpps, ldaps or a port number which
51+
# will be checked for certificate expiry and also will be checked after
52+
# an update to confirm correct certificate is running (if CHECK_REMOTE) is set to true
53+
#SERVER_TYPE="https"
54+
#CHECK_REMOTE="true"

test/test-config/getssl-ubuntu.cfg renamed to test/test-config/getssl-http01.cfg

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,11 @@
77
# This server issues full certificates, however has rate limits
88
#CA="https://acme-v01.api.letsencrypt.org"
99
CA="https://pebble:14000/dir"
10-
SERVER_TYPE="5002"
10+
11+
#VALIDATE_VIA_DNS=true
12+
#DNS_ADD_COMMAND="/getssl/dns_scripts/dns_add_challtestsrv"
13+
#DNS_DEL_COMMAND="/getssl/dns_scripts/dns_del_challtestsrv"
14+
1115
#PRIVATE_KEY_ALG="rsa"
1216

1317
# Additional domains - this could be multiple domains / subdomains in a comma separated list
@@ -39,7 +43,7 @@ DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
3943
DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
4044

4145
# The command needed to reload apache / nginx or whatever you use
42-
RELOAD_CMD="service nginx restart"
46+
RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl /etc/nginx/sites-enabled/default && service nginx restart"
4347

4448
# Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,
4549
# smtps_deprecated, smtps, smtp_submission, xmpp, xmpps, ldaps or a port number which

test/test-config/nginx-ubuntu-sites-enabled-default renamed to test/test-config/nginx-ubuntu-no-ssl

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,18 @@
1414
# Default server configuration
1515
#
1616
server {
17+
listen 80 default_server;
1718
listen 5002 default_server;
1819
listen [::]:5002 default_server;
1920

2021
# SSL configuration
2122
#
22-
listen 5001 ssl default_server;
23-
listen [::]:5001 ssl default_server;
23+
listen 443 default_server;
24+
listen [::]:443 default_server;
25+
26+
listen 5001 default_server;
27+
listen [::]:5001 default_server;
28+
2429
#
2530
# Note: You should disable gzip for SSL traffic.
2631
# See: https://bugs.debian.org/773332

0 commit comments

Comments
 (0)