1package pki_test
2
3import (
4 "crypto/x509"
5 "encoding/pem"
6 "os"
7 "path/filepath"
8 "testing"
9 "time"
10
11 "github.com/bnema/gordon/internal/adapters/out/pki"
12 "github.com/bnema/zerowrap"
13 "github.com/stretchr/testify/assert"
14 "github.com/stretchr/testify/require"
15)
16
17func testLogger() zerowrap.Logger {
18 return zerowrap.Default()
19}
20
21func TestNewCA_GeneratesRootAndIntermediate(t *testing.T) {
22 dir := t.TempDir()
23 ca, err := pki.NewCA(dir, testLogger())
24 require.NoError(t, err)
25
26 // Root cert exists on disk
27 rootPEM, err := os.ReadFile(filepath.Join(dir, "pki", "root.crt"))
28 require.NoError(t, err)
29 block, _ := pem.Decode(rootPEM)
30 require.NotNil(t, block)
31 rootCert, err := x509.ParseCertificate(block.Bytes)
32 require.NoError(t, err)
33 assert.True(t, rootCert.IsCA)
34 assert.Equal(t, rootCert.Issuer.CommonName, rootCert.Subject.CommonName) // self-signed
35
36 // Intermediate cert exists on disk
37 interPEM, err := os.ReadFile(filepath.Join(dir, "pki", "intermediate.crt"))
38 require.NoError(t, err)
39 block, _ = pem.Decode(interPEM)
40 require.NotNil(t, block)
41 interCert, err := x509.ParseCertificate(block.Bytes)
42 require.NoError(t, err)
43 assert.True(t, interCert.IsCA)
44 assert.NotEqual(t, interCert.Issuer.CommonName, interCert.Subject.CommonName) // signed by root
45
46 // Interface methods work
47 assert.NotEmpty(t, ca.RootCertificate())
48 assert.NotEmpty(t, ca.RootCertificateDER())
49 assert.NotEmpty(t, ca.RootFingerprint())
50 assert.NotEmpty(t, ca.RootCommonName())
51 assert.False(t, ca.IntermediateExpiresAt().IsZero())
52}
53
54func TestNewCA_LoadsExistingOnRestart(t *testing.T) {
55 dir := t.TempDir()
56
57 // First boot: generate
58 ca1, err := pki.NewCA(dir, testLogger())
59 require.NoError(t, err)
60 fp1 := ca1.RootFingerprint()
61
62 // Second boot: load
63 ca2, err := pki.NewCA(dir, testLogger())
64 require.NoError(t, err)
65 fp2 := ca2.RootFingerprint()
66
67 assert.Equal(t, fp1, fp2, "root CA should be the same across restarts")
68}
69
70func TestCA_IssueCertificate(t *testing.T) {
71 dir := t.TempDir()
72 ca, err := pki.NewCA(dir, testLogger())
73 require.NoError(t, err)
74
75 cert, err := ca.IssueCertificate("test.example.com")
76 require.NoError(t, err)
77 require.NotNil(t, cert)
78
79 // Parse the leaf cert
80 leaf, err := x509.ParseCertificate(cert.Certificate[0])
81 require.NoError(t, err)
82 assert.Equal(t, "test.example.com", leaf.Subject.CommonName)
83 assert.Contains(t, leaf.DNSNames, "test.example.com")
84 assert.False(t, leaf.IsCA)
85
86 // Verify chain: leaf -> intermediate -> root
87 rootPool := x509.NewCertPool()
88 rootPool.AppendCertsFromPEM(ca.RootCertificate())
89 interPool := x509.NewCertPool()
90 inter, err := x509.ParseCertificate(cert.Certificate[1])
91 require.NoError(t, err)
92 interPool.AddCert(inter)
93
94 _, err = leaf.Verify(x509.VerifyOptions{
95 Roots: rootPool,
96 Intermediates: interPool,
97 })
98 assert.NoError(t, err, "leaf cert should verify against root CA")
99}
100
101func TestCA_RenewIntermediate(t *testing.T) {
102 dir := t.TempDir()
103 ca, err := pki.NewCA(dir, testLogger())
104 require.NoError(t, err)
105
106 oldExpiry := ca.IntermediateExpiresAt()
107
108 // x509 timestamps have second precision, so we must cross
109 // a second boundary to observe a different NotAfter.
110 time.Sleep(1100 * time.Millisecond)
111
112 err = ca.RenewIntermediate()
113 require.NoError(t, err)
114
115 newExpiry := ca.IntermediateExpiresAt()
116 assert.True(t, newExpiry.After(oldExpiry), "renewed intermediate should have later expiry")
117
118 // Leaf certs should still work after renewal
119 cert, err := ca.IssueCertificate("after-renewal.example.com")
120 require.NoError(t, err)
121 require.NotNil(t, cert)
122}