From 1999e32b6622ade455eae153191bd9b92d2b0c3e Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Wed, 21 Aug 2024 09:10:08 -0500 Subject: [PATCH] Update PKI CA test Previously if a client tries to connect to a server but it does not have the CA signing cert installed and trusted it will get an UNTRUSTED_ISSUER error from NSS. In the latest NSS the error has changed to UNKNOWN_ISSUER, so the test has been updated accordingly. --- .github/workflows/pki-ca-test.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pki-ca-test.yml b/.github/workflows/pki-ca-test.yml index 8f35d45fa..a26968a9a 100644 --- a/.github/workflows/pki-ca-test.yml +++ b/.github/workflows/pki-ca-test.yml @@ -142,7 +142,7 @@ jobs: # check stderr cat > expected << EOF - WARNING: UNTRUSTED ISSUER encountered on 'CN=pki.example.com,OU=pki-tomcat,O=EXAMPLE' indicates a non-trusted CA cert 'CN=CA Signing Certificate,OU=pki-tomcat,O=EXAMPLE' + WARNING: UNKNOWN_ISSUER encountered on 'CN=pki.example.com,OU=pki-tomcat,O=EXAMPLE' indicates an unknown CA cert 'CN=CA Signing Certificate,OU=pki-tomcat,O=EXAMPLE' Trust this certificate (y/N)? SEVERE: FATAL: SSL alert sent: BAD_CERTIFICATE IOException: Unable to write to socket: Failed to write to socket: (-5987) Invalid function argument. EOF @@ -169,8 +169,8 @@ jobs: # check stderr cat > expected << EOF + WARNING: UNKNOWN_ISSUER encountered on 'CN=pki.example.com,OU=pki-tomcat,O=EXAMPLE' indicates an unknown CA cert 'CN=CA Signing Certificate,OU=pki-tomcat,O=EXAMPLE' WARNING: BAD_CERT_DOMAIN encountered on 'CN=pki.example.com,OU=pki-tomcat,O=EXAMPLE' indicates a common-name mismatch - WARNING: UNTRUSTED ISSUER encountered on 'CN=pki.example.com,OU=pki-tomcat,O=EXAMPLE' indicates a non-trusted CA cert 'CN=CA Signing Certificate,OU=pki-tomcat,O=EXAMPLE' Trust this certificate (y/N)? SEVERE: FATAL: SSL alert sent: BAD_CERTIFICATE IOException: Unable to write to socket: Failed to write to socket: (-12276) Unable to communicate securely with peer: requested domain name does not match the server's certificate. EOF @@ -194,7 +194,7 @@ jobs: # check stderr cat > expected << EOF - WARNING: UNTRUSTED ISSUER encountered on 'CN=pki.example.com,OU=pki-tomcat,O=EXAMPLE' indicates a non-trusted CA cert 'CN=CA Signing Certificate,OU=pki-tomcat,O=EXAMPLE' + WARNING: UNKNOWN_ISSUER encountered on 'CN=pki.example.com,OU=pki-tomcat,O=EXAMPLE' indicates an unknown CA cert 'CN=CA Signing Certificate,OU=pki-tomcat,O=EXAMPLE' Trust this certificate (y/N)? EOF