ca-profile-caServerCert-test.yml

name: CA with caServerCert profile

on: workflow_call

env:
  DS_IMAGE: ${{ vars.DS_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v4

      - name: Retrieve PKI images
        uses: actions/cache@v4
        with:
          key: pki-images-${{ github.sha }}
          path: pki-images.tar

      - name: Load PKI images
        run: docker load --input pki-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up DS container
        run: |
          tests/bin/ds-create.sh \
              --image=${{ env.DS_IMAGE }} \
              --hostname=ds.example.com \
              --password=Secret.123 \
              ds

      - name: Connect DS container to network
        run: docker network connect example ds --alias ds.example.com

      - name: Set up PKI container
        run: |
          tests/bin/runner-init.sh pki
        env:
          HOSTNAME: pki.example.com

      - name: Connect PKI container to network
        run: docker network connect example pki --alias pki.example.com

      - name: Install CA
        run: |
          docker exec pki pkispawn \
              -f /usr/share/pki/server/examples/installation/ca.cfg \
              -s CA \
              -D pki_ds_url=ldap://ds.example.com:3389 \
              -v

      - name: Configure caServerCert profile
        run: |
          # allow user-specified SAN extension
          docker exec pki sed -i \
              -e "s/^\(policyset.serverCertSet.list\)=\(.*\)$/\1=\2,13/" \
              -e '$ a policyset.serverCertSet.13.constraint.class_id=noConstraintImpl' \
              -e '$ a policyset.serverCertSet.13.constraint.name=No Constraint' \
              -e '$ a policyset.serverCertSet.13.default.class_id=userExtensionDefaultImpl' \
              -e '$ a policyset.serverCertSet.13.default.name=User supplied extension in CSR' \
              -e '$ a policyset.serverCertSet.13.default.params.userExtOID=2.5.29.17' \
              /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caServerCert.cfg

          # require unique subject name
          docker exec pki sed -i \
              -e "s/^\(policyset.serverCertSet.list\)=\(.*\)$/\1=\2,14/" \
              -e '$ a policyset.serverCertSet.14.constraint.class_id=uniqueSubjectNameConstraintImpl' \
              -e '$ a policyset.serverCertSet.14.constraint.name=Unique Subject Name Constraint' \
              -e '$ a policyset.serverCertSet.14.default.class_id=noDefaultImpl' \
              -e '$ a policyset.serverCertSet.14.default.name=No Default' \
              /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caServerCert.cfg

          # check updated profile
          docker exec pki cat /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caServerCert.cfg

          docker exec pki pki-server ca-redeploy --wait

      - name: Set up CA admin
        run: |
          docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt

          docker exec pki pki nss-cert-import \
              --cert ca_signing.crt \
              --trust CT,C,C \
              ca_signing

          docker exec pki pki pkcs12-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password Secret.123

      - name: Create SSL server cert
        run: |
          # generate cert request
          docker exec pki pki \
              nss-cert-request \
              --subject "CN=server.example.com" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --subjectAltName "critical, DNS:www.example.com" \
              --csr sslserver.csr

          docker exec pki openssl req -text -noout -in sslserver.csr | tee output

          # verify SAN extension in cert request
          echo "X509v3 Subject Alternative Name: critical" > expected
          echo "DNS:www.example.com" >> expected
          sed -En 'N; s/^ *(X509v3 Subject Alternative Name: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual
          diff actual expected

          # issue cert
          docker exec pki pki \
              -n caadmin \
              ca-cert-issue \
              --profile caServerCert \
              --csr-file sslserver.csr \
              --output-file sslserver.crt

          docker exec pki openssl x509 -text -noout -in sslserver.crt | tee output

          # verfiy SAN extension in cert
          echo "X509v3 Subject Alternative Name: critical" > expected
          echo "DNS:www.example.com" >> expected
          sed -En 'N; s/^ *(X509v3 Subject Alternative Name: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual
          diff actual expected

      - name: Create SSL server cert with same subject name
        run: |
          # generate cert request
          docker exec pki pki \
              nss-cert-request \
              --subject "CN=server.example.com" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --subjectAltName "critical, DNS:pki.example.com" \
              --csr sslserver.csr

          docker exec pki openssl req -text -noout -in sslserver.csr | tee output

          # verify SAN extension
          echo "X509v3 Subject Alternative Name: critical" > expected
          echo "DNS:pki.example.com" >> expected
          sed -En 'N; s/^ *(X509v3 Subject Alternative Name: .*)\n *(.*)$/\1\n\2/p; D' output | tee actual
          diff actual expected

          # issue cert
          docker exec pki pki \
              -n caadmin \
              ca-cert-issue \
              --profile caServerCert \
              --csr-file sslserver.csr \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          # request should be rejected by UniqueSubjectNameConstraint
          cat > expected << EOF
          ERROR: Request rejected: Subject Name Not Unique CN=server.example.com
          EOF

          diff expected stderr

      - name: Remove CA
        run: docker exec pki pkidestroy -s CA -v

      - name: Check PKI server systemd journal
        if: always()
        run: |
          docker exec pki journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

      - name: Check CA debug log
        if: always()
        run: |
          docker exec pki find /var/lib/pki/pki-tomcat/logs/ca -name "debug.*" -exec cat {} \;

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh ds
          tests/bin/pki-artifacts-save.sh pki
        continue-on-error: true

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ca-profile-caServerCert
          path: /tmp/artifacts