|
| 1 | +#!/bin/bash |
| 2 | + |
| 3 | +## Test for single domain certificates. |
| 4 | + |
| 5 | +if [[ -z $TRAVIS_CI ]]; then |
| 6 | + le_container_name="$(basename ${0%/*})_$(date "+%Y-%m-%d_%H.%M.%S")" |
| 7 | +else |
| 8 | + le_container_name="$(basename ${0%/*})" |
| 9 | +fi |
| 10 | +run_le_container ${1:?} "$le_container_name" |
| 11 | + |
| 12 | +# Create the $domains array from comma separated domains in TEST_DOMAINS. |
| 13 | +IFS=',' read -r -a domains <<< "$TEST_DOMAINS" |
| 14 | + |
| 15 | +# Cleanup function with EXIT trap |
| 16 | +function cleanup { |
| 17 | + # Cleanup the files created by this run of the test to avoid foiling following test(s). |
| 18 | + docker exec "$le_container_name" sh -c 'rm -rf /etc/nginx/certs/default.*' |
| 19 | + docker stop "$le_container_name" > /dev/null |
| 20 | +} |
| 21 | +trap cleanup EXIT |
| 22 | + |
| 23 | +function default_cert_fingerprint { |
| 24 | + docker exec "$le_container_name" openssl x509 -in "/etc/nginx/certs/default.crt" -fingerprint -noout |
| 25 | +} |
| 26 | + |
| 27 | +function default_cert_subject { |
| 28 | + docker exec "$le_container_name" openssl x509 -in "/etc/nginx/certs/default.crt" -subject -noout |
| 29 | +} |
| 30 | + |
| 31 | +user_cn="user-provided" |
| 32 | + |
| 33 | +i=0 |
| 34 | +until docker exec "$le_container_name" [[ -f /etc/nginx/certs/default.crt ]]; do |
| 35 | + if [ $i -gt 60 ]; then |
| 36 | + echo "Default cert wasn't created under one minute at container first launch." |
| 37 | + fi |
| 38 | + i=$((i + 2)) |
| 39 | + sleep 2 |
| 40 | +done |
| 41 | + |
| 42 | +# Connection test to unconfigured domains |
| 43 | +for domain in "${domains[@]}"; do |
| 44 | + wait_for_conn --domain "$domain" --default-cert |
| 45 | +done |
| 46 | + |
| 47 | +# Test if the default certificate get re-created when |
| 48 | +# the certificate or private key file are deleted |
| 49 | +for file in 'default.key' 'default.crt'; do |
| 50 | + old_default_cert_fingerprint="$(default_cert_fingerprint)" |
| 51 | + docker exec "$le_container_name" rm -f /etc/nginx/certs/$file |
| 52 | + docker restart "$le_container_name" > /dev/null && sleep 5 |
| 53 | + i=0 |
| 54 | + while [[ "$(default_cert_fingerprint)" == "$old_default_cert_fingerprint" ]]; do |
| 55 | + if [ $i -gt 55 ]; then |
| 56 | + echo "Default cert wasn't re-created under one minute after $file deletion." |
| 57 | + break |
| 58 | + fi |
| 59 | + i=$((i + 2)) |
| 60 | + sleep 2 |
| 61 | + done |
| 62 | +done |
| 63 | + |
| 64 | +# Test if the default certificate get re-created when |
| 65 | +# the certificate expire in less than three months |
| 66 | +docker exec "$le_container_name" sh -c 'rm -rf /etc/nginx/certs/default.*' |
| 67 | +docker exec "$le_container_name" openssl req -x509 \ |
| 68 | + -newkey rsa:4096 -sha256 -nodes -days 60 \ |
| 69 | + -subj "/CN=letsencrypt-nginx-proxy-companion" \ |
| 70 | + -keyout /etc/nginx/certs/default.key \ |
| 71 | + -out /etc/nginx/certs/default.crt > /dev/null 2>&1 |
| 72 | +old_default_cert_fingerprint="$(default_cert_fingerprint)" |
| 73 | +docker restart "$le_container_name" > /dev/null && sleep 5 |
| 74 | +i=0 |
| 75 | +while [[ "$(default_cert_fingerprint)" == "$old_default_cert_fingerprint" ]]; do |
| 76 | + if [ $i -gt 55 ]; then |
| 77 | + echo "Default cert wasn't re-created under one minute when the certificate expire in less than three months." |
| 78 | + break |
| 79 | + fi |
| 80 | + i=$((i + 2)) |
| 81 | + sleep 2 |
| 82 | +done |
| 83 | + |
| 84 | +# Test that a user provided default certificate isn't overwrited |
| 85 | +docker exec "$le_container_name" sh -c 'rm -rf /etc/nginx/certs/default.*' |
| 86 | +docker exec "$le_container_name" openssl req -x509 \ |
| 87 | + -newkey rsa:4096 -sha256 -nodes -days 60 \ |
| 88 | + -subj "/CN=$user_cn" \ |
| 89 | + -keyout /etc/nginx/certs/default.key \ |
| 90 | + -out /etc/nginx/certs/default.crt > /dev/null 2>&1 |
| 91 | +docker restart "$le_container_name" > /dev/null |
| 92 | + |
| 93 | +# Connection test to unconfigured domains |
| 94 | +for domain in "${domains[@]}"; do |
| 95 | + wait_for_conn --domain "$domain" --subject-match "$user_cn" |
| 96 | +done |
0 commit comments