(t *testing.T)
| 32 | } |
| 33 | |
| 34 | func TestLoadOrCreateNodeCA_CreateThenReuse(t *testing.T) { |
| 35 | dir := t.TempDir() |
| 36 | certPath := filepath.Join(dir, "sub", "node_ca_cert.pem") |
| 37 | keyPath := filepath.Join(dir, "sub", "node_ca_key.pem") |
| 38 | |
| 39 | ca1, err := LoadOrCreateNodeCA(certPath, keyPath) |
| 40 | if err != nil { |
| 41 | t.Fatalf("first create: %v", err) |
| 42 | } |
| 43 | if ca1.cert.Subject.CommonName != "pulse-node-ca" { |
| 44 | t.Fatalf("CN = %q, want pulse-node-ca", ca1.cert.Subject.CommonName) |
| 45 | } |
| 46 | if !ca1.cert.IsCA || !ca1.cert.BasicConstraintsValid { |
| 47 | t.Fatalf("CA flags wrong") |
| 48 | } |
| 49 | if ca1.cert.KeyUsage&x509.KeyUsageCertSign == 0 { |
| 50 | t.Fatalf("missing KeyUsageCertSign") |
| 51 | } |
| 52 | if ca1.cert.KeyUsage&x509.KeyUsageCRLSign == 0 { |
| 53 | t.Fatalf("missing KeyUsageCRLSign") |
| 54 | } |
| 55 | if rsaKey, ok := ca1.key.(*rsa.PrivateKey); !ok { |
| 56 | t.Fatalf("key type %T, want *rsa.PrivateKey", ca1.key) |
| 57 | } else if rsaKey.N.BitLen() != 4096 { |
| 58 | t.Fatalf("key bits = %d, want 4096", rsaKey.N.BitLen()) |
| 59 | } |
| 60 | |
| 61 | ca2, err := LoadOrCreateNodeCA(certPath, keyPath) |
| 62 | if err != nil { |
| 63 | t.Fatalf("second load: %v", err) |
| 64 | } |
| 65 | if !ca1.cert.Equal(ca2.cert) { |
| 66 | t.Fatalf("reload returned different cert") |
| 67 | } |
| 68 | } |
| 69 | |
| 70 | func TestLoadOrCreateNodeCA_PartialFilesError(t *testing.T) { |
| 71 | dir := t.TempDir() |
nothing calls this directly
no test coverage detected