(t *testing.T)
| 8 | ) |
| 9 | |
| 10 | func TestNodeCA_IssueServerCert(t *testing.T) { |
| 11 | dir := t.TempDir() |
| 12 | ca, err := LoadOrCreateNodeCA(filepath.Join(dir, "ca.pem"), filepath.Join(dir, "ca.key")) |
| 13 | if err != nil { |
| 14 | t.Fatalf("create CA: %v", err) |
| 15 | } |
| 16 | |
| 17 | tlsCert, err := ca.IssueServerCert("pulse-grpc-server", []string{"localhost", "127.0.0.1"}, 24*time.Hour) |
| 18 | if err != nil { |
| 19 | t.Fatalf("IssueServerCert: %v", err) |
| 20 | } |
| 21 | if tlsCert.Leaf == nil { |
| 22 | t.Fatal("Leaf is nil") |
| 23 | } |
| 24 | if tlsCert.PrivateKey == nil { |
| 25 | t.Fatal("PrivateKey is nil") |
| 26 | } |
| 27 | if got := tlsCert.Leaf.Subject.CommonName; got != "pulse-grpc-server" { |
| 28 | t.Fatalf("CN = %q, want pulse-grpc-server", got) |
| 29 | } |
| 30 | if len(tlsCert.Leaf.DNSNames) != 1 || tlsCert.Leaf.DNSNames[0] != "localhost" { |
| 31 | t.Fatalf("DNSNames = %v", tlsCert.Leaf.DNSNames) |
| 32 | } |
| 33 | if len(tlsCert.Leaf.IPAddresses) != 1 || tlsCert.Leaf.IPAddresses[0].String() != "127.0.0.1" { |
| 34 | t.Fatalf("IPAddresses = %v", tlsCert.Leaf.IPAddresses) |
| 35 | } |
| 36 | // 验证由 CA 签发 |
| 37 | pool := ca.ClientCAPool() // CA cert pool（用作 root 也可，因是自签） |
| 38 | _, err = tlsCert.Leaf.Verify(x509.VerifyOptions{ |
| 39 | Roots: pool, |
| 40 | KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, |
| 41 | }) |
| 42 | if err != nil { |
| 43 | t.Fatalf("verify against CA: %v", err) |
| 44 | } |
| 45 | } |
| 46 | |
| 47 | func TestNodeCA_IssueServerCert_Validations(t *testing.T) { |
| 48 | dir := t.TempDir() |
nothing calls this directly
no test coverage detected