starred/certbot-certbot
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-07-28 08:45:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update integration tests to account for default key type changed to ecdsa (#10546)

Browse Source 
Fixes #10423.

In
https://github.com/certbot/certbot/pull/10409#issuecomment-3180214385,
we noted that a comment in
`certbot-ci/src/certbot_integration_tests/certbot_tests/test_main.py:test_renew_with_ec_keys`
says:

> since ecdsa is now default, the integration test is not actually
testing "When running non-interactively, if --key-type is unspecified
but the default value differs to the lineage key type, Certbot should
keep the lineage key type." as it says in the comment. To fix that, it
should be initially created with rsa, not ecdsa.

That is no longer accurate, since the default key type changed to
ecdsda.

This PR adds a new test that does what the comment specifies, and
updates the comment to reflect that the existing test no longer does
that.
This commit is contained in:
ohemorange
2026-01-23 14:09:38 -08:00
committed by GitHub
parent 7d6c1e7732
commit 3b9a1d0d64
1 changed files with 28 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
certbot-ci/src/certbot_integration_tests/certbot_tests/test_main.py
+28 -3
View File
@@ -415,6 +415,29 @@ def test_renew_with_changed_private_key_complexity(context: IntegrationTestsCont
key3 = join(context.config_dir, 'archive', certname, 'privkey3.pem')
assert_rsa_key(key3, 2048)
def test_certonly_non_default_key_size_kept(context: IntegrationTestsContext) -> None:
"""Test that certonly keeps key type but uses default key size when unspecified."""
# create rsa 4096 key cert
certname = context.get_domain('renew')
context.certbot([
'certonly',
'--cert-name', certname,
'--key-type', 'rsa', '--rsa-key-size', '4096',
'--force-renewal', '-d', certname,
])
key1 = join(context.config_dir, "archive", certname, 'privkey1.pem')
assert_rsa_key(key1, 4096)
assert_cert_count_for_lineage(context.config_dir, certname, 1)
assert_saved_lineage_option(context.config_dir, certname, 'key_type', 'rsa')
# When running non-interactively, if --key-type is unspecified but the default value differs
# to the lineage key type, Certbot should keep the lineage key type. The key size will still
# change to the default value, in order to stay consistent with the behavior of certonly.
context.certbot(['certonly', '--force-renewal', '-d', certname])
key2 = join(context.config_dir, 'archive', certname, 'privkey2.pem')
assert_rsa_key(key2, 2048)
def test_renew_ignoring_directory_hooks(context: IntegrationTestsContext) -> None:
"""Test hooks are ignored during renewal with relevant CLI flag."""
@@ -742,6 +765,7 @@ def test_ecdsa_curves(context: IntegrationTestsContext, curve: str,
def test_renew_with_ec_keys(context: IntegrationTestsContext) -> None:
"""Test proper renew with updated private key complexity."""
# create ecdsa 256 key cert
certname = context.get_domain('renew')
context.certbot([
'certonly',
@@ -755,15 +779,16 @@ def test_renew_with_ec_keys(context: IntegrationTestsContext) -> None:
assert_cert_count_for_lineage(context.config_dir, certname, 1)
assert_saved_lineage_option(context.config_dir, certname, 'key_type', 'ecdsa')
# renew using 384 ecdsa key instead
context.certbot(['renew', '--elliptic-curve', 'secp384r1'])
assert_cert_count_for_lineage(context.config_dir, certname, 2)
key2 = join(context.config_dir, 'archive', certname, 'privkey2.pem')
assert 280 < os.stat(key2).st_size < 320 # ec keys of 384 bits are ~310 bytes
assert_elliptic_key(key2, SECP384R1)
# When running non-interactively, if --key-type is unspecified but the default value differs
# to the lineage key type, Certbot should keep the lineage key type. The curve will still
# change to the default value, in order to stay consistent with the behavior of certonly.
# When running non-interactively, if --key-type is unspecified, Certbot should keep the
# lineage key type. The curve will still change to the default value, in order to stay
# consistent with the behavior of certonly.
context.certbot(['certonly', '--force-renewal', '-d', certname])
key3 = join(context.config_dir, 'archive', certname, 'privkey3.pem')
assert 200 < os.stat(key3).st_size < 250 # ec keys of 256 bits are ~225 bytes