mirror of
https://github.com/certbot/certbot.git
synced 2026-08-02 03:11:55 +02:00
Fix the Nginx configuration during integration tests (#6801)
If you execute `tests/lock_test.py` or `tox -e integration` on a fairly recent machine, you will get the following error during tests executing against a live Nginx instance: ``` no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking, client: x.x.x.x, server: y:y:y:y:z ``` Indeed, having no defined ssl certificate for a ssl port would inevitably lead to an error during the handshake SSL process between a client and this mis-configured nginx instance. However it was not a problem one year before, because the handshake was not occurring in practice: the test just need to have a nginx started, and then immediately proceed to modify the configuration with a correct SSL setup. And nginx was able to start with a mis-configuration on SSL. But then this fix has been done: https://trac.nginx.org/nginx/ticket/178 Basically with this, validation of the configuration is done during nginx startup, that will refuse to start with invalid configuration on SSL. Consequently, all related tests are failing with a sufficiently up-to-date nginx. For now, it is not seen on Travis because Ubuntu Trusty is used, with an old Nginx. The PR fixes that, by generating on the fly self-signed certificates in the two impacted tests, and pushing the right parameters in the Nginx configuration. * Fix nginx configuration with self-signed certificates generated on the fly * Fix lint/mypy * Fix old cryptography * Unattended openssl * Update lock_test.py
This commit is contained in:
committed by
Brad Warren
parent
841f8efd0a
commit
7161e792e8
@@ -7,8 +7,12 @@ export PATH="/usr/sbin:$PATH" # /usr/sbin/nginx
|
||||
nginx_root="$root/nginx"
|
||||
mkdir $nginx_root
|
||||
|
||||
# Generate self-signed certificate for Nginx
|
||||
openssl req -new -newkey rsa:2048 -days 1 -nodes -x509 \
|
||||
-keyout $nginx_root/cert.key -out $nginx_root/cert.pem -subj "/CN=nginx.wtf"
|
||||
|
||||
reload_nginx () {
|
||||
original=$(root="$nginx_root" ./certbot-nginx/tests/boulder-integration.conf.sh)
|
||||
original=$(./certbot-nginx/tests/boulder-integration.conf.sh $nginx_root $nginx_root/cert.key $nginx_root/cert.pem)
|
||||
nginx_conf="$nginx_root/nginx.conf"
|
||||
echo "$original" > $nginx_conf
|
||||
|
||||
|
||||
Reference in New Issue
Block a user