diff options
| author | Péter Dimitrov <[email protected]> | 2019-01-10 16:34:56 +0100 |
|---|---|---|
| committer | Péter Dimitrov <[email protected]> | 2019-01-10 16:34:56 +0100 |
| commit | 82602f666daa29717ab936014a9ec1ffa3047813 (patch) | |
| tree | 3c8a3538d2fc37c60b5248fbd89958b3068c7e38 | |
| parent | 99e235762c021af7107e7c2e9f08c62a21d41f85 (diff) | |
| parent | 348483658478645e12127e888fd53aed45ad750f (diff) | |
| download | otp-82602f666daa29717ab936014a9ec1ffa3047813.tar.gz otp-82602f666daa29717ab936014a9ec1ffa3047813.tar.bz2 otp-82602f666daa29717ab936014a9ec1ffa3047813.zip | |
Merge branch 'peterdmv/ssl/fix-crl-suite' into maint
* peterdmv/ssl/fix-crl-suite:
ssl: Fix CRL suite with openssl-1.1.1a
Change-Id: I2847107b6cf0210c3002c016a6ba49288505d06f
| -rw-r--r-- | lib/ssl/test/make_certs.erl | 12 | ||||
| -rw-r--r-- | lib/ssl/test/ssl_crl_SUITE.erl | 7 |
2 files changed, 17 insertions, 2 deletions
diff --git a/lib/ssl/test/make_certs.erl b/lib/ssl/test/make_certs.erl index 8fe7c54549..7f3371da9a 100644 --- a/lib/ssl/test/make_certs.erl +++ b/lib/ssl/test/make_certs.erl @@ -189,6 +189,18 @@ gencrl(Root, CA, C, CrlHours) -> Env = [{"ROOTDIR", filename:absname(Root)}], cmd(Cmd, Env). +%% This function sets the number of seconds until the next CRL is due. +gencrl_sec(Root, CA, C, CrlSecs) -> + CACnfFile = filename:join([Root, CA, "ca.cnf"]), + CACRLFile = filename:join([Root, CA, "crl.pem"]), + Cmd = [C#config.openssl_cmd, " ca" + " -gencrl ", + " -crlsec ", integer_to_list(CrlSecs), + " -out ", CACRLFile, + " -config ", CACnfFile], + Env = [{"ROOTDIR", filename:absname(Root)}], + cmd(Cmd, Env). + can_generate_expired_crls(C) -> %% OpenSSL can generate CRLs with an expiration date in the past, %% if we pass a negative number for -crlhours. However, LibreSSL diff --git a/lib/ssl/test/ssl_crl_SUITE.erl b/lib/ssl/test/ssl_crl_SUITE.erl index 23c5eaf84d..c61039b5da 100644 --- a/lib/ssl/test/ssl_crl_SUITE.erl +++ b/lib/ssl/test/ssl_crl_SUITE.erl @@ -383,8 +383,11 @@ crl_hash_dir_expired(Config) when is_list(Config) -> {verify, verify_peer}], {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config), - %% First make a CRL that expired yesterday. - make_certs:gencrl(PrivDir, CA, CertsConfig, -24), + %% First make a CRL that will expire in one second. + make_certs:gencrl_sec(PrivDir, CA, CertsConfig, 1), + %% Sleep until the next CRL is due + ct:sleep({seconds, 1}), + CrlDir = filename:join(PrivDir, "crls"), populate_crl_hash_dir(PrivDir, CrlDir, [{CA, "1627b4b0"}], |