newTestCertChain creates a fresh three-level certificate chain for testing. All certificates are valid at time.Now().
(t *testing.T)
| 135 | // newTestCertChain creates a fresh three-level certificate chain for |
| 136 | // testing. All certificates are valid at time.Now(). |
| 137 | func newTestCertChain(t *testing.T) testCertChain { |
| 138 | t.Helper() |
| 139 | |
| 140 | // Smaller key sizes are fine for tests; keeps them fast. |
| 141 | const keyBits = 2048 |
| 142 | |
| 143 | // ---- Root CA ---- |
| 144 | rootKey, err := rsa.GenerateKey(rand.Reader, keyBits) |
| 145 | require.NoError(t, err) |
| 146 | rootTmpl := &x509.Certificate{ |
| 147 | SerialNumber: big.NewInt(1), |
| 148 | Subject: pkix.Name{CommonName: "Test Root CA"}, |
| 149 | NotBefore: time.Now().Add(-time.Hour), |
| 150 | NotAfter: time.Now().Add(24 * time.Hour), |
| 151 | KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageCRLSign, |
| 152 | BasicConstraintsValid: true, |
| 153 | IsCA: true, |
| 154 | } |
| 155 | rootDER, err := x509.CreateCertificate(rand.Reader, rootTmpl, rootTmpl, &rootKey.PublicKey, rootKey) |
| 156 | require.NoError(t, err) |
| 157 | rootCert, err := x509.ParseCertificate(rootDER) |
| 158 | require.NoError(t, err) |
| 159 | |
| 160 | // ---- Intermediate CA ---- |
| 161 | intermediateKey, err := rsa.GenerateKey(rand.Reader, keyBits) |
| 162 | require.NoError(t, err) |
| 163 | intermediateTmpl := &x509.Certificate{ |
| 164 | SerialNumber: big.NewInt(2), |
| 165 | Subject: pkix.Name{CommonName: "Test Intermediate CA"}, |
| 166 | NotBefore: time.Now().Add(-time.Hour), |
| 167 | NotAfter: time.Now().Add(24 * time.Hour), |
| 168 | KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageCRLSign, |
| 169 | BasicConstraintsValid: true, |
| 170 | IsCA: true, |
| 171 | } |
| 172 | intermediateDER, err := x509.CreateCertificate(rand.Reader, intermediateTmpl, rootCert, &intermediateKey.PublicKey, rootKey) |
| 173 | require.NoError(t, err) |
| 174 | intermediateCert, err := x509.ParseCertificate(intermediateDER) |
| 175 | require.NoError(t, err) |
| 176 | |
| 177 | // ---- Signing (leaf) certificate ---- |
| 178 | signingKey, err := rsa.GenerateKey(rand.Reader, keyBits) |
| 179 | require.NoError(t, err) |
| 180 | signingTmpl := &x509.Certificate{ |
| 181 | SerialNumber: big.NewInt(3), |
| 182 | Subject: pkix.Name{CommonName: "metadata.azure.com"}, |
| 183 | NotBefore: time.Now().Add(-time.Hour), |
| 184 | NotAfter: time.Now().Add(24 * time.Hour), |
| 185 | KeyUsage: x509.KeyUsageDigitalSignature, |
| 186 | } |
| 187 | signingDER, err := x509.CreateCertificate(rand.Reader, signingTmpl, intermediateCert, &signingKey.PublicKey, intermediateKey) |
| 188 | require.NoError(t, err) |
| 189 | signingCert, err := x509.ParseCertificate(signingDER) |
| 190 | require.NoError(t, err) |
| 191 | |
| 192 | return testCertChain{ |
| 193 | RootCert: rootCert, |
| 194 | RootKey: rootKey, |
no test coverage detected