Function TestClientCertificateReloadOnServerRestart

test/conn_test.go:409–524

(t *testing.T)

}

func TestClientCertificateReloadOnServerRestart(t *testing.T) {
	copyFiles := func(t *testing.T, cpFiles map[string]string) {
		for from, to := range cpFiles {
			content, err := os.ReadFile(from)
			if err != nil {
				t.Fatalf("Error reading file: %s", err)
			}
			if err := os.WriteFile(to, content, 0640); err != nil {
				t.Fatalf("Error writing file: %s", err)
			}
		}
	}

	s, opts := RunServerWithConfig("./configs/tlsverify.conf")
	defer s.Shutdown()

	endpoint := fmt.Sprintf("%s:%d", opts.Host, opts.Port)
	secureURL := fmt.Sprintf("nats://%s", endpoint)

	tmpCertDir := t.TempDir()
	certFile := filepath.Join(tmpCertDir, "client-cert.pem")
	keyFile := filepath.Join(tmpCertDir, "client-key.pem")
	caFile := filepath.Join(tmpCertDir, "ca.pem")

	// copy valid cert files to tmp dir
	filesToCopy := map[string]string{
		"./configs/certs/client-cert.pem": certFile,
		"./configs/certs/client-key.pem":  keyFile,
		"./configs/certs/ca.pem":          caFile,
	}
	copyFiles(t, filesToCopy)

	dcChan, rcChan, errChan := make(chan bool, 1), make(chan bool, 1), make(chan error, 1)
	nc, err := nats.Connect(secureURL,
		nats.RootCAs(caFile),
		nats.ClientCert(certFile, keyFile),
		nats.ReconnectWait(100*time.Millisecond),
		nats.ErrorHandler(func(_ *nats.Conn, _ *nats.Subscription, err error) {
			errChan <- err
		}),
		nats.DisconnectErrHandler(func(_ *nats.Conn, _ error) {
			dcChan <- true
		}),
		nats.ReconnectHandler(func(_ *nats.Conn) {
			rcChan <- true
		}),
	)
	if err != nil {
		t.Fatalf("Failed to create (TLS) connection: %v", err)
	}
	defer nc.Close()

	// overwrite client certificate files with invalid ones, those
	// should be loaded on server restart
	filesToCopy = map[string]string{
		"./configs/certs/client-cert-invalid.pem": certFile,
		"./configs/certs/client-key-invalid.pem":  keyFile,
	}