Initialize clean CSR inventory repository

scripts/test_local_tls.py

@@ -0,0 +1,54 @@
+import json
+from pathlib import Path
+import shutil
+import sys
+import tempfile
+import unittest
+
+from renew_local_tls import identity, openssl, renew
+
+
+class IdentityTests(unittest.TestCase):
+    def test_ip_and_dns_names(self):
+        self.assertEqual(identity("192.168.188.45"), ("192.168.188.45", "IP", "-verify_ip"))
+        self.assertEqual(identity("Inventory.Example.org")[0], "inventory.example.org")
+
+    def test_invalid_names_are_rejected(self):
+        for name in ("https://example.org", "example.org:443", "", "a\nsubjectAltName=DNS:evil", "*.example.org"):
+            with self.subTest(name=name), self.assertRaises(ValueError):
+                identity(name)
+
+
+@unittest.skipUnless(sys.platform != "win32" and shutil.which("openssl"), "Linux/OpenSSL required")
+class CertificateTests(unittest.TestCase):
+    def test_issue_reuse_and_renew_preserve_ca(self):
+        with tempfile.TemporaryDirectory() as directory:
+            project = Path(directory)
+            renew(project, "192.168.188.45")
+            ca = (project / "tls/ca/root.crt").read_bytes()
+            state = project / "tls/certs/current.json"
+            first = json.loads(state.read_text())
+            renew(project, "192.168.188.45")
+            self.assertEqual(first, json.loads(state.read_text()))
+            renew(project, "192.168.188.45", force=True)
+            second = json.loads(state.read_text())
+            self.assertNotEqual(first["serial"], second["serial"])
+            self.assertEqual(ca, (project / "tls/ca/root.crt").read_bytes())
+            self.assertIn(second["serial"], (project / "traefik/dynamic/tls.yml").read_text())
+            self.assertEqual((project / "tls/certs" / (second["serial"] + ".key")).stat().st_mode & 0o777, 0o600)
+            openssl("verify", "-CAfile", project / "tls/ca/root.crt", "-verify_ip", "192.168.188.45",
+                    project / "tls/certs" / (second["serial"] + ".crt"))
+
+    def test_incomplete_ca_is_not_overwritten(self):
+        with tempfile.TemporaryDirectory() as directory:
+            project = Path(directory)
+            ca = project / "tls/ca"
+            ca.mkdir(parents=True)
+            (ca / "root.key").write_text("existing key")
+            with self.assertRaises(RuntimeError):
+                renew(project, "192.168.188.45")
+            self.assertEqual((ca / "root.key").read_text(), "existing key")
+
+
+if __name__ == "__main__":
+    unittest.main()