diff options
| author | Marc A. Paradise <marc.paradise@gmail.com> | 2021-09-27 14:00:45 -0400 |
|---|---|---|
| committer | Marc A. Paradise <marc.paradise@gmail.com> | 2021-09-27 16:04:55 -0400 |
| commit | 7485cf079c8b60e4600a03b03f6ef00cb0d89495 (patch) | |
| tree | ec82a47e23dfe36e15d44f83f59da2cfddf1802a | |
| parent | 092b0ea9fb7952b9a09aa13d1e67346a34c97ecd (diff) | |
| download | chef-7485cf079c8b60e4600a03b03f6ef00cb0d89495.tar.gz | |
Check for ca_key_file before loading ca keymp/chef-12091
Checking for csr_file wasn't correct, because that's not what we're
using to load the ca key.
This also adds an inspec verification to ensure that the generated
`openssl_x509_certificate` in the _openssl.rb test is valid. It fails
without the supporting change.
Signed-off-by: Marc A. Paradise <marc.paradise@gmail.com>
| -rw-r--r-- | cspell.json | 1 | ||||
| -rw-r--r-- | kitchen-tests/test/integration/end-to-end/_openssl.rb | 6 | ||||
| -rw-r--r-- | lib/chef/resource/openssl_x509_certificate.rb | 2 |
3 files changed, 8 insertions, 1 deletions
diff --git a/cspell.json b/cspell.json index 4c974d6a80..66c26b91d6 100644 --- a/cspell.json +++ b/cspell.json @@ -27,6 +27,7 @@ "ADMINI", "adminonly", "advapi", + "Afile", "Afonov", "agrs", "airgapped", diff --git a/kitchen-tests/test/integration/end-to-end/_openssl.rb b/kitchen-tests/test/integration/end-to-end/_openssl.rb new file mode 100644 index 0000000000..c68889f3bb --- /dev/null +++ b/kitchen-tests/test/integration/end-to-end/_openssl.rb @@ -0,0 +1,6 @@ +# Reference recipes/_openssl.rb test to 'generate and sign a certificate with the CA' +# This ensures that the generated certificate is valid. +describe command("/opt/chef/embedded/bin/openssl verify -CAfile /etc/ssl_test/my_ca.crt /etc/ssl_test/my_signed_cert.crt") do + its("stdout") { should match /my_signed_cert.*OK/ } + its("stderr") { should be_empty } +end diff --git a/lib/chef/resource/openssl_x509_certificate.rb b/lib/chef/resource/openssl_x509_certificate.rb index a6e0eb97f2..8d5ca2b9fa 100644 --- a/lib/chef/resource/openssl_x509_certificate.rb +++ b/lib/chef/resource/openssl_x509_certificate.rb @@ -226,7 +226,7 @@ class Chef end def ca_private_key - if new_resource.csr_file.nil? + if new_resource.ca_key_file.nil? key else OpenSSL::PKey.read ::File.read(new_resource.ca_key_file), new_resource.ca_key_pass |