Add an option to use certifications generated from localhost.

In the Fedora project, we are running the mysql2 tests on the build environment
with a user permission, without root permission and without `sudo`.

In this case, we couldn't set up the custom domain "mysql2gem.example.com"
required to run SSL tests. This feature to create a set of the certifications
from the localhost gives an option to run the SSL tests executed in the environment.

How to generate the certificaton files:

```
$ cd spec/ssl/
$ bash gen_certs.sh
```

The files are generated in the `spec/ssl/<host name>`. Added the new files
generated from the domain localhost in the `spec/ssl/localhost`.

How to use:

```
$ TEST_RUBY_MYSQL2_SSL_CERT_HOST=localhost \
  bundle exec rake spec
```

Author: junaruga

.github/workflows/container.yml

@@ -16,7 +16,7 @@ jobs:
           # Fedora latest stable version
           - {distro: fedora, image: 'fedora:latest'}
           # Fedora development version
-          - {distro: fedora, image: 'fedora:rawhide'}
+          - {distro: fedora, image: 'fedora:rawhide', ssl_cert_host: 'localhost'}
       # On the fail-fast: true, it cancels all in-progress jobs
       # if any matrix job fails unlike Travis fast_finish.
       fail-fast: false
@@ -27,4 +27,10 @@ jobs:
       # as a temporary workaround to avoid the following issue
       # in the Fedora >= 34 containers.
       # https://bugzilla.redhat.com/show_bug.cgi?id=1900021
-      - run: docker run --add-host=mysql2gem.example.com:127.0.0.1 -t --cap-add=SYS_PTRACE --security-opt seccomp=unconfined mysql2
+      - run: |
+          docker run \
+            --add-host=mysql2gem.example.com:127.0.0.1 \
+            -t \
+            -e TEST_RUBY_MYSQL2_SSL_CERT_HOST="${{ matrix.ssl_cert_host || '' }}" \
+            --cap-add=SYS_PTRACE --security-opt seccomp=unconfined \
+            mysql2

ci/ssl.sh

@@ -2,11 +2,14 @@
 
 set -eux
 
+# TEST_RUBY_MYSQL2_SSL_CERT_HOST: custom host for the SSL certificates.
+SSL_CERT_HOST=${TEST_RUBY_MYSQL2_SSL_CERT_HOST:-mysql2gem.example.com}
+
 # Make sure there is an /etc/mysql
 mkdir -p /etc/mysql
 
 # Copy the local certs to /etc/mysql
-cp spec/ssl/*pem /etc/mysql/
+cp spec/ssl/${SSL_CERT_HOST}/*pem /etc/mysql/
 
 # Wherever MySQL configs live, go there (this is for cross-platform)
 cd $(my_print_defaults --help | grep my.cnf | xargs find 2>/dev/null | xargs dirname)

spec/mysql2/client_spec.rb

@@ -153,7 +153,7 @@ def connect(*args)
 
     let(:option_overrides) do
       {
-        'host'     => 'mysql2gem.example.com', # must match the certificates
+        'host'     => ssl_cert_host, # must match the certificates
         :sslkey    => '/etc/mysql/client-key.pem',
         :sslcert   => '/etc/mysql/client-cert.pem',
         :sslca     => '/etc/mysql/ca-cert.pem',

spec/spec_helper.rb

@@ -60,6 +60,18 @@ def clock_time
     end
   end
 
+  def ssl_cert_host
+    return @ssl_cert_host if @ssl_cert_host
+
+    host = ENV['TEST_RUBY_MYSQL2_SSL_CERT_HOST']
+    @ssl_cert_host = if host && !host.empty?
+      host
+    else
+      'mysql2gem.example.com'
+    end
+    @ssl_cert_host
+  end
+
   config.before(:suite) do
     begin
       new_client

spec/ssl/gen_certs.sh

@@ -2,7 +2,13 @@
 
 set -eux
 
-echo "
+# Note that we generate a set of certificates for localhost to assist the
+# testing environment where the domain "mysql2gem.example.com" can not be set.
+for HOST in mysql2gem.example.com localhost; do
+  mkdir -p "${HOST}"
+  pushd "${HOST}"
+
+  echo "
 [ ca ]
 # January 1, 2015
 default_startdate = 2015010360000Z
@@ -22,27 +28,30 @@ organizationalUnitName_default = Mysql2Gem
 emailAddress_default           = [email protected]
 " | tee ca.cnf cert.cnf
 
-# The client and server certs must have a different common name than the CA
-# to avoid "SSL connection error: error:00000001:lib(0):func(0):reason(1)"
+  # The client and server certs must have a different common name than the CA
+  # to avoid "SSL connection error: error:00000001:lib(0):func(0):reason(1)"
 
-echo "
+  echo "
 commonName_default             = ca_mysql2gem
 " >> ca.cnf
 
-echo "
-commonName_default             = mysql2gem.example.com
+  echo "
+commonName_default             = ${HOST}
 " >> cert.cnf
 
-# Generate a set of certificates
-openssl genrsa -out ca-key.pem 2048
-openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca-cert.pem -batch -config ca.cnf
-openssl req -newkey rsa:2048 -days 3600 -nodes -keyout pkcs8-server-key.pem -out server-req.pem -batch -config cert.cnf
-openssl x509 -req -in server-req.pem -days 3600 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem
-openssl req -newkey rsa:2048 -days 3600 -nodes -keyout pkcs8-client-key.pem -out client-req.pem -batch -config cert.cnf
-openssl x509 -req -in client-req.pem -days 3600 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem
-
-# Convert format from PKCS#8 to PKCS#1
-openssl rsa -in pkcs8-server-key.pem -out server-key.pem
-openssl rsa -in pkcs8-client-key.pem -out client-key.pem
+  # Generate a set of certificates
+  openssl genrsa -out ca-key.pem 2048
+  openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca-cert.pem -batch -config ca.cnf
+  openssl req -newkey rsa:2048 -days 3600 -nodes -keyout pkcs8-server-key.pem -out server-req.pem -batch -config cert.cnf
+  openssl x509 -req -in server-req.pem -days 3600 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem
+  openssl req -newkey rsa:2048 -days 3600 -nodes -keyout pkcs8-client-key.pem -out client-req.pem -batch -config cert.cnf
+  openssl x509 -req -in client-req.pem -days 3600 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem
+
+  # Convert format from PKCS#8 to PKCS#1
+  openssl rsa -in pkcs8-server-key.pem -out server-key.pem
+  openssl rsa -in pkcs8-client-key.pem -out client-key.pem
+
+  popd
+done
 
 echo "done"

spec/ssl/localhost/ca-cert.pem

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICtTCCAZ0CFAwnppExyVZKvNYuoDiG+1VfU8qoMA0GCSqGSIb3DQEBCwUAMBcx
+FTATBgNVBAMMDGNhX215c3FsMmdlbTAeFw0yMjEyMjMxNTMwNThaFw0zMjEwMzEx
+NTMwNThaMBcxFTATBgNVBAMMDGNhX215c3FsMmdlbTCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBALjIBExDu99Q4uvMi4ikmhQkhKyK4X/+NALos8iFXFbq
+a6B8Yeho2rRzfdxnAXg3RW/3t7a/sU/V/KfPHgUcBmDNp6ZGS0bGK6uFWU963aI7
+vn/B4yiXLM3CeHzRgLisvIySJ2PYGNW9I4Sunwwl9V+juAJ1iZemfKGNcQ10VWw0
+zRD0TV3/6wQrdasEkf7t1Zv+HOg9zrPKM0uRX4F7sXdcoatFpOmvNZGiTfJCeCfP
+tMkjyhncO48z3+es0yr1/574CDxB7Stc30ce528k8wZwQFPe4vlLVDzdxVD02Bcj
+jhQQkadRWiuRtUXBFFIx5QOvzNrZmD6mWeL1TSSdNlECAwEAATANBgkqhkiG9w0B
+AQsFAAOCAQEANHFob2ypSKhMF9vQVWbs7c8oqRSNkMVcRqoc8wbRREKKLkmqoXRm
+FcaPVXd2Y3O6Milw4lFLzQbTr7wf7Fhab69LNDaEj42KMxCPqMJyvHyD1AGeBcIc
+dCagd3ZA+DrBjBvmHDAwkBBlM/P7FukhL1NoVNP9eqz2/9yOOPwlTLo1YCQwV/gN
+WdWWtD4r9sbm2nGNXZ85yZAQHfIdUQZhHU/SFdLy1oSsPQMgPe8N58QvP/UcpdHe
+RT4DqAu2MlfHWXFarjSakCLYsbvyeFvb+qg69snO0FVUT5IZQQ/3xbFh3o0bqeyo
+LUbvUMmXgVacmlOWmwrcxvJvvFEBzEBkNA==
+-----END CERTIFICATE-----

spec/ssl/localhost/ca-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC4yARMQ7vfUOLr
+zIuIpJoUJISsiuF//jQC6LPIhVxW6mugfGHoaNq0c33cZwF4N0Vv97e2v7FP1fyn
+zx4FHAZgzaemRktGxiurhVlPet2iO75/weMolyzNwnh80YC4rLyMkidj2BjVvSOE
+rp8MJfVfo7gCdYmXpnyhjXENdFVsNM0Q9E1d/+sEK3WrBJH+7dWb/hzoPc6zyjNL
+kV+Be7F3XKGrRaTprzWRok3yQngnz7TJI8oZ3DuPM9/nrNMq9f+e+Ag8Qe0rXN9H
+HudvJPMGcEBT3uL5S1Q83cVQ9NgXI44UEJGnUVorkbVFwRRSMeUDr8za2Zg+plni
+9U0knTZRAgMBAAECggEABEWxnb7KKvdgi8Gir0HZAyK2A5RBcvdiZffR4k69DBBm
+9SKzE8/K0LXD4PLrvIcQnq5cS8giVh11Nj8Ka2VSu2291NEWv/fofhJ69mS5l5zo
+gmUt9pwKL+axaPdiEcMCqABgE0Wli1mQZuqvqDT/d5reMAZeLEiv5H9T8BLyv6nt
+y5N/EiSsPx67cGDGFBlNATDl1xUApxkQe0EVsBfpku3r/2UiVGtra7k0kOA4a8UL
+tx8O4mED2b46DWed2+zNbKcXOvXLjlkjZTudfVi6p6B8dsSopP+gJxVnpiY8QxN9
+xctPw/IlFzIlriMm2U2/JLHxdJP4Gyz393oavPLDAQKBgQDP9IDemtQjKlN8PmOO
+4MZtl9+Y6nx3ZyEK1Jky7ncyFMlfCAqGY8+RbT2FvxV2FR+qhinzY/UYmV/eQF6S
+AgMHKM8wkolF4G2xoUDnwZRG53+pzlJTemXu/sayzu0chQ05Ru+KdKkuL9Qv42zt
+KwMme6mPGKXCSi5EQypI0l6NwQKBgQDjeOa3LPn1li7jfA1GCwp00LuiBnuRUQRK
+6zH25yMiMbUay+zmbDxWMLSlYffzP9hLcp2XcySNkNNoT2Gjm6Ng9s/IqP+8beqI
+haNrmcLZl6wbJVqmnXjyaAWhmTzso9OJl4QFrRNdIdcjQtkeP58wVA7VDIK0LtQN
+m7nqrKHskQKBgHj5ZuKYtWIDpG95p9cdYbGtkTDW8DNR9kHjrX+YhBTJTOAQwHav
+p7eVEh41LBn2beZ4h/0EIDgAOWoEjj9oFjTbA7Tg+iSBS67y/NwVm9mnoHe7A992
+K8hdxF+Oyxc1O50fbAhil2y7/DcjmWFbDUkc1WXeU8dz+fhSDk4wuzrBAoGBAKAh
+QREb6U54DcP4VQPEy/SV6DBULfKLPOFclkzAQ5xTr7EQc1F2SjdGjDSMNdcYT7Q1
+GDlARjAeDqS0lQBulOGyfW09guHr4pl+sh8SG/e/bNmjPyBhZH4IukYbMKdJYKXQ
+cpDoWORL6T4aVeuUUATed56E8xHSkVaPFJ7eLhLxAoGBAMtB/grTYP7YHzPDH8T+
+SfJ05OoFB1MR1JzqdDLwzI60c041RdVZ/StpXjK7th2MAK4zymuzXRgTklvsRRTc
+RV+2REWqGpSNO4eTPLM6j8TvAwAaI+WzSRCW/4XDAkQHnVN7M4Bg6gWiEX+Xi6pr
+FMC+/PNymu450sLrLA+9kByf
+-----END PRIVATE KEY-----

spec/ssl/ca.cnf renamed to spec/ssl/localhost/ca.cnf

@@ -0,0 +1,22 @@
+
+[ ca ]
+# January 1, 2015
+default_startdate = 2015010360000Z
+
+[ req ]
+distinguished_name = req_distinguished_name
+
+[ req_distinguished_name ]
+# If this isn't set, the error is error, no objects specified in config file
+commonName = Common Name (hostname, IP, or your name)
+
+countryName_default            = US
+stateOrProvinceName_default    = CA
+localityName_default           = San Francisco
+0.organizationName_default     = mysql2_gem
+organizationalUnitName_default = Mysql2Gem
+emailAddress_default           = [email protected]
+
+
+commonName_default             = localhost
+

spec/ssl/localhost/cert.cnf

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICnzCCAYcCAQEwDQYJKoZIhvcNAQELBQAwFzEVMBMGA1UEAwwMY2FfbXlzcWwy
+Z2VtMB4XDTIyMTIyMzE1MzA1OVoXDTMyMTAzMTE1MzA1OVowFDESMBAGA1UEAwwJ
+bG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1sStOpst
++FCGz9V7hQmD+rQlzpcg10cfPDOVKQokEu9ZRue8/dflNGDLSy8zmCYfCYDsXZvi
+VEiDPgXR3AxhpbF6VBj4fG83wAFtEeO18EPyAsxBpYyCJIVuTxPWSJv7Qvv01TEA
+z6W1wo2G5S35B7JcY65WS5JG7Jyhg4cln4PcLEFG76ECBzvUc9kVcRdROiv5OVCN
+i1N6glnMjMUsc6mC7labUnQSV/1RWHt5GRvFd0G9nszL8Yxj1GHmXdcUUHGXvb71
+l3rj0vWCNkG+K1e17tNLP86ACWhtLMps8CFzU32+uSUaE4ol/Vs+3FH+74lpdJL8
+oRvdu4b2msKt9wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQChXIphVRRhl/RxLS3C
+gifApYt+Ou7B+lPR5+Ex929QxCgRp2Ux6GDEVF/Iyvj2RIWN0pj504JN23pEBOEK
+e/YNdX7A/fFr7mSrjQ38MUt18I4n1xzWAVS+l9y4QbCdMWvaYRBkm3vtBL7+3fFU
+6Rz++EOzkHfGFVIIEOvC7tqkt4lMELMYEhU4dMe7ZVU0cu1TfX7snlZTWTJoJQhl
+EIEp3Q0EuphPJlkkn3aOKhJkuPVAkIeMxXluYEc+KFj7HkSaOn0onVy2CAZIixxE
+T+G5SI6LVK1dzRTbvHa35vsnyLYK52BPomRC7QMDkNiUgQugqzOI1vnDjek0+2/+
+v5D7
+-----END CERTIFICATE-----