fix: regenerate test certificates

New versions of RusTLS validate and reject v1 client certificates.

Author: abonander

.github/workflows/sqlx.yml

@@ -309,7 +309,7 @@ jobs:
           --no-default-features
           --features any,postgres,macros,_unstable-all-types,runtime-${{ matrix.runtime }},tls-${{ matrix.tls }}
         env:
-          DATABASE_URL: postgres://postgres@localhost:5432/sqlx?sslmode=verify-ca&sslrootcert=.%2Ftests%2Fcerts%2Fca.crt&sslkey=.%2Ftests%2Fkeys%2Fclient.key&sslcert=.%2Ftests%2Fcerts%2Fclient.crt
+          DATABASE_URL: postgres://postgres@localhost:5432/sqlx?sslmode=verify-ca&sslrootcert=.%2Ftests%2Fcerts%2Fca.crt&sslkey=.%2Ftests%2Fcerts%2Fkeys%2Fclient.key&sslcert=.%2Ftests%2Fcerts%2Fclient.crt
           # FIXME: needed to disable `ltree` tests in Postgres 9.6
           # but `PgLTree` should just fall back to text format
           RUSTFLAGS: --cfg postgres_${{ matrix.postgres }}_client_ssl
@@ -411,7 +411,7 @@ jobs:
           --no-default-features
           --features any,mysql,macros,migrate,_unstable-all-types,runtime-${{ matrix.runtime }},tls-${{ matrix.tls }}
         env:
-          DATABASE_URL: mysql://root@localhost:3306/sqlx?sslmode=verify_ca&ssl-ca=.%2Ftests%2Fcerts%2Fca.crt&ssl-key=.%2Ftests%2Fkeys%2Fclient.key&ssl-cert=.%2Ftests%2Fcerts%2Fclient.crt
+          DATABASE_URL: mysql://root@localhost:3306/sqlx?sslmode=verify_ca&ssl-ca=.%2Ftests%2Fcerts%2Fca.crt&ssl-key=.%2Ftests%2Fcerts%2Fkeys%2Fclient.key&ssl-cert=.%2Ftests%2Fcerts%2Fclient.crt
           RUSTFLAGS: --cfg mysql_${{ matrix.mysql }}
 
   mariadb:
@@ -499,5 +499,5 @@ jobs:
           --no-default-features
           --features any,mysql,macros,migrate,_unstable-all-types,runtime-${{ matrix.runtime }},tls-${{ matrix.tls }}
         env:
-          DATABASE_URL: mysql://root@localhost:3306/sqlx?sslmode=verify_ca&ssl-ca=.%2Ftests%2Fcerts%2Fca.crt&ssl-key=.%2Ftests%2Fkeys%2Fclient.key&ssl-cert=.%2Ftests%2Fcerts%2Fclient.crt
+          DATABASE_URL: mysql://root@localhost:3306/sqlx?sslmode=verify_ca&ssl-ca=.%2Ftests%2Fcerts%2Fca.crt&ssl-key=.%2Ftests%2Fcerts%2Fkeys%2Fclient.key&ssl-cert=.%2Ftests%2Fcerts%2Fclient.crt
           RUSTFLAGS: --cfg mariadb_${{ matrix.mariadb }}

tests/.dockerignore

@@ -1,6 +1,6 @@
 *
 !certs/*
-!keys/*
+!certs/keys/*
 !mysql/my.cnf
 !mssql/*.sh
 !postgres/pg_hba.conf

tests/certs/.gitignore

@@ -0,0 +1,4 @@
+# Certificate-signing request does not need to be committed
+*.csr
+# Test certificates aren't meant to be permanent, so tracking what serial number to use is unnecessary.
+ca.srl

tests/certs/README.md

@@ -0,0 +1,87 @@
+# SQLx Test TLS Certificates
+
+This directory contains the following files for testing TLS connections.
+
+* `ca.crt`: Self-signed Certificate Authority for `client.crt`
+* `client.crt`: Client certificate signed by `ca.crt`
+* `server.crt`: Server certificate signed by `ca.crt`
+
+These certificates are **not** to be used outside of testing with SQLx.
+The private keys are publicly available in the `keys` directory.
+
+These certificates should be valid until the year 2035.
+
+RusTLS requires TLS certificates to be x509v3. 
+OpenSSL 3.2 and up create v3 certificates by default.
+
+## (Re)generating
+
+When generating certificates, OpenSSL prompts for a number of fields:
+
+```
+You are about to be asked to enter information that will be incorporated
+into your certificate request.
+What you are about to enter is what is called a Distinguished Name or a DN.
+There are quite a few fields but you can leave some blank
+For some fields there will be a default value,
+If you enter '.', the field will be left blank.
+-----
+Country Name (2 letter code) [AU]:
+State or Province Name (full name) [Some-State]:
+Locality Name (eg, city) []:
+Organization Name (eg, company) [Internet Widgits Pty Ltd]:
+Organizational Unit Name (eg, section) []:
+Common Name (e.g. server FQDN or YOUR name) []:
+Email Address []:
+```
+
+These are purely informational and can _generally_ be left blank or filled with arbitrary values 
+(except for `Common Name` with client certificates; see below for details).
+
+### CA Certificate
+
+Create a self-signed root certificate:
+
+```shell
+openssl req -x509 -sha256 -days 3650 -key keys/ca.key -out ca.crt
+```
+
+This is passed as a trust root when testing certificate authentication.
+
+### Client Certificate
+
+**Note**: Postgres expects the Common Name (`CN`) field of the certificate to match the database username: 
+<https://www.postgresql.org/docs/current/auth-cert.html>
+
+At the prompt `Common Name (e.g. server FQDN or YOUR name) []:`, enter `postgres`.
+
+Create a certificate signing request (CSR) to "submit" to our fake certificate authority:
+
+```
+openssl req -key keys/client.key -new -out client.csr
+```
+
+Create a signed certificate using our CA key and the CSR:
+
+```
+openssl x509 -req -CA ca.crt -CAkey keys/ca.key -in client.csr -out client.crt -days 3650 -CAcreateserial
+```
+
+### Server Certificate
+
+
+Create a certificate signing request (CSR) to "submit" to our fake certificate authority:
+
+```
+openssl req -key keys/server.key -new -out server.csr -addext subjectAltName=DNS:sqlx.rs
+```
+
+This adds a required x509 v3 extension:
+* `subjectAltName=DNS:sqlx.rs` supplies the Subject Alternative Name that RusTLS uses to verify the hostname.
+  * Only checked if using SSL mode `ssl_mode=verify_identity` (MySQL/MariaDB) or `sslmode=verify-full` (Postgres).
+
+Create a signed certificate using our CA key and the CSR:
+
+```
+openssl x509 -req -CA ca.crt -CAkey keys/ca.key -in server.csr -out server.crt -days 3650 -CAcreateserial
+```

tests/certs/ca.crt

@@ -1,28 +1,12 @@
 -----BEGIN CERTIFICATE-----
-MIIEzTCCAzWgAwIBAgIQFN6Kw8UmgcAAAGlENSADBzANBgkqhkiG9w0BAQsFADB/
-MR4wHAYDVQQKExVta2NlcnQgZGV2ZWxvcG1lbnQgQ0ExKjAoBgNVBAsMIW1laGNv
-ZGVAR29sZW0ubG9jYWwgKFJ5YW4gTGVja2V5KTExMC8GA1UEAwwobWtjZXJ0IG1l
-aGNvZGVAR29sZW0ubG9jYWwgKFJ5YW4gTGVja2V5KTAeFw0yMDA3MTgxMjE1NDla
-Fw0zMDA3MTgxMjE1NDlaMH8xHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBD
-QTEqMCgGA1UECwwhbWVoY29kZUBHb2xlbS5sb2NhbCAoUnlhbiBMZWNrZXkpMTEw
-LwYDVQQDDChta2NlcnQgbWVoY29kZUBHb2xlbS5sb2NhbCAoUnlhbiBMZWNrZXkp
-MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAnElV+r9IY3H3jBM72Og3
-MINManqh2VpBvbn6ZlQiYKsyeRiK0hyx+7PugJiw8NW60rHI9z4P4ie5pyCsXQ/F
-3dkAmEuliFGOR3NclzUtBu/K3eYrwafO57cLc/k/1skcqV4p8Q4XILsRP25TiSJp
-O3Q3Oq70t/unZRONKHUsQfag1z79xW36w09mnFMYTBUKQB1QcaZnGZ0xFyp6jk+w
-Z0molgMSDiJS3gWP0zdSGRHVL+eR/072EqYBZ6ycSlfh1XlaP4SM9DMR5K/X9Iwi
-AQCSWFPAksUoSLrG/+pyHYWtcelj7u6NNRxIcW6DiyF+HgeSx9YJTnYq0eP9zqbb
-gBEhaPz6bnTTzJo6+peyHLHaClxx3K9l6oDK2Z2ZMVLXw4oDcwep6JHdBh2w4MCz
-r7DiopNHrnZ3flSz0msy2bf/aZ5k1TzjtmQDzJ8Ln+UlKdqyyA6UOZGA1yyYPS4j
-B5EwY/G1bh/1onxHD5h2yBEDtF9mEhXEigioRB/C1W9JAgMBAAGjRTBDMA4GA1Ud
-DwEB/wQEAwICBDASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBT0YKcYJw+Y
-op0QUrxexXHJ+ond9DANBgkqhkiG9w0BAQsFAAOCAYEAIoDIJo9eQ4Ifs0oxvwVR
-CRlZ/VZLm23dMSpMr5BLP/MvUP8W4wQY5Q2U3UO2RSABiJqLiZhS8XSPMzy7o9Ha
-wqbnXRbrX6TkYLrQT5pvZwImOis6+zYl2uMo3BS1wMTllNhQBAC+SqCrM+t3E5xD
-oasKmaqVo0flWSrHpU/hTVJLrU1rE00ghxVGjiAXoi+JvN718zI7hiIeHh+ikJlW
-qEVqtcaPdBKUoaf0c/xDGo/+aEr8BhPcEx5XLjvDiLdc0lHfmt3rRKCrJh8aDoMm
-8PpYZwx7zc+CG4BDY+Bz6kZ5VCSd9RQ3XNjJEd25tgd3IDuiXQGp5CQoVOCQQyKv
-QKKhy87ZsThgcHZUR36KHXXLdRy2uAT36G2+HKdzjVTgS5nlYIdBJFi5Fvc+3Syb
-vM3rhXbJtg0HPZCHmzIRwLqdhyKEKxEKUy9DfkoO1RtXWLS0+1uDDdmZYLQ2qTC2
-/CtEMstXpen5DIy5P1lX8ycUF/UDHOAd6ba6KNul0tCo
+MIIB0zCCAYWgAwIBAgIUEFN5G3AUb5d/ZC+q+YtFuMeoWvowBQYDK2VwMF8xCzAJ
+BgNVBAYTAnVzMRMwEQYDVQQIDApjYWxpZm9ybmlhMSEwHwYDVQQKDBhJbnRlcm5l
+dCBXaWRnaXRzIFB0eSBMdGQxGDAWBgNVBAMMD0F1c3RpbiBCb25hbmRlcjAeFw0y
+NTA3MDEwMzA4MTVaFw0zNTA2MjkwMzA4MTVaMF8xCzAJBgNVBAYTAnVzMRMwEQYD
+VQQIDApjYWxpZm9ybmlhMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBM
+dGQxGDAWBgNVBAMMD0F1c3RpbiBCb25hbmRlcjAqMAUGAytlcAMhAHfjdF5QJ4OW
+k/3XLlsxDcP8cwBVmB+ySWKq2JanRS8uo1MwUTAdBgNVHQ4EFgQUCw2pVpGKz2xk
+IjbVHYh0LnzdkW4wHwYDVR0jBBgwFoAUCw2pVpGKz2xkIjbVHYh0LnzdkW4wDwYD
+VR0TAQH/BAUwAwEB/zAFBgMrZXADQQBA6VMDBPz9x0b5Wvw4D+2UrLdyhzzjqtrX
+UQOjCTqcKdEwWvgS6ftiQlQJPDfkVDEMOAJgqRmEGvsKjvwMCPIC
 -----END CERTIFICATE-----

tests/certs/ca.srl

@@ -1,57 +1,11 @@
-Certificate:
-    Data:
-        Version: 1 (0x0)
-        Serial Number:
-            e0:be:1f:7a:49:1e:49:ec
-    Signature Algorithm: NULL
-        Issuer: CN = postgres
-        Validity
-            Not Before: Apr 10 20:59:23 2021 GMT
-            Not After : Apr  8 20:59:23 2031 GMT
-        Subject: CN = postgres
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:bf:4f:18:ca:d8:ff:a3:93:aa:9a:3b:90:35:c7:
-                    ff:82:65:d1:d0:e8:65:9d:9c:6c:cb:70:4e:31:7e:
-                    7e:52:ce:2d:85:7a:83:ee:b8:eb:f1:ba:37:0e:34:
-                    66:3d:b6:db:cb:45:6f:64:0f:5c:4d:ba:53:25:c9:
-                    ff:e0:a1:39:9b:82:c9:c0:08:e8:17:6b:01:6a:99:
-                    47:05:d8:c5:2f:83:f3:33:f7:ad:bb:f3:dd:5f:6a:
-                    95:4f:d9:8e:1d:bc:ff:84:78:77:eb:98:40:36:2d:
-                    9a:a3:29:a6:ba:58:90:c1:92:88:5f:07:c3:a8:a6:
-                    06:f0:ca:f8:81:40:13:65:1d:08:6c:97:9f:d4:b4:
-                    8d:f7:77:32:f6:2c:d4:9b:07:b3:86:3a:62:7f:da:
-                    3d:3c:e9:96:71:cc:62:2e:ac:6d:00:ca:ac:6c:a1:
-                    b4:68:28:67:18:be:4b:31:e7:f1:c3:1d:a4:ad:05:
-                    50:59:44:30:09:b1:91:e1:86:5d:ec:75:06:a9:70:
-                    43:6b:81:5c:ff:98:fd:22:5c:3a:0e:08:2e:e3:b3:
-                    c4:e0:65:dd:cd:e7:f2:69:08:0a:1b:90:c4:06:c1:
-                    06:ee:75:ee:d3:3c:ab:a2:9c:51:00:1c:56:fe:24:
-                    92:36:ee:e1:f3:6f:0c:14:79:32:07:f9:12:2b:26:
-                    79:c1
-                Exponent: 65537 (0x10001)
-    Signature Algorithm: NULL
 -----BEGIN CERTIFICATE-----
-MIIDjjCCAfYCCQC2xx9LEcChiTANBgkqhkiG9w0BAQsFADB/MR4wHAYDVQQKExVt
-a2NlcnQgZGV2ZWxvcG1lbnQgQ0ExKjAoBgNVBAsMIW1laGNvZGVAR29sZW0ubG9j
-YWwgKFJ5YW4gTGVja2V5KTExMC8GA1UEAwwobWtjZXJ0IG1laGNvZGVAR29sZW0u
-bG9jYWwgKFJ5YW4gTGVja2V5KTAeFw0yMTA0MTAyMDU5MjNaFw0zMTA0MDgyMDU5
-MjNaMBMxETAPBgNVBAMMCHBvc3RncmVzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-MIIBCgKCAQEAv08Yytj/o5OqmjuQNcf/gmXR0OhlnZxsy3BOMX5+Us4thXqD7rjr
-8bo3DjRmPbbby0VvZA9cTbpTJcn/4KE5m4LJwAjoF2sBaplHBdjFL4PzM/etu/Pd
-X2qVT9mOHbz/hHh365hANi2aoymmuliQwZKIXwfDqKYG8Mr4gUATZR0IbJef1LSN
-93cy9izUmwezhjpif9o9POmWccxiLqxtAMqsbKG0aChnGL5LMefxwx2krQVQWUQw
-CbGR4YZd7HUGqXBDa4Fc/5j9Ilw6Dggu47PE4GXdzefyaQgKG5DEBsEG7nXu0zyr
-opxRABxW/iSSNu7h828MFHkyB/kSKyZ5wQIDAQABMA0GCSqGSIb3DQEBCwUAA4IB
-gQBxzRXtmp1gXzNTnwQ+acdZ2mRkjoEkr00e5wQTXCcOhfsXG/udQaEU1SUhaCyV
-HppmxDB4i3aHhiGKztk6JU/SE9o4B//BbdLfmv741lwrE/5Lgx2YSBnATqDWC7rI
-W2Tj33Sf06y7MKgkG5TszkM2cGdYhowhsyhhpww50gKfoRBNTp935jLo3nytShiM
-NeQpf7/Wjcd1yIRYbWefTDJDSwGnzBoPCNHIEhAT15RUV2jGe9ctSMU2zQWInDll
-U8dkWRZp9cZpQCvx2HkMy7oqsigoHxSSnsMzc8gtJHdhovjoLAVu9y5mAtEjHnTd
-2ud1woYVo5dDoQEaFMp1Ll4qotLhMRVDl3SBPJoKOrEQfS/4JwITzuS8C7RSlmxE
-UR2gPw7R39ocTE/rigUnE4WHf4q18kWrkRRZoMsvitv9FSyMkN1yaL0IintkRXzg
-ZkSZbzxVriE1dZ5u+Ie1zNaa5rB+yb/nzRC9HMbBtZbVgHe1ngr+pEyAMWFd4U8N
-HRQ=
+MIIBqjCCAVygAwIBAgIURmjYOsv10CRGeCFUY35KOsBmD8IwBQYDK2VwMF8xCzAJ
+BgNVBAYTAnVzMRMwEQYDVQQIDApjYWxpZm9ybmlhMSEwHwYDVQQKDBhJbnRlcm5l
+dCBXaWRnaXRzIFB0eSBMdGQxGDAWBgNVBAMMD0F1c3RpbiBCb25hbmRlcjAeFw0y
+NTA3MDEwNjQ2NDdaFw0zNTA2MjkwNjQ2NDdaMEcxCzAJBgNVBAYTAnVzMRMwEQYD
+VQQIDApjYWxpZm9ybmlhMRAwDgYDVQQKDAdTUUx4LnJzMREwDwYDVQQDDAhwb3N0
+Z3JlczAqMAUGAytlcAMhAKlX7AIHulcVhkBeSN2WtjZbjzde5tlUKwVWyWEhP7sE
+o0IwQDAdBgNVHQ4EFgQUf2VV1eVj09YOwgKa1ZX1kq7VAd4wHwYDVR0jBBgwFoAU
+Cw2pVpGKz2xkIjbVHYh0LnzdkW4wBQYDK2VwA0EA5WMQjRBwEI/QtLzSAQTy5fSM
+FGorJMxGtUpBjFzCEbYku4EHvbJoN707Kf9vYpgxjAIyP2cowxj/Wdd4paegBg==
 -----END CERTIFICATE-----

tests/certs/client.crt

@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VwBCIEILnh8afwKgHjlFlCqooToMmzrI3DAifXtxhUtnCElFtn
+-----END PRIVATE KEY-----

tests/certs/client.csr

@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VwBCIEICauTALD/rWma9h+oROYjcxDrzI9KZlaVzwmhiTpSItd
+-----END PRIVATE KEY-----