fix tests

Author: qingyang-hu

.evergreen/config.yml

@@ -554,24 +554,18 @@ functions:
         args: [*task-runner, evg-test-kmip]
 
   start-kms-failpoint-server:
-    - command: ec2.assume_role
-      params:
-        role_arn: ${aws_test_secrets_role}
-    - command: subprocess.exec
-      params:
-        working_dir: src/go.mongodb.org/mongo-driver
-        binary: bash
-        background: true
-        include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "DRIVERS_TOOLS"]
-        # This cannot use task because it will hang on Windows.
-        args: [etc/setup-encryption.sh]
     - command: subprocess.exec
       params:
         binary: python3
+        env:
+          KMS_FAILPOINT_SERVERS_RUNNING: "true"
         background: true
         args: ["-u", "${DRIVERS_TOOLS}/.evergreen/csfle/kms_failpoint_server.py", "--port", "9003"]
 
   run-retry-kms-requests:
+    - command: ec2.assume_role
+      params:
+        role_arn: ${aws_test_secrets_role}
     - command: subprocess.exec
       type: test
       params:
@@ -586,7 +580,8 @@ functions:
       params:
         binary: "bash"
         env:
-          KMS_FAILPOINT_SERVERS_RUNNING: "true"
+          CSFLE_TLS_CA_FILE: "${PARENT_DIR}/x509gen/ca.pem"
+        include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "DRIVERS_TOOLS"]
         args: [*task-runner, evg-test-retry-kms-requests]
 
   run-fuzz-tests:

internal/integration/client_side_encryption_prose_test.go

@@ -1516,8 +1516,8 @@ func TestClientSideEncryptionProse(t *testing.T) {
 		tlsConfig := make(map[string]*tls.Config)
 		if tlsCAFileKMIP != "" && tlsClientCertificateKeyFileKMIP != "" {
 			clientAndCATlsMap := map[string]interface{}{
-				"tlsCertificateKeyFile": tlsClientCertificateKeyFileKMIP,
-				"tlsCAFile":             tlsCAFileKMIP,
+				// "tlsCertificateKeyFile": tlsClientCertificateKeyFileKMIP,
+				"tlsCAFile": tlsCAFileKMIP,
 			}
 			certConfig, err := options.BuildTLSConfig(clientAndCATlsMap)
 			assert.Nil(mt, err, "BuildTLSConfig error: %v", err)
@@ -1637,11 +1637,11 @@ func TestClientSideEncryptionProse(t *testing.T) {
 				_, err = cpt.clientEnc.CreateDataKey(context.Background(), tc.name, dkOpts)
 				// check if current test case is KMIP, which should pass
 				if tc.name == "kmip" {
-					assert.Nil(mt, err, "expected no error, got err: %v, %s", err, tlsClientCertificateKeyFileKMIP)
+					assert.Nil(mt, err, "expected no error, got err: %v, %s", err, tlsCAFileKMIP)
 				} else {
 					assert.NotNil(mt, err, "expected error, got nil")
 					assert.True(mt, strings.Contains(err.Error(), tc.tlsError),
-						"expected error '%s' to contain '%s', %s", err.Error(), tc.tlsError, tlsClientCertificateKeyFileKMIP)
+						"expected error '%s' to contain '%s', %s", err.Error(), tc.tlsError, tlsCAFileKMIP)
 				}
 
 				// call CreateDataKey with expired CEO each provider and same masterKey

mongo/options/clientoptions.go

@@ -1252,6 +1252,7 @@ func (c *ClientOptionsBuilder) SetSRVServiceName(srvName string) *ClientOptionsB
 // addCACertFromFile adds a root CA certificate to the configuration given a path
 // to the containing file.
 func addCACertFromFile(cfg *tls.Config, file string) error {
+	fmt.Println("adding CA file", file)
 	data, err := ioutil.ReadFile(file)
 	if err != nil {
 		return err