Skip to content

Commit 5c73869

Browse files
abhishoya-stripeabhishoya-stripe
committed
[fix] CRL enforcement
1 parent 7d45971 commit 5c73869

16 files changed

Lines changed: 465 additions & 361 deletions

‎cmd/integration_test.go‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -683,3 +683,52 @@ func startSmokescreen(t *testing.T, useTLS bool, logHook logrus.Hook, httpProxyA
683683

684684
return conf, server, nil
685685
}
686+
687+
func TestCRLEnforcement(t *testing.T) {
688+
var logHook logrustest.Hook
689+
690+
_, proxyServer, err := startSmokescreen(t, true, &logHook, "")
691+
require.NoError(t, err)
692+
defer proxyServer.Close()
693+
694+
targetServer := httptest.NewServer(ProxyTargetHandler)
695+
defer targetServer.Close()
696+
697+
proxyURL, err := url.Parse(proxyServer.URL)
698+
require.NoError(t, err)
699+
700+
connectWithCert := func(certFile, keyFile string) error {
701+
cert, err := tls.LoadX509KeyPair(certFile, keyFile)
702+
if err != nil {
703+
return err
704+
}
705+
706+
tlsConfig := &tls.Config{
707+
Certificates: []tls.Certificate{cert},
708+
InsecureSkipVerify: true,
709+
}
710+
711+
conn, err := tls.Dial("tcp", proxyURL.Host, tlsConfig)
712+
if err != nil {
713+
return err
714+
}
715+
defer conn.Close()
716+
717+
req, _ := http.NewRequest("CONNECT", targetServer.URL, nil)
718+
req.Write(conn)
719+
720+
br := bufio.NewReader(conn)
721+
_, err = http.ReadResponse(br, req)
722+
return err
723+
}
724+
725+
t.Run("valid certificate is accepted", func(t *testing.T) {
726+
err := connectWithCert("testdata/pki/enforce-client.pem", "testdata/pki/enforce-client-key.pem")
727+
assert.NoError(t, err)
728+
})
729+
730+
t.Run("revoked certificate is rejected", func(t *testing.T) {
731+
err := connectWithCert("testdata/pki/revoked-client.pem", "testdata/pki/revoked-client-key.pem")
732+
assert.Error(t, err)
733+
})
734+
}

‎cmd/smokescreen.go‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -294,12 +294,6 @@ func NewConfiguration(args []string, logger *log.Logger) (*smokescreen.Config, e
294294
}
295295
}
296296

297-
if c.IsSet("tls-crl-file") {
298-
if err := conf.SetupCrls(c.StringSlice("tls-crl-file")); err != nil {
299-
return err
300-
}
301-
}
302-
303297
if c.IsSet("unsafe-allow-private-ranges") {
304298
conf.UnsafeAllowPrivateRanges = c.Bool("unsafe-allow-private-ranges")
305299
}
@@ -321,6 +315,14 @@ func NewConfiguration(args []string, logger *log.Logger) (*smokescreen.Config, e
321315
}
322316
}
323317

318+
// SetupCrls must be called after SetupTls because it needs the CA map
319+
// populated by SetupTls to verify CRL signatures.
320+
if c.IsSet("tls-crl-file") {
321+
if err := conf.SetupCrls(c.StringSlice("tls-crl-file")); err != nil {
322+
return err
323+
}
324+
}
325+
324326
if c.IsSet("upstream-http-proxy-addr") {
325327
conf.UpstreamHttpProxyAddr = c.String("upstream-http-proxy-addr")
326328
}

‎cmd/testdata/pki/ca.pem‎

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,33 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIFtzCCA5+gAwIBAgIUcYbxViF/fKZg1BwwMGN2FL6EGTIwDQYJKoZIhvcNAQEL
2+
MIIFtzCCA5+gAwIBAgIUelDmBGV1ghBRPc3hhL8o+sQ3LDEwDQYJKoZIhvcNAQEL
33
BQAwazELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM
44
DVNhbiBGcmFuY2lzY28xGTAXBgNVBAoMEFNtb2tlc2NyZWVuIFRlc3QxFDASBgNV
5-
BAsMC1Ntb2tlc2NyZWVuMB4XDTIzMTEwNzIyMDU1NVoXDTMzMTEwNDIyMDU1NVow
5+
BAsMC1Ntb2tlc2NyZWVuMB4XDTI2MDYxODA1MTU1MVoXDTM2MDYxNTA1MTU1MVow
66
azELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNh
77
biBGcmFuY2lzY28xGTAXBgNVBAoMEFNtb2tlc2NyZWVuIFRlc3QxFDASBgNVBAsM
8-
C1Ntb2tlc2NyZWVuMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAx4a5
9-
2Y4XpdumUADBTa3oIY9kFHvH+yquzRyD4ngRCTKmDq4r1SKpZBQluG18ihf6f7GS
10-
7BFAl2wIcRt5fZtWmpKgZynLrCx+fiBVrnxKdsiVkZp/nY8hLDnweInYXX6J3UP2
11-
vmrTl+jGAoylDgQ3aS3gkhVc3QjI6pSg58cDKZYNX22J0whp2DiRHD5T1pYWWAaK
12-
5Aw0XR1SatvsLSKu6Xga7heTOZH0M06KYSs8h4BklSAdRR7xP+u1VqnXWPKetj8g
13-
WnqoEQummIrDEZMZAiV3KJANdkDfa66vKnEweIAymqempXK+35gqAmI3ErO4quWD
14-
mAaZ6iZLzpZxJRNpRyF7LNi5fntaOA67r80yDel6VfaDekoEqVwI6jXCSbLdqzyj
15-
lD47RQDVZmKX6SSi/skb9lsHc2HpejJyMEDXQPgn+keulIg+/088qWwGgRRTpipt
16-
NIl2+RSKnK+fqoIhUVQdV9yBJ3MVWXH/H2KfVrOy/TARsai9CsfC6Mt3xM5cOE0r
17-
WFjybZO1QStenRXjFKMD15zoVM+fYQRYTuO0t1ICSgWAbPNjWpYkTXocbYq/flGY
18-
KTGfRGAuiEMuRC1HSjgT+ZhARB353oNgfNinh8M/cwGpAPwvsUtLOSTI3z+gZ/eh
19-
0hE5zAUmI9a7X8t9cXDgiYb6PwTYt7CsY/0YTwMCAwEAAaNTMFEwHQYDVR0OBBYE
20-
FCJvjD/Gk7eKYbHd4RaBgeyQbY3SMB8GA1UdIwQYMBaAFCJvjD/Gk7eKYbHd4RaB
21-
geyQbY3SMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBAJ5FMe89
22-
sAQ0YtAj7LmBqx73DlrmwNZ/00N5IZJgoiBYxGQvsc7Y69vBSkiX0ZuJ5i1rkJqL
23-
ngJTdycOKzc1ofa6kf3JPrxk3EeGEEqCDdByI2eUB9oVxcGtqL1/eAXVYwFjXupY
24-
/CRkrv1qVSfioyNw1JrLxu0j+zqlfYFc/hUAvPm7HEHTnDKePxf+r1fqztudD4ld
25-
kjrcxW4otWHxEP4oyadyrcF7NWQK9vgzyXlB3lj57b8qlfrcniCnqYVFsRoCCFoa
26-
+fETmhzgyNsUG5N2YfvDHd8yYuKyRKm+dDnVCN+RIov32oTvIFY5qHdpyjv30wvB
27-
0hhGpeTgeXY/ddVJu2BU8Ni8xgbKB9tRgPiO88bN4aWKoM6TRlhWfbcvpGKWY9ED
28-
CVzILzUDydhaqB8iC0NYlcBrooVl7MHkvl/7KW9QC+WKrsIXWeF48sUOtOpTvkfY
29-
nBjD+1RfHLML66WoferPNoDB1T6vkIcRKbHESYRfRwvsgD2fqVsepvJREt63yHKz
30-
KJHD/XxJAxMjrqAxqz1t4c/yg2dHA14jL/VgIooUfbvtiljFaDml0tdEIB4n0Ddy
31-
ckpj/iwIwJsg2yVVuStqWEPeErVmsdsDKbtn3KV6Y7wAQcSWFhJVYwiy78atgxOk
32-
CIQtLAJVo2DMgpZEHAmrkGlJ/a44blA/zd4b
8+
C1Ntb2tlc2NyZWVuMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuf+Y
9+
fKeHDee2HBiVH3OG243/IIyinXb3vxYtSQrVEdEhmjrZtQ6TNVz5C5tUy+rn2OLC
10+
mib7PSGCFtPyc6o8RrIvmMnuqhOPoDHQL00do+rjO+JvtneQjhZYRc5mAxvB+zb6
11+
CW8t7iDo9NduY94y2wzdGNtOwpr4JFXEUuTtvYmuHphPAWZsYWm4lZ6Mg6XwhZQy
12+
WQKLvNEKvCxYAnSZ4m8Tw+W+HL+g3X4R6wL4Q1qK4sCoL/QeltYXewaeFsE8rptj
13+
vNDroK1yIL8dX9lPvS1HhFfvG3aArrgJqwaQPA68SvD0EHD+w8ksKyvk07j113pC
14+
REGgaCQYwgX75dj8j0Q3no9ndxKLIdtuyAkhqZVOkj36YFJaKetusAsrnfC62x1t
15+
Ynw4sAw3NPL32kJF+GSDJHdYCZQmPyq88OUJheMchAAB0jEHMCgrM3e+Qj3E5AeH
16+
TQClZ5Rzx1I9hT5xLdJhbCrT7Q6cCHBta/07QF3UgrGWnAcdLl+eev7sJn09PVFT
17+
8yZjDFeQX3ScOs/QyMcKX2oXBK9CrjXH8d/12cJUMjf0uQY9rGxivPvMgoOGmmWQ
18+
Tv0lIsawazzi7Kgq7G9SLvjMBd8ex5S/sFQtY+8H5dq/PzHpNtzMw7sXYMge40Sh
19+
BwbBBe2sgQjMPr2cYctyzv8xzTrgzoT1wkyJ1McCAwEAAaNTMFEwDwYDVR0TAQH/
20+
BAUwAwEB/zAdBgNVHQ4EFgQUhfV6WbX2RowdrhJMTqFajuwRqFMwHwYDVR0jBBgw
21+
FoAUhfV6WbX2RowdrhJMTqFajuwRqFMwDQYJKoZIhvcNAQELBQADggIBAGWVjYvY
22+
fI4Dt2fgevOrXvKbe05S41sc/4ic/ffcdIhZvgbsAFX1aybnvo9XjQlUGBLF12Ua
23+
TEWG/CBxnj1zoTtrwCZgPahEcw2KXsS+Oz6d2OCOPrBSaXkt2y3kG9RJyVZ2l/SP
24+
iZtmO8A5RTfbPAJuHAwGPBwKcFRTCQ+xtPLlDaVwVeYvGeJW7rlUEYwNgownEH6l
25+
MdYouYKGxmj8YTNlSd2hfcT3te8uCWQNU+aupdZSVyMIVEehs64nHZP3MkFP1xo1
26+
PHYr6hqoyKn4M5ZFktDOTVp9nbs+Pz0KdBNWjnGdnZauls3FfpTULpKT9On1Bf58
27+
/O7eVI1aDlbjwGbVpwnHe3S5odVRF6Wm4cR+Qf0a3D8n01k0xaQ9Wsca91WQm8fc
28+
NnML8CLwRs/EBS1h4xQW0Ck3vxDG6yC/A2voB+2TbmiagZ0IP3E4OqrSk9I1+Zl9
29+
1ZvdcS48q2xixmggXA2XIk/t1coBUDMSubkms/kkyyZosRILy2lqDolbM+bRsX6J
30+
J64v06JkDi4fWWQ3qq6qaHRYkREApQ1IVJsdUaxwNJNrz6qu1RJordoC9vjc3fP4
31+
mlayJUC5XM4P36lSDXc/L2cBePtgKbt4qNN2RvAEpVMUNVZqEkwftfpNLCs2UC5A
32+
3cISUGwSv8gI/IeQS61MdCzoJbeq19Ea4uxp
3333
-----END CERTIFICATE-----

‎cmd/testdata/pki/crl.pem‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
-----BEGIN X509 CRL-----
2-
MIIC2zCBxAIBATANBgkqhkiG9w0BAQsFADBrMQswCQYDVQQGEwJVUzETMBEGA1UE
2+
MIIC+zCB5AIBATANBgkqhkiG9w0BAQsFADBrMQswCQYDVQQGEwJVUzETMBEGA1UE
33
CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEZMBcGA1UECgwQ
4-
U21va2VzY3JlZW4gVGVzdDEUMBIGA1UECwwLU21va2VzY3JlZW4XDTIzMTEwNzIx
5-
NDMyMFoXDTIzMTIwNzIxNDMyMFowFDASAgEBFw0yMzExMDcyMTQzMTRaoA8wDTAL
6-
BgNVHRQEBAICEAEwDQYJKoZIhvcNAQELBQADggIBAI7yGPw4/A+7WMrqghIcsbZK
7-
UuLRA7R0AlKIzQGJ/4Tk+ZJF1mlhQrB7kB89yPq7b+CssldnvWpIH67yn3snKtdU
8-
QYOxvXfds2wJn4kyWo46Nnz4/1huc2r4sNEvyvTLEH6VRxivHGR2UncODPkNVpcu
9-
eBoFUwUZrh9aWUcBY1/ilPcWq7JwyGQsuIM7IBLkaWb75ZV+poEzufIVVxKUhCbB
10-
YK56ik7HxDk9YyrX3+69dpCFAsOtg3STph4CpKLHmmarJ6rRGJ1gTa5prva7kfZD
11-
ewYuyjJHhonHPR9WkiVeMm6SV7Odmhw0t8p2TMRx2xre+jdIuHZ7OrPxpd0f+XU9
12-
NFMzUyccS9WrPbztcWW7c0bTA0wfESCxMQ5HccG3JHy5kVGCj8pugOUk1j1WmTo7
13-
D+8qlEnRaIaKUfK7Hp+8X8tGtG3D7Dt+N466i9C6zOfCerP0A8hl0c+UQucpy/cg
14-
G04P7Fpv6b5/yazVReoBcmCFFFPJ04P+MH2h/OIOo4lQjR735H3zRTiCqUpWpQQO
15-
O6gL8AnoulS7H9IVvUJi1C3HEUnA7GBrkILoi5g94O8NICLq781v7ACUz9gBV6P1
16-
y5ev/z5Dz9jWbFa4YjY8DQjLPmulYPSJWDmvVEuYHgjvEZTER+fJfJQwMZCQ5bhA
17-
T4MWh0an1F6H6uTv1Rpc
4+
U21va2VzY3JlZW4gVGVzdDEUMBIGA1UECwwLU21va2VzY3JlZW4XDTI2MDYxODA1
5+
MTU1MVoXDTM2MDYxNTA1MTU1MVowFDASAgEBFw0yNjA2MTgwNTE1NTFaoC8wLTAf
6+
BgNVHSMEGDAWgBSF9XpZtfZGjB2uEkxOoVqO7BGoUzAKBgNVHRQEAwIBATANBgkq
7+
hkiG9w0BAQsFAAOCAgEAMmZ7gpenu2sDFg4DulHTZIfoj/qoBdnzfbX5sHGm+T+e
8+
PdCDQBgBtQ9j9wjweX2LQjV11tV27/MVfqi0TCUJ3PK1Y1MHFA6N7W0nUUF05oPb
9+
sc4tkzSpPc3e+mhR6RXY0FviDCEvlSFRcJ2efdiWZYxWygCbLVQfuuoc8rGKqK5g
10+
BLCnjkz76ghoYFmS9UdxSLB4L4HTYuePOiP6ktgmpJbBkf1QsOiCxEv8VbRFKNFw
11+
uAwAz/i3NMO4bSPbwJLOAZWhyYlkaq2/VAmuuoy5AM0wyd8gZfDsnqNXyjQLZFGj
12+
iM2G6dK/7/qQKdFKbXxfSDpxn8jmY11wW4iOX+F9ulzXOcuaALn4gNPX22zUDmrG
13+
Sj5tf9fj4e4HbJIluJFkC2+Lw8QDVLjRuRWMxAAp4hX7SdIyF6HRmhVheLcbPgh/
14+
SPhyn5SxTl0l7+cvV+M4RkLNVjDzwweajPWlwlgqxgWYDIU69E15jnsqy0Ew/qkb
15+
EqAiA7S72TuSc0xmoMst8nspgMH7DAC1phMbqNxDtkuBzU/Cy+XpP7NQgiKoJlN7
16+
RjvVxr0monyf9lxQwiWytQiw1gZBeLGYflLaPIi4pyvJEsj+SsTrK3QZt9rK+CTz
17+
XT7SCXfxOloaNW2EfX7rG5TB40gcFXmCUiL8bb+MhRBf0LHCaS2InGm4edCo9sA=
1818
-----END X509 CRL-----

‎cmd/testdata/pki/enforce-client-key.pem‎

Lines changed: 26 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1,52 +1,28 @@
11
-----BEGIN PRIVATE KEY-----
2-
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQC581NKIuSWzUk0
3-
ohbyub5o2iPRmbJ4bcvvNwZ3ZUCr+Zuf6RXj2YrM1rcN9twU3x4oK8zJJn25AThZ
4-
7evaJhJcJvNUDpBKDIr5S+R1XUskBrBcgHOQpEQhZH+rWL4obZ0e+Zk119AhQpJD
5-
1yEuptoivkI1bkRhbYg3miEfj5mz1VMFBZ3SKvfjvf80VUGdYhSEscHcuwk9jXzr
6-
wm9/NoJi5L1hrdKPLaYI4LKr/JghcbwZ/RoqEiFKWDsAiZZcItvqeGV2o6TaOlH5
7-
9osRi7drJJfcwL0v11M5fbcOiIW/tdccp5JEzOEeMD36PjhQvzkFdQE54FFBfZF8
8-
60wML3vK29Y7ZHHhlRtZ78L+NQ/wBMIhj+tIY0wmf2Xoas+5qQ8Qj5igpBzlymFV
9-
EKXJfXTWGq4Gmbgpm/j0L0O3/4PbUjJk0H7NpBlA20Pwjp01v1ALYK5BrfvzvR6X
10-
47YAtYhToxlVFxjWhe+4+hkwxZOdMr/lHJqVlIKP5hGMiFI9sw8B5aAViJkAeLsg
11-
yXbF3GiCq/ie0AGmxXjQytgaFNPIeeqsSvKS+LZxRSz7nyjtgQh+fHDfzpv4I2MF
12-
b7xMVgEH69H2LW/wvsMAu7IX2UMaG2UB3FqxwZ2OJE4cHc+ocMUSqlstWihIUjMs
13-
bIZnA9WLYWO8GdwmAlp7/zY3I1/mGwIDAQABAoICAALzxohASpHMW5Ou2R9sbIX8
14-
pKHwx0EbOSgonv0pSeARG/PrfvH5o7cB17EskKzyJ+fqXht5dXiI+OyQlvSFMzhs
15-
U+OrQYYzccdoeY2VeBpv0r/9OBh9Symej1pYk9hPeTWjL9gHf6HvjSPvl/LGKmNv
16-
0txHTmWfmBCN7WWzYXTV97X2M13BWeMvQoyBqAOIKZw7uEC5ZXmpM+kIUr3ZzzMj
17-
v4/78wJb7q1oZ93MKlwpkpt1BcPSOt4TzYgCJzV6RjSQScga7ASc9W07CVUzeyuD
18-
zrduBfLq/8LDaLMd3sW+7NXjITLfb9mLWYiOEVXS22RnSagyFAgupq8tiy0MWfJF
19-
EO1HZXsbONfCbYqG1ju8k8vaKBjynTaLh/k1r0VW/nmoGduko9k9zvQZefFP1i4j
20-
NazRihZ2A+uJc/GkMhsmPHP1AnJ1tYAMSRczJKgRqQWqq/VCwiIOTp9nZz9bFGCZ
21-
BOvVqDvBSOOjd0vWyu7/sCVD+c74b6zZKLV9z3dcONKarrJYy7ArofKtC8Az3ibD
22-
ke3Y944qVoqU3NG51pHwwvhLztZ1TVjNB/UNkzKTboDMHm5eUVUK3qMOnGpiJExX
23-
/DeJBpgWIAIFzggBq8TcC/UXx+gibd8mgojGuSEBcOBW3ft9mIjao+xnmikpJ8MY
24-
tnrLA5xoYthPMAVThAWNAoIBAQD7TOvdOuhMiym+QObG7V+62XZG8AjqXmFpulmf
25-
0SBhlb1aAHuqkGlOBslPEsktwmby+W2aKIakqyFn4lZ4iAA4wvQrV5DU/dwq0OQh
26-
HB4wy7YMaShRo4/k0kN3wDH0c7rRm01HLqmg7G5rAynDmdg0nPwId5euefzvDIG1
27-
jiVoifTAtSYjDO9iO50vGWSRFEHmnB86CqGlL5KQffKDkc40O8iOeEyzYR/Zre7X
28-
Z7zfm5038NZS5DhASIcptIGnEHuR20j8rRXivF1Hg+/Hq8Udo7ax8bdcGyLQ3vrq
29-
9qcy8aDknCLQlhykj7LMIBTXrMG1cQgbHsrmovuO/jUHR3IvAoIBAQC9bYv5MDUF
30-
KXkTinfIfTWr0qqO/a7AXNDVksWetoEaP7c0PM4f7q8B5y2Ksqs8wRRlIy8G9xgt
31-
Nw1d1fqG7EVNclhL/SxJRgRrR4D9t2nmk0LULX8LDoCF1RLYyy4DNOgwtBI/2B0F
32-
VL92ISWeBKV4YWo3q62B+/TOCmsEuLw6PIN8bq4TfFQtOi3ccX5rmH7XJsKIdPUo
33-
+DG0KghnulfuHdZhx9VOXIz9k/E3ZKS6QWX5R7Kxy9X7DD3AURyZXeok7ZFzpqf/
34-
zQei6e2V4/btj85d9GDJpPe35OkKB3MECWFZ502QFbBfFb9fD6banhWz7Ot6RezD
35-
FPJ3w8DHQCvVAoIBAQCl4ys4CPDbxmmx26n72yp8b5zySvW3sMHhR1BufWBAytYK
36-
GZOJDndVOImfFymSeWf4MMs3HlVzUjxlFTY7rptm3NrN2aoTz9iMswRFDwim8XKl
37-
Uq145t3QETTUUh0n31WNlFU5DgaP4kMphRcGtgHRCWgeNsP8Oy7KppjhPopXLepR
38-
Y8NfE+TaFbw3IS4Pzy2Ji7nZWLdIEdVQaLO0QoW6WVSVJ7iKGS0rRvQJYcN+YH0y
39-
NltksJ6pYLdIwo1ruSe5KuZNVfzChdGVqfSY/DzMyguJ/6QouwkKlIdSn6vTp0ms
40-
X51j0BPsVaeTtAHONY5RteHB9Vu/UAt7YzeiLHmlAoIBAG+PhcEzP/aTT0hP423D
41-
OAnCn0ppYzLNNvyhXRu09mHEJpxwNyEdTBp90Rd/VFQKjn1l9DtQ6P8wDgI2lD5E
42-
BiivcAsIxr08rDuWOAS0sXznO5OEW+7iEpU/QMNHHgkrbpfIZXsOR0EtgTkMGoBu
43-
0hkMnia9SAlmnu19uztjpQ9TNkjhUkoNjfG48uuCN+ccP49st2LwJraDPZqSqrKU
44-
T1bgYbLiouBsp2hsacKq1k0PWQQv0rDdkF8y/Wc3HfXBFrW66E/JVeXUFWxAAvmk
45-
8XdFm09ALoRzUKUP/qM2celtsNTm4Yo7C81kHHna2PSl57g4jxJK/j6CJq6cLfvq
46-
8iUCggEAU4CoVMc7Xie7rw2mH1JCr5A3EJiU+QtNOrpUiqMaYi1SOzAFuA+n9gDU
47-
cgTdlOTG1LVF/CjjwdrMQ8jLG1yLFzwEZVO91c5RXFLtZGVfg/fmYdJ7l04dDfmp
48-
t0GPS1Eaf34ZtQfr1c9FXowUmF+FhdtRtRoEA91gNY0Ci0M1GptGGqo1Vk0yY8x5
49-
+gIq63YZ208c0eUVnZSNYvm6OyMiLVkjAHgSqzegKRlZXnElFFLozCb5d/iq7JaO
50-
/C/UaI7cuYSdpj2A4moeyIgm0ma0YHWaDVbSI7t4jVYoE7umKMb8kDMlBOI0B3XQ
51-
aYHcDZxFvVRMO7c7pbmMAeFI3hqP2A==
2+
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC2Cw4I5PqcZJgN
3+
6pLxdVuUXnBgpOfJ6Yd5Shu4U102XB+jcp0MmjxDkeje7cOBSyPTZYm7vgo+7CDT
4+
7N9xJ85AG8ncP7E3gVvxLhks8GDhxoAUCh9XkMHa4arDDw6XASAgW6RHeSRYXQWW
5+
cYPdy5j6zHFCzNQwQ88cQdnytq36ii48HLcEzjjjXjCoGJCGZwlrKuOFK/DwyHsh
6+
pWFa5shYwoGZXGZFpUKG6lM7l/hzdfdpWB/mINd1iyCkcCxfTxDMNKRuiQ6Mv/tE
7+
AtuIS7RwUKByjpJNbn0KqWz7XyVrYalutwdtbi+ExPpT4w85g2uhrthbE4gbt5sQ
8+
y5yjrmEzAgMBAAECggEAHzrYRohZwfiz6TdDzC6Q7mwhJUNFDGuGtTUUelO62veE
9+
6fpgnOfczM68P3pUntqwI7T4ov+gLFk/7HtnfbcReAgMYj9+/IGxrzd0VDRMuo7e
10+
LBHsfI4144HxVJNBsoAb7dEq5qQOqyYSLlP9BlDGRshJ6ebPxBPt9PALHsteH2vI
11+
XDw1hGZ/j/09W/5CwWhG04QjcKAOlpq17pO4eh2lhaZBOriLWb/UBW7NOvfYri/y
12+
8Dygr66Z/JiGifnX60zMaRc+rJtZ8qejI5ZfuIQlnvB/VJAPG+LIo3wqRK1o3Ob4
13+
3rtbV489F/oGWURn79WtK1kddRpsC6SFmyxk5MWdiQKBgQD5HKUWnrm8KtYhHLpF
14+
9Izc09v1WskDQzYGELfpukfevZA4TyPaYEN/1cYHfG3/hTGfDx7/ine3A2zoNWAs
15+
OgUU+j81bRjK27QbYdPQ0awNMPFMYrQVruFa1o5i3+Koy4q9NIWRaHotEnUwuNNP
16+
nPvLtKqUJbsPmy6s9bl01CarJQKBgQC7E6jcPxkQk4kCVSmKIKnIgAQE2X8/xUTB
17+
OWuKwfm/y1YyaCsQrq9XmZoXYbFHMIM1n9cPF2+eMs56UWhZd9Aam3qHKuykjckY
18+
e+P2iroEfNM+LclqvxGkNmjq5McowaIxeg6fJLQl/DPRowOEOPdyXPI25+iTsArZ
19+
Nceg8RqXdwKBgQDw6rAKOUVdYnwmF9daElEsu8PM/JjMi/KyWPbUlvAszV2t53PA
20+
HTsKZZ8X3FGxPYoozwHml26B01E/HWe+PfpuODprG/BPN71ugeTM3gor07p5ajfJ
21+
hJCzPi8EFovpPLgXlbTbVJRcBK7LiOPr6eFmN3qEvhyz0huI8DgEcaxX9QKBgCoZ
22+
Nnq5yE4upTpdJ8fpqctw43aj6zrSjbJd1ZGYLTe37mHRhz9t0A+KhV6VoWs/w4ch
23+
vSesQnX7QPPNtgnMKIyUSHJ6el5dec+EsbwdY9b2sCLh8t2Ouc2WYO3bJeZKDNHN
24+
gdTWUaPqqU6XvIbYuvaFbAxnC7OQfiB7Nb1GBJHpAoGAQS5etkTK1YFHcEt4vCDj
25+
UcQEF3DdTwmglh9lx+ct93KdFoGXkm56/7qeeBdPSS56Bxdp6SutPnCkQIrc5QnD
26+
NplcpdaE4CTIeh0h/WVZBOAUmoO2aXMt3vCceyv5fzKnUHvP3VUwgSJ5KNo9uxS0
27+
eUI/HFkEhcBJ0ueelME+Bzs=
5228
-----END PRIVATE KEY-----

‎cmd/testdata/pki/enforce-client.pem‎

Lines changed: 22 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,28 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIFvjCCA6agAwIBAgIBAzANBgkqhkiG9w0BAQsFADBrMQswCQYDVQQGEwJVUzET
2+
MIIEvjCCAqagAwIBAgIBAzANBgkqhkiG9w0BAQsFADBrMQswCQYDVQQGEwJVUzET
33
MBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEZMBcG
44
A1UECgwQU21va2VzY3JlZW4gVGVzdDEUMBIGA1UECwwLU21va2VzY3JlZW4wHhcN
5-
MjMxMTA3MjEzMzE5WhcNMzMxMTA0MjEzMzE5WjCBijELMAkGA1UEBhMCVVMxEzAR
5+
MjYwNjE4MDUxNTUxWhcNMzYwNjE1MDUxNTUxWjCBijELMAkGA1UEBhMCVVMxEzAR
66
BgNVBAgMCkNhbGlmb3JuaWExGTAXBgNVBAoMEFNtb2tlc2NyZWVuIFRlc3QxJDAi
77
BgNVBAsMG2VncmVzc25lZWRpbmdzZXJ2aWNlLmF6LmVudjElMCMGA1UEAwwcZWdy
8-
ZXNzbmVlZGluZ3NlcnZpY2UtZW5mb3JjZTCCAiIwDQYJKoZIhvcNAQEBBQADggIP
9-
ADCCAgoCggIBALnzU0oi5JbNSTSiFvK5vmjaI9GZsnhty+83BndlQKv5m5/pFePZ
10-
iszWtw323BTfHigrzMkmfbkBOFnt69omElwm81QOkEoMivlL5HVdSyQGsFyAc5Ck
11-
RCFkf6tYvihtnR75mTXX0CFCkkPXIS6m2iK+QjVuRGFtiDeaIR+PmbPVUwUFndIq
12-
9+O9/zRVQZ1iFISxwdy7CT2NfOvCb382gmLkvWGt0o8tpgjgsqv8mCFxvBn9GioS
13-
IUpYOwCJllwi2+p4ZXajpNo6Ufn2ixGLt2skl9zAvS/XUzl9tw6Ihb+11xynkkTM
14-
4R4wPfo+OFC/OQV1ATngUUF9kXzrTAwve8rb1jtkceGVG1nvwv41D/AEwiGP60hj
15-
TCZ/Zehqz7mpDxCPmKCkHOXKYVUQpcl9dNYargaZuCmb+PQvQ7f/g9tSMmTQfs2k
16-
GUDbQ/COnTW/UAtgrkGt+/O9HpfjtgC1iFOjGVUXGNaF77j6GTDFk50yv+UcmpWU
17-
go/mEYyIUj2zDwHloBWImQB4uyDJdsXcaIKr+J7QAabFeNDK2BoU08h56qxK8pL4
18-
tnFFLPufKO2BCH58cN/Om/gjYwVvvExWAQfr0fYtb/C+wwC7shfZQxobZQHcWrHB
19-
nY4kThwdz6hwxRKqWy1aKEhSMyxshmcD1YthY7wZ3CYCWnv/NjcjX+YbAgMBAAGj
20-
TTBLMAkGA1UdEwQCMAAwHQYDVR0OBBYEFFwkGmF+kzcyEoRQcsRY5Xyx4eAdMB8G
21-
A1UdIwQYMBaAFCJvjD/Gk7eKYbHd4RaBgeyQbY3SMA0GCSqGSIb3DQEBCwUAA4IC
22-
AQAVm1qA1Q1XuSGPEHj9B2jTOJ0Z0/0dEvMXuceWAHSlH3Z0+8ntVJsGXaV2b/kF
23-
ynWYqTWbVoGgx+f5dlMPy5e+qHIpL7kfbY61E0jafoHIG9A4p1UJ+AzYQCdJtbq3
24-
9bWAHZ97XYE80/pBgH7bSfP9ZlsRzc+4blbYkFOxmtN7a/FbIKUSg2uRLuIq7m94
25-
X5wGS72GBYMpf2N7u0AxfJ1OEzVpmr/65LU/kc7KF2p/N3jnBIHR2reD12TIClWA
26-
DykNHQIezwaKpAPckH4gOrDXIGeL7HI9dgp0syv/2K/EvfHKqqjyHUkrsLKlKisc
27-
/wRpRIL7vwEEy+41rUuI9q04xuFBjffcnbkVTyzkp/XoViOqa4XK56GleT49AC8J
28-
ryS5JWQginFaUeWVsA7APFi4Pi4fS6B58XLHEKYSU/u/Xcp4PNZ6cOnaeHQCbQvI
29-
65yJA50u7WttKvLJEmrzAMTSh807tFaAr0Eol2oYNhXykI2i2r3YOgwkZfztIy5d
30-
VvFWWo0DMRAOlAxJreeerxzNObCOPT+7SdUsZGjNfMwycFbMhNS6t9TFTcF5gP+R
31-
33Xsh1asvqSLNtQBH5Za0GK5IKWgHU8vO1CpHb7k05qoTuM0e/E/WMm5al3SYarW
32-
1Wd9epiHL6H3PUZCmBA+gWjfsRARvG64FbmNcbOmMJyv6Q==
8+
ZXNzbmVlZGluZ3NlcnZpY2UtZW5mb3JjZTCCASIwDQYJKoZIhvcNAQEBBQADggEP
9+
ADCCAQoCggEBALYLDgjk+pxkmA3qkvF1W5RecGCk58nph3lKG7hTXTZcH6NynQya
10+
PEOR6N7tw4FLI9Nlibu+Cj7sINPs33EnzkAbydw/sTeBW/EuGSzwYOHGgBQKH1eQ
11+
wdrhqsMPDpcBICBbpEd5JFhdBZZxg93LmPrMcULM1DBDzxxB2fK2rfqKLjwctwTO
12+
OONeMKgYkIZnCWsq44Ur8PDIeyGlYVrmyFjCgZlcZkWlQobqUzuX+HN192lYH+Yg
13+
13WLIKRwLF9PEMw0pG6JDoy/+0QC24hLtHBQoHKOkk1ufQqpbPtfJWthqW63B21u
14+
L4TE+lPjDzmDa6Gu2FsTiBu3mxDLnKOuYTMCAwEAAaNNMEswCQYDVR0TBAIwADAd
15+
BgNVHQ4EFgQUBcBlAAGGkHYwHG4BiG4k23atDLQwHwYDVR0jBBgwFoAUhfV6WbX2
16+
RowdrhJMTqFajuwRqFMwDQYJKoZIhvcNAQELBQADggIBABp0rBhJasXPEIxHweMq
17+
lr6Fn3mtEa1W986rMrRwbltQ9utAGEoQHg7FQgCxqRJ172qH61rIumPdVL+WYNLn
18+
78vwGmwHOWETzQEgEatP6pKlnR9iEaYlsoNDSTtuUh5u9tepghd5xYAEqZ/DdK+N
19+
lgpE2+0+3IxJUQh+LomiCGlfXsdeKR/2cEbp7Ir/fj/r4C2BaqJ1aW01S1gO1Yz0
20+
htzpvO5O17/X0jeMzjY8NYDyfEPqqfeILRuqkTWqVFq7n26zMuffR0C+xvK7SgDI
21+
olNwxhvdu2XRZSRrxuam7dWtReVb4KLqCwrnEoHQiWXCwrOO/qMKj2M3NdNcV5mW
22+
hyOh5xReC84AsVppVzk0oRNPoWFdyMQMle2moQo8TNeC5979cVcUvwSdSlCshLuW
23+
947DrljlOWiNKOCrMgeUXfu5FVhlB1a/QisLYwiUOa6S5Ipt4zcRX78QDTSklTDg
24+
eYs8+nrKtaBf1+pZheSWLq0252OOOKBKLQy2QJplSJ7WaGOT++60qTL+JBd8vhQb
25+
FM905RAquNriXwpzhbMj/3ZTCNYMXHbEEQlkNNvXw4lCYZKwsvikHa2Swp2W2+RX
26+
JCWbRvsVXtqHWSyLNi12GvAsADevXSX8syfnVVhd43Ok51b0eLH/8SmIlKaQ4PDS
27+
vyq6hNtTkKwmB3h72fYVtnJk
3328
-----END CERTIFICATE-----

‎cmd/testdata/pki/open-client-key.pem‎

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,28 @@
11
-----BEGIN PRIVATE KEY-----
2-
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDJPuPbA/3ngH3x
3-
ryizsQAr7RTc1moSztICttCP6AUEBvSWBqfjYP5NWZ5Zd4Wtmb0OpDL+XDIiWbcc
4-
QQjjlcTlA0JI42ioudSY3g6+a5WxuQzYh6PlxfcKm1Joli4uKUWJsfnE0z4ImDub
5-
7xQY1PXBhlF28H0GUWwiWHT7am79xg0uBGxvfR4WTNpHk9PBCKO/3J2nCaRCgENs
6-
5EeRwizCWR+G56idQ9cCtQ2wqhequ6jY5TWY/TuL08MF0J6cSsPRSSwZ1fPtEuz4
7-
Du+djQvhqH4YmJO8lotwV+MW84gm8mv8sZVIff72dhfTP1yX+bdjC/SdS8C2a0xS
8-
xA91GhMxAgMBAAECggEAWMBeD5xikQKXSIt1eU3BpB2h+kSrMhE5CA5ky1pJP/3r
9-
RvC3gO0pKaaw0YcHEsj+2iKrBIdXatPDD/hUeb32wALgbDGyWdreee5QdUUQFvlj
10-
w2iKbQ6RxQE75jj5M81qx++QFfANZw/wFfRpmgvtOARLEBe+I5esBzeYm7pUKaEy
11-
czP1DPiw7zRijJhrH+zQ8U/tLHilOpguEId1Js5Y6mOsiDfkz+UtoJ9FHVRNUZbn
12-
2K/YRwyvaf9ALGD+ueQFk6goaKo0RXNlGrw7qkVK69cZ1TmHMLzsnqrJoXWp6sls
13-
9ysINNeBSN1JP/MMB8IJ2b8ht3L7KVFcoufmIAzTawKBgQDv7CD1oTviMEcfErYL
14-
1zTiMcmrjrbF4y+O8RMzQbwb0C5c1DmYNtzygAi6LbbXcS4rhTLQT+RV5PLZBnuu
15-
mFk0JC0Fw1ypqs8jQ6jCegvSpl+dOFMKNL9ShkszNkWZFSJbmcHDPkwwBW0V+Mw8
16-
QbzlZcQK5ja5/2beCv/xy/rrBwKBgQDWu0MHQ/izrFTfv2whTseOZMlb23diwuCV
17-
KGFQxUgs9I2lFZYb6pyJfC1btCYwMsifNJ59MUe2h3E8BRZr3VGg5dSYTpyj8DRK
18-
nRaF3ghL81Bf6PG4gfsFR4kSopUPHa/8HZVqGYm/Yn4z1DPgRNLJrJltd77sPNNI
19-
G24jG72qBwKBgQC5h3ipWWhMbhbhcX+zQlUTwXp5HuA5wIgLWmMFlQSY4XCoujhb
20-
e7l6EQYuqqEkktIoN1Vm/xDMV0JwDvJfvlHk30Ctnzgtv/d0BqMe2HACEkQH+QFF
21-
+Com79CBJqvFSDGMcicDC06xJ9EGV6Hfytn+7qYd445YYKc0d38ahSlgywKBgE1R
22-
lGsTUIPxs4X1eUvs//IH3HFU7wICxbcvmQrqXnjBfhdJVImsyry+l96DWZTVVGPv
23-
IHpXukjBMEa6Vj50rKXQ2+ITvFdTcKDFO4zsS/R9Ih3G1PLo6qgWAAdTv3R37hxL
24-
0rcnhvAA2Qx0hlFktrmjioNeMMMDi9hU+C1wGbUVAoGBANtD3FBKM6HQQGaC/DFc
25-
5WeyceJzw4yKPXPHDU2Z7h5SxsAhsluf+lujMBN1MoVoJXfuLI5gK15lwmIew9oG
26-
KjH/co9vnA0D0WH/Czq64pdJLLsw7nEaRWx2JazFN1xgutz97uFJlYE5hmEzCgTo
27-
+tE2wXwneeVR037CW8Al9NDy
2+
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBM28/OBSoEXub
3+
ULSAx64Lbvunij3hIC2rxKv3dF/4OemIrHa4TZOjqk2R1VAblyLNnaAvCqt+X6Te
4+
+DNgbBN3S9gyEFxfTNXDUbPAWGHEB/xFgMG4DcPRef13vra8rYi+Ku2+54LvCPd8
5+
Up6D00/x93T3tJJBAk3T8sDAWi0/vOjOGHnfFUn6mq2sg82cG8WDAF/UeJBT8A/2
6+
vxWQ4tatuIA7nYE/NWFleUYJiarNTXwySg8gq7vd+mY6UoCNzQym/r29ZcluIXA6
7+
x6+TMiSsanL/nWmudbf6jQZ0aRnN5lf/MsvdpDCxat+sOu3mO7HCsxoniqY/zEW9
8+
VPSPJv/NAgMBAAECggEABCnCK7mSPS2xqfiEoZwr57rETELrvG5ZRzDdh8W6zHpR
9+
Y7/1OvMPZS2mFQ6X3R0i0ECleZegRGcPm9WU8QhcwjhT+Bg0KI8n5Nj3QTczIoQN
10+
iPqr5Sk4XzFiwQubnAs211CZ5bNonEZnY6CgIjURrVdPIbtPxeJxbOMq1iCoH8E+
11+
GbrLm/NMGRI39EuwdHrSq41WlURg4VX+X92UtECdxY3RvvS4zgkMg44sAQgKyaTx
12+
6itU1RbJv3tYNNaix3X5Yi3MjHjU0kmfYz+1W4pmFONnt2f/1TmtiN/Jr0UL8zSA
13+
m21KRHLU364Q9iXZXptjPJwFSQQ1b2rmLpkZQGM1fQKBgQD49Vl4ZLDxr/GO8bLp
14+
mU2o0n0hvSTZRfzeUBllewwuC9/dAd00eoaX/cvlHxedDsLz4XWUKjQd0xq6Md0g
15+
sVSWHUtQB4X1tw0E+ZT4VPUE3bb3Tz+Er6g7JxghM05wMn68jagOFlzIlR/NobBi
16+
jwQ0GbEvjR7lrz7wCBIszC/m6wKBgQDGqluj/CrVvcl0j+Gvl1RpVo+wnwnMtuxk
17+
585xytcgLAR9Ftxw9YJYwifI0sxvZqJAQWB2ZBBa4nfkjvVs99oXTaDzjYaMj3HM
18+
qQQy5tWu7aXHGSkQK8/Z+ZyHvbDBtSL5LUFX1tCJ/TuwzSiiGVYeauQ0vSxCbVLa
19+
0hHBAJ/2JwKBgQDMaB3yxLGnbu9ljzt3owBpWZGWDwdfQaCSI7AGa1YfxG4ktrAZ
20+
s3Qo/R/Y2oN317Pnq7jvUwuBZV/vept1iUPLEPhSGCs8CPSungFbN94JBcWBHtcn
21+
KVZ2Yu3j7I09f6ghRimyj1fU9OOs4VHCSmyIHoQlZ7fzm8SQLgBGOcwmywKBgCBY
22+
MB9cuOSfx6LQoh/idX3I+A/7dK79wTMUgooISkoUoI51IGLLtfMZeTy7BUnF3fi0
23+
LC5aUEdbw8VUeSTKnZlZrDC7BALyf8agZeybpIKccncd44+ccnS8rP10psiC4zTK
24+
Z28TrFQrBILehBUQJvNA1/K2MfSGtAyoUvenUGPVAoGBAI1UPFq0ZSkY/S6xuBNz
25+
n1PVoTx4k8KeNaDXeAcQ59/HjPk792sQhr3mgf4bj/xoAZgKgFfD6CfmiboXNFvB
26+
JL2Z3DxK1hmx/cT46A6HbuD43nLi9g5hxoHNiAN1XurCJYXzMHE1KDA2cR5rAwIO
27+
kGyA20IDSKfaXo/I6rtzZUgO
2828
-----END PRIVATE KEY-----

0 commit comments

Comments
 (0)