From 2164c84f6cb286de82cb9ac756238fd555b933f0 Mon Sep 17 00:00:00 2001 From: Mashhur <99575341+mashhurs@users.noreply.github.com> Date: Fri, 17 Apr 2026 17:24:52 -0700 Subject: [PATCH 1/5] Autorenew SSL certs and use them everywhere (#431) * Autorenew SSL certs and use them everywhere: java unit tests, docker files, ruby spec and integration tests. * Upgrades junit, wiremock, mokito dependencies used by unit tests * Overall flow: - to generate certs first in CI host -> run_tests.sh: used by both unit and integration tests - generate in gradle only if needed, e.g. local ./gradlew clean test - we will not clean certs with gradle clean, if we do integration tests will fail due to mismatch - and genera.sh will skip if certs exist - makes sure we are not generating twice (cherry picked from commit 254e669f77e933c89388eb5ed7d50eced2d67d42) # Conflicts: # build.gradle # spec/integration/elastic_integration_spec.rb --- .buildkite/scripts/run_tests.sh | 2 + .ci/Dockerfile.elasticsearch | 2 +- .ci/logstash-run.sh | 1 - build.gradle | 15 +++- spec/fixtures/test_certs/README.txt | 2 - spec/fixtures/test_certs/ca.p12 | Bin 1782 -> 0 bytes .../test_certs/client_from_root.chain.crt | 67 --------------- spec/fixtures/test_certs/client_from_root.crt | 35 -------- spec/fixtures/test_certs/client_from_root.jks | Bin 4572 -> 0 bytes spec/fixtures/test_certs/client_from_root.key | 51 ----------- .../test_certs/client_from_root.key.pkcs8 | 53 ------------ spec/fixtures/test_certs/client_from_root.p12 | Bin 4390 -> 0 bytes .../client_no_matching_subject.chain.crt | 67 --------------- .../test_certs/client_no_matching_subject.crt | 35 -------- .../test_certs/client_no_matching_subject.key | 51 ----------- .../client_no_matching_subject.key.pkcs8 | 53 ------------ .../test_certs/client_no_matching_subject.p12 | Bin 4458 -> 0 bytes .../test_certs/client_self_signed.crt | 30 ------- .../test_certs/client_self_signed.key | 52 ------------ .../test_certs/client_self_signed.p12 | Bin 4166 -> 0 bytes spec/fixtures/test_certs/root.crt | 32 ------- spec/fixtures/test_certs/root.key | 51 ----------- .../test_certs/server_from_root.chain.crt | 68 --------------- spec/fixtures/test_certs/server_from_root.crt | 36 -------- spec/fixtures/test_certs/server_from_root.key | 51 ----------- .../test_certs/server_from_root.key.pkcs8 | 53 ------------ spec/fixtures/test_certs/server_from_root.p12 | Bin 4486 -> 0 bytes spec/integration/elastic_integration_spec.rb | 80 ++++++++++++++++-- .../ElasticsearchRestClientWireMockTest.java | 2 +- .../ssl-certs-generator}/.gitignore | 0 .../ssl-certs-generator}/generate.sh | 7 ++ .../ssl-certs-generator}/openssl.cnf | 0 32 files changed, 95 insertions(+), 801 deletions(-) delete mode 100644 spec/fixtures/test_certs/README.txt delete mode 100644 spec/fixtures/test_certs/ca.p12 delete mode 100644 spec/fixtures/test_certs/client_from_root.chain.crt delete mode 100644 spec/fixtures/test_certs/client_from_root.crt delete mode 100644 spec/fixtures/test_certs/client_from_root.jks delete mode 100644 spec/fixtures/test_certs/client_from_root.key delete mode 100644 spec/fixtures/test_certs/client_from_root.key.pkcs8 delete mode 100644 spec/fixtures/test_certs/client_from_root.p12 delete mode 100644 spec/fixtures/test_certs/client_no_matching_subject.chain.crt delete mode 100644 spec/fixtures/test_certs/client_no_matching_subject.crt delete mode 100644 spec/fixtures/test_certs/client_no_matching_subject.key delete mode 100644 spec/fixtures/test_certs/client_no_matching_subject.key.pkcs8 delete mode 100644 spec/fixtures/test_certs/client_no_matching_subject.p12 delete mode 100644 spec/fixtures/test_certs/client_self_signed.crt delete mode 100644 spec/fixtures/test_certs/client_self_signed.key delete mode 100644 spec/fixtures/test_certs/client_self_signed.p12 delete mode 100644 spec/fixtures/test_certs/root.crt delete mode 100644 spec/fixtures/test_certs/root.key delete mode 100644 spec/fixtures/test_certs/server_from_root.chain.crt delete mode 100644 spec/fixtures/test_certs/server_from_root.crt delete mode 100644 spec/fixtures/test_certs/server_from_root.key delete mode 100644 spec/fixtures/test_certs/server_from_root.key.pkcs8 delete mode 100644 spec/fixtures/test_certs/server_from_root.p12 rename {src/test/resources/co/elastic/logstash/filters/elasticintegration/ssl-test-certs => utils/ssl-certs-generator}/.gitignore (100%) rename {src/test/resources/co/elastic/logstash/filters/elasticintegration/ssl-test-certs => utils/ssl-certs-generator}/generate.sh (92%) rename {src/test/resources/co/elastic/logstash/filters/elasticintegration/ssl-test-certs => utils/ssl-certs-generator}/openssl.cnf (100%) diff --git a/.buildkite/scripts/run_tests.sh b/.buildkite/scripts/run_tests.sh index 2c7f42ff..91aca36b 100755 --- a/.buildkite/scripts/run_tests.sh +++ b/.buildkite/scripts/run_tests.sh @@ -11,4 +11,6 @@ else git checkout "$TARGET_BRANCH" fi +./utils/ssl-certs-generator/generate.sh +chmod -R 0440 utils/ssl-certs-generator/generated/* mkdir -p .ci && curl -sL --retry 5 --retry-delay 5 https://github.com/logstash-plugins/.ci/archive/1.x.tar.gz | tar zxvf - --skip-old-files --strip-components=1 -C .ci --wildcards '*Dockerfile*' '*docker*' '*.sh' '*logstash-versions*' && .ci/docker-setup.sh && .ci/docker-run.sh \ No newline at end of file diff --git a/.ci/Dockerfile.elasticsearch b/.ci/Dockerfile.elasticsearch index 1c07b675..6f4cae76 100755 --- a/.ci/Dockerfile.elasticsearch +++ b/.ci/Dockerfile.elasticsearch @@ -10,7 +10,7 @@ ARG ES_SSL_SUPPORTED_PROTOCOLS RUN rm -f $es_path/config/scripts -COPY --chown=elasticsearch:elasticsearch spec/fixtures/test_certs/* $es_path/config/test_certs/ +COPY --chown=elasticsearch:elasticsearch utils/ssl-certs-generator/generated/* $es_path/config/test_certs/ COPY --chown=elasticsearch:elasticsearch .ci/elasticsearch-run.sh $es_path/ RUN if [ "$SECURE_INTEGRATION" != "true" ] ; then echo "xpack.security.enabled: false" >> $es_yml; fi diff --git a/.ci/logstash-run.sh b/.ci/logstash-run.sh index 22e4ea62..459c52b1 100755 --- a/.ci/logstash-run.sh +++ b/.ci/logstash-run.sh @@ -39,6 +39,5 @@ else echo "Waiting for elasticsearch to respond..." ES_VERSION=$(wait_for_es) echo "Elasticsearch $ES_VERSION is Up!" - chmod -R 0440 spec/fixtures/test_certs/* bundle exec rspec --format=documentation $extra_tag_args --tag es_version:$ES_VERSION spec/integration fi \ No newline at end of file diff --git a/build.gradle b/build.gradle index 7316152c..d1934783 100644 --- a/build.gradle +++ b/build.gradle @@ -104,15 +104,25 @@ dependencies { from requiredLogstashCoreJar("guava", "jre") }) - mockitoAgent('org.mockito:mockito-core:5.14.1') { + mockitoAgent('org.mockito:mockito-core:5.23.0') { transitive = false } +<<<<<<< HEAD testImplementation 'org.junit.jupiter:junit-jupiter-api:5.1.0' testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.1.0' testImplementation 'org.mockito:mockito-junit-jupiter:5.14.1' testImplementation 'org.hamcrest:hamcrest-library:2.2' testImplementation "com.github.seregamorph:hamcrest-more-matchers:0.1" testImplementation 'com.github.tomakehurst:wiremock-jre8:2.35.1' +======= + testImplementation 'org.junit.jupiter:junit-jupiter-api:5.14.3' + testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.14.3' + testRuntimeOnly 'org.junit.platform:junit-platform-launcher:1.14.3' + testImplementation 'org.mockito:mockito-junit-jupiter:5.23.0' + testImplementation 'org.hamcrest:hamcrest-library:3.0' + testImplementation "com.github.seregamorph:hamcrest-more-matchers:1.0" + testImplementation 'org.wiremock:wiremock:3.13.2' +>>>>>>> 254e669 (Autorenew SSL certs and use them everywhere (#431)) testRuntimeOnly requiredLogstashCoreJar("log4j-core") geolite2('org.elasticsearch:geolite2-databases:20191119') { @@ -802,6 +812,7 @@ tasks.withType(JavaCompile) { test { useJUnitPlatform() + systemProperty 'ssl.test.certs.dir', "${projectDir}/utils/ssl-certs-generator/generated" testLogging { exceptionFormat "full" outputs.upToDateWhen { false } @@ -810,7 +821,7 @@ test { } task generateTestCertificates(type: Exec) { - def sslTestCertsDir = "${projectDir}/src/test/resources/co/elastic/logstash/filters/elasticintegration/ssl-test-certs" + def sslTestCertsDir = "${projectDir}/utils/ssl-certs-generator" workingDir sslTestCertsDir commandLine './generate.sh' diff --git a/spec/fixtures/test_certs/README.txt b/spec/fixtures/test_certs/README.txt deleted file mode 100644 index e4fa8b79..00000000 --- a/spec/fixtures/test_certs/README.txt +++ /dev/null @@ -1,2 +0,0 @@ -GENERATED CERTIFICATES FOR TESTING ONLY. -DO NOT USE THESE CERTIFICATES IN PRODUCTION diff --git a/spec/fixtures/test_certs/ca.p12 b/spec/fixtures/test_certs/ca.p12 deleted file mode 100644 index a903b298ecb9f318eb7afdee3fc68f21449e2d40..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1782 zcmV7Duzgg_YDCD0ic2gjRb-Qi72`Yw2hW8Bt2LUi<1_>&LNQU+thDZTr0|Wso1Q2G*s-cZ7F7q6Y{d{|c>(qdP1@OUc0IF=;P&~A<6tB~RM2Bg7 zTrzQ=yo+GPb*$Y&*ob>*94s&EAwt1-4oB{(Q34AjAiT*szBY(|<}tSUrJWMoDTLY^ z7?iCy4F}!MNm{QyUki*R0#~&Y!sLZUh_bDFd-O#{%}L0(+!^6MN``wDZ;L6qgREc& z=>{YUw}eb$RS^uRo_=>F(zF?k+-k0I_WP@g;V*--Asp5+dCl^;>pF*=n`9{dhK7zG z77`n5iHd+@M==I}9c^Q`#Ul!=ZuAtp&giS6)LJ)Mma(~WuR+ynK)sM0?4U?Bye734 z%d4yn7aHv1kJ)}eL7@RT@0KgTXHj90TyH6hLbY|n!>qPq;VBxL!->yJ%Xb)h_&xS( zDy9G=Pl5*N>e~{(mp5ic`g&vdb$bjaBczhk3_*qkP@|kFUvRh`H@5l_TbB5XYHs+al-Ui*Dm=cs6(0 zPJ%og79??v4aQSTb3D6PC>1IfHX(z1>jiGks>YSAir zfWC#IeOYNqtTpD4VK^(`JiRsE0RkQG(YG+{-tgWIA_||mgV#B30BM|XEg(`L4tq%1 z?J-qF&a=fZ4mW{Z5XrQs9Z=nXsdwcCV6CfWzGq$Gq!F{_=qF(-kk#luk`H;KRgM21 z-i00UY$-5O(zO{ z=!xhxz`8c>_O+al2&+}1vJ3!L=&91`x1afR+fmV}- zS;9e{Yb4nk)l~_f(`l^;;&Y`c5qCe4DVJD!^tusKC5_Qy7z)L^hzU4A56$hJb7r;3 zn2g!;wTZT!ae|mMjO@3a$QNuAt=I?_t>H|#_~EXh%VF$(XMd%6 zSzp6o_ren08trI%3VjPDGONxR86hh`uKh^rCXLph%y0HSt9a(^GeN9T9sZh&Ct43Y z@hY5X3tV3pfV2&Ng=ckE0b1`&aV`e%CnG?3@7LTPX521au2=D_&p{8PxSkw zN|{U=h+p;-(o4pQM+)*gXRHIjMqeG|0}>k?fYKjIOuA~>fzZQ73e3tS)?%1glMNFb zD{({=;P3|dL$Z{3S!Jj%5;n-npI{z1`ax0{PLdYDa0(2+@s+1@Ovl!GJH-IBwMyE! zz09uuYg6E}Qm~$tXQB_r>Ysxa$JOFFCJn3!0%5$R<8`m%!54E6e|*VKE-Wqh==(;C zmnAXWY+LwQ_UmOy8aI2*e*H>Q(!L!b>7PhW_uR?GZIGR1eE$5))Tm6gjw(L3lj`*H ztPz&2x>-6dv^MDj7w_j zK+;y3vK5BfEFx}1ksS!H4z-V<0PVRwfl<3?kWo!MYtH)*S3#455^srQd1c+i3b&h* zGXxMAYMc2KEFeMEBVMw@-R{KGsUV(ejmI?FhQ}0~16kJ54=RRw+r+x$ZKE(vFflL< z1_@w>NC9O71OfpC00baFKEz?}>rtUTI|w-O3(rI@m#5EGD+2yY>wP6r?x` YPr@d9gB$rFtTDIUy8j&-IRXMF5L1;#NB{r; diff --git a/spec/fixtures/test_certs/client_from_root.chain.crt b/spec/fixtures/test_certs/client_from_root.chain.crt deleted file mode 100644 index cc468390..00000000 --- a/spec/fixtures/test_certs/client_from_root.chain.crt +++ /dev/null @@ -1,67 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIGATCCA+mgAwIBAgIBBDANBgkqhkiG9w0BAQsFADBRMQswCQYDVQQGEwJMUzEL -MAkGA1UECAwCTkExEzARBgNVBAcMCkh0dHAgSW5wdXQxETAPBgNVBAoMCExvZ3N0 -YXNoMQ0wCwYDVQQDDARyb290MB4XDTI2MDMxMDIxNTA1NVoXDTI5MDMxMDIxNTA1 -NVowUzELMAkGA1UEBhMCTFMxCzAJBgNVBAgMAk5BMRMwEQYDVQQHDApIdHRwIElu -cHV0MREwDwYDVQQKDAhMb2dzdGFzaDEPMA0GA1UEAwwGY2xpZW50MIICIjANBgkq -hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA3buIigEAaZurkKsC7SEm0a0k+ZK9Ohqv -S/zNSA5KeKdBYZAxmIJrpRKMEE6quvlFHyb6QlWRpp4iZUGW2Q8H0Xaz+o6gDIvx -wkAHHfkINH7bUNWjykBjmKy566qo7aNES2lW9kcf89N1f1nSPD+8zUnLSXuRyu/X -bDuiS58F2JmfFUBBZmMYZldWJ2PpflK/yAyIh8LoMo1ScURX8uW1nv9desB7JK5g -Y9LSA7xucBAoVGfGSjITkAeWYA7I0AKBDNDyjAGnkPgOBa2L/Efx59yx85u6evhM -eDV/6UkL63nSr8dpD6x0Yg4W5bL9F7lHm4xuZ87rIaqQ9H0dwYJKEVuApp7DCKpU -XZ8d+BEyxbyVySqjMiDdi+Jq8ZGhZQrjU4mczbOWmP5uxkXQp1Npj7PEGcQSU3Qv -AnKjmWyb1da2SJp5weD8C3quOoudHOct8n+MTIcq7r9ZcqX9dAOA29HQ9RW85iA/ -SLPkBlCaFF4i0veEmztlxWcKOwHmmjGHaAE7ChTuZa/snmU6c9Dp78HAo5JhjBew -fJsrGzLfkR45kOcEbSfkDGsetLkgiYUvRozJKfLovZKwRoUR/Y60mEIbzD8xRN14 -ifN31OsSo4oY3I6XOEAKx8gMkPQMZWX8eQE+llY+bqlRwfyuZp37T4R7k9125Qei -bLQILpaxf7MCAwEAAaOB4TCB3jAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF -oDAzBglghkgBhvhCAQ0EJhYkT3BlblNTTCBHZW5lcmF0ZWQgQ2xpZW50IENlcnRp -ZmljYXRlMB0GA1UdDgQWBBRQNeIQIufOUCAcOn6jaZpaOGCekjAfBgNVHSMEGDAW -gBQ9KCdtCHLDCbqgwSXsMhljXvTSojAOBgNVHQ8BAf8EBAMCBeAwHQYDVR0lBBYw -FAYIKwYBBQUHAwIGCCsGAQUFBwMEMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAA -ATANBgkqhkiG9w0BAQsFAAOCAgEAWNgFwOzMAQBAtaFm+7bc20ck9UMbX+sus9Rr -xonVP2D5irmVOmP/fBStCgfRGS0+TJbB/8/bNQCWBjZO/abJykraHEnn+/LaAeet -NzMRFYfVZDq2k00UzUXw7G4I/7F/T4pPQNOchG74aTHPJDjnfGNOokqQOZ79wYKm -ipr5/aWjnsZh4tN3smJdJdULpUQ8r9jaye4dN6ORK6evqr4WAfuXs/wvSxdbCxhS -Sje5Za/VK1jBQ3J34N03j3UeAckw1pBvAFcOmnOr93lWTwSknP9duN5zdAO/YXyH -dEHUIbL4quwFsGnf/jQG5V57bKMczeastd5MQ/7XL5rbnKofvXFGaxViO0MkE+va -x4XyOpjCbqxb+lcJB4SwM89b6edxfKJ4d1hlvBmT4AQn6aYkui6xl7rttjjNgEbr -s5Pb9Nz83RduRHoCq8s0uW8trEmwGciiSMXqd0qMRxWxzlzkDSpBjJ6YpfrXVUvt -j6eqBYlUstzvag8KADqKQ3kpnRkePqct5YV7SAYjRm4MqjR5W7euLYOadYWp4uGZ -qyDGcpGYUiYIpJ9iMFxmbJfZ/GWkxYPpMPaRqygLBcH/x7Cz2pjxcg3vNLJUcl4P -0V3raE20G57IaWC5PArPKCFEKTT0YqGZRty3cu5ZnsXHWhB2VhCukWfNtU1h+X5I -VX9bH5I= ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIIFiDCCA3CgAwIBAgIJAN5nsUugKJMGMA0GCSqGSIb3DQEBCwUAMFExCzAJBgNV -BAYTAkxTMQswCQYDVQQIDAJOQTETMBEGA1UEBwwKSHR0cCBJbnB1dDERMA8GA1UE -CgwITG9nc3Rhc2gxDTALBgNVBAMMBHJvb3QwHhcNMjYwMzEwMjE1MDU0WhcNMzEw -MzEwMjE1MDU0WjBRMQswCQYDVQQGEwJMUzELMAkGA1UECAwCTkExEzARBgNVBAcM -Ckh0dHAgSW5wdXQxETAPBgNVBAoMCExvZ3N0YXNoMQ0wCwYDVQQDDARyb290MIIC -IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAt041lpDZUKVEsU3QdEs5WiRT -SizlLfBHUHGjZ+VaFUYqPEPyCoWCj7rxAYYPZQHGRk/vvKxLPdgSI99+UrWXpTDc -Fi/qS6AuD4CJRiy09NXzeRlHsHYJd3TQaDhXuE/r1GYa17xYhyRqulLm++7LHtm5 -j5KQB4d/0sU1aUHdB1e2xMEpEG7u37GjOc5XsYaz9yXVFgNR+yiMUWmaW3MKQ5pj -DWRLTQ2Up5U10TD/XcWOhbyIaZZIQoN11NHS36tiqcGtOfMilIogI2H0Oy+7bw+c -b0ABatsNtHKdJCzYOI6G9X1+KSTrc4tJU3ci5zvBu472sBQIjo1t72t+si7FmDq3 -QjAULffjQUkAh9BNf4uUz/1rHWGURWfWLXbdSSz3EgNs94H8lzD+DXz1nrv853/4 -oAiWTz1Ee2WnnBqYp+GGTxWp6WXCzRuJUC8qHdGCu7f4Jv9Z0eoe3fgxVrK3BU8S -KB/3kERmwMmy1Q5jvHdXEFV8AcenVeelGCB0AICxpNXenKfXuhsLtc2mRIBmUIKH -hOce8ed0LIiQWrAxhxti8lB9gUPdZ7/s4g7yfqRcS4mHwfhjyEwBMEiW9a3pCvSF -JZ+VGsN729xlwHZFKh4D9Rh0pafjL4yovgJcSE1lSYo2A7I9U0BHD2oGKpSDFKHy -rKnGzUGiewYCEmHuXcECAwEAAaNjMGEwHQYDVR0OBBYEFD0oJ20IcsMJuqDBJewy -GWNe9NKiMB8GA1UdIwQYMBaAFD0oJ20IcsMJuqDBJewyGWNe9NKiMA8GA1UdEwEB -/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQAQbulq -wTQ9uVXTpifNg7WKvcKCSm9nLrHfJ7sCbXaXvVaQu/NyauGkFaKoeYM5kNiu2k6p -regsLavZbr22x0tGu7CrVEucAdz0OV0PHAMCFh3e2fz63BcQFy2LBXBW89LAHC8C -0HTdB/gSHrG6urcfrEeX1jpIXIljnvHR01m6JkN3gz0KXUngSVmb2RhVAtiRhGlP -Esym+FtOl1+HXAk882kYF6P3Kr7X/P+kW8Djctb8MidiNIJtP/fW8rooRE/vfXmF -ePnzNkdteWpbe7iNmDxv4sBvQHK8t4rPQVbVn1yj6VdBX6c5IoL7KV8FraONapjm -hjAZHsTe55wfSorZHSstDZlEEmhL9y159CbPVhbWjuDvb+jlwi664en7ajZaoG/L -t+UCq3K4twkQhztuNt40v9Bm/NgAZxpHMlsHGHTG+cNdsewNP/Q8pGuZGWQUJpJr -Z7ppfee+SzeXAVDYZ/OXJbwDyBIj+83GycsdEl4ahXHmAyBFxZ+TZjOmkMcBN15/ -7vEhJr+kntAV5jEJZDUJqxbF4u0xIZ8eQ7ZIwhlwnRtKQkwt91VphzxZj8XVrGHP -4jKqx/rszj1q0IkPh69wsbzXPCQoUx5uh9Y1ZeISs9Js2RabyQLEvibOdCnnwYrX -ffMjLFrmvkj/ydrdonIbckYg0WvTfiKe0YzrQQ== ------END CERTIFICATE----- diff --git a/spec/fixtures/test_certs/client_from_root.crt b/spec/fixtures/test_certs/client_from_root.crt deleted file mode 100644 index a83166b4..00000000 --- a/spec/fixtures/test_certs/client_from_root.crt +++ /dev/null @@ -1,35 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIGATCCA+mgAwIBAgIBBDANBgkqhkiG9w0BAQsFADBRMQswCQYDVQQGEwJMUzEL -MAkGA1UECAwCTkExEzARBgNVBAcMCkh0dHAgSW5wdXQxETAPBgNVBAoMCExvZ3N0 -YXNoMQ0wCwYDVQQDDARyb290MB4XDTI2MDMxMDIxNTA1NVoXDTI5MDMxMDIxNTA1 -NVowUzELMAkGA1UEBhMCTFMxCzAJBgNVBAgMAk5BMRMwEQYDVQQHDApIdHRwIElu -cHV0MREwDwYDVQQKDAhMb2dzdGFzaDEPMA0GA1UEAwwGY2xpZW50MIICIjANBgkq -hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA3buIigEAaZurkKsC7SEm0a0k+ZK9Ohqv -S/zNSA5KeKdBYZAxmIJrpRKMEE6quvlFHyb6QlWRpp4iZUGW2Q8H0Xaz+o6gDIvx -wkAHHfkINH7bUNWjykBjmKy566qo7aNES2lW9kcf89N1f1nSPD+8zUnLSXuRyu/X -bDuiS58F2JmfFUBBZmMYZldWJ2PpflK/yAyIh8LoMo1ScURX8uW1nv9desB7JK5g -Y9LSA7xucBAoVGfGSjITkAeWYA7I0AKBDNDyjAGnkPgOBa2L/Efx59yx85u6evhM -eDV/6UkL63nSr8dpD6x0Yg4W5bL9F7lHm4xuZ87rIaqQ9H0dwYJKEVuApp7DCKpU -XZ8d+BEyxbyVySqjMiDdi+Jq8ZGhZQrjU4mczbOWmP5uxkXQp1Npj7PEGcQSU3Qv -AnKjmWyb1da2SJp5weD8C3quOoudHOct8n+MTIcq7r9ZcqX9dAOA29HQ9RW85iA/ -SLPkBlCaFF4i0veEmztlxWcKOwHmmjGHaAE7ChTuZa/snmU6c9Dp78HAo5JhjBew -fJsrGzLfkR45kOcEbSfkDGsetLkgiYUvRozJKfLovZKwRoUR/Y60mEIbzD8xRN14 -ifN31OsSo4oY3I6XOEAKx8gMkPQMZWX8eQE+llY+bqlRwfyuZp37T4R7k9125Qei -bLQILpaxf7MCAwEAAaOB4TCB3jAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF -oDAzBglghkgBhvhCAQ0EJhYkT3BlblNTTCBHZW5lcmF0ZWQgQ2xpZW50IENlcnRp -ZmljYXRlMB0GA1UdDgQWBBRQNeIQIufOUCAcOn6jaZpaOGCekjAfBgNVHSMEGDAW -gBQ9KCdtCHLDCbqgwSXsMhljXvTSojAOBgNVHQ8BAf8EBAMCBeAwHQYDVR0lBBYw -FAYIKwYBBQUHAwIGCCsGAQUFBwMEMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAA -ATANBgkqhkiG9w0BAQsFAAOCAgEAWNgFwOzMAQBAtaFm+7bc20ck9UMbX+sus9Rr -xonVP2D5irmVOmP/fBStCgfRGS0+TJbB/8/bNQCWBjZO/abJykraHEnn+/LaAeet -NzMRFYfVZDq2k00UzUXw7G4I/7F/T4pPQNOchG74aTHPJDjnfGNOokqQOZ79wYKm -ipr5/aWjnsZh4tN3smJdJdULpUQ8r9jaye4dN6ORK6evqr4WAfuXs/wvSxdbCxhS -Sje5Za/VK1jBQ3J34N03j3UeAckw1pBvAFcOmnOr93lWTwSknP9duN5zdAO/YXyH -dEHUIbL4quwFsGnf/jQG5V57bKMczeastd5MQ/7XL5rbnKofvXFGaxViO0MkE+va -x4XyOpjCbqxb+lcJB4SwM89b6edxfKJ4d1hlvBmT4AQn6aYkui6xl7rttjjNgEbr -s5Pb9Nz83RduRHoCq8s0uW8trEmwGciiSMXqd0qMRxWxzlzkDSpBjJ6YpfrXVUvt -j6eqBYlUstzvag8KADqKQ3kpnRkePqct5YV7SAYjRm4MqjR5W7euLYOadYWp4uGZ -qyDGcpGYUiYIpJ9iMFxmbJfZ/GWkxYPpMPaRqygLBcH/x7Cz2pjxcg3vNLJUcl4P -0V3raE20G57IaWC5PArPKCFEKTT0YqGZRty3cu5ZnsXHWhB2VhCukWfNtU1h+X5I -VX9bH5I= ------END CERTIFICATE----- diff --git a/spec/fixtures/test_certs/client_from_root.jks b/spec/fixtures/test_certs/client_from_root.jks deleted file mode 100644 index 412d687b02a8f729800cdf71184670bb3ad4527f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4572 zcma)AXEYp+v)x^NS*#Kv2qM}lOCm(?-L77uB)W)h^%kpS_1>aJNYrT2609W%O9&CY zx9EbbsCoIH_s;Kk-lz9I%(*jn=FZo-XW(e)6bMKJM?=x16aq0CF{cn98L$`)^&v(> zJ^s?q;ApVY|7wBn5u?E(e`(m?;3cK}9~BiC2r5QXbivUS?Qq9`6eJM1Ib8DJk_rwZ zW>8eQ$30XQWA}-#WV-2dK0)AFeFq4{OA7*Wz^O>d|9c~df&>6(Bc*r}qXBdvA_fW& z)0Qnf9!X^#K1>rrJ9mdxVu{fddJF?eUUq>|qvYN-PR;xwSSc}@Yin*{x07n!fv%OU zCiGGDz0}Fw@Uz!)5)bwz|6InQt;Qv+CX_Z_hp?uXx~@?j_tG|I8f4CG-IM5`WE_r; z5-+vu6Wz{x!kyS>75A}L%xKt2B+Bxpx4p2C@d*mjmdD%b^!0u6Svi3p;jpHVDR;IYxJOi7M)(IGqjXAifGOTjikWsHhWL?0e zM2e1npB46UwnCrBtM|lcFrH90SMKo>k>24Myt`PZXO-ix@b()%mt#?!KQ>V4oMAyP zvcgc8V@*7ajaFzF_UkF5N9GO_hLv^YS&?dJ+-CPE2Y!~{s9)d0d&UQ>JLqF*4|;#wdJ+FqL#JXWi_|=Jz7uSq|Y-!s#3s9mz(j*C<4}`}KbWvESIbz~<=)gE1kkH_{4R(3^Yf`o8Y07dTA{}@@1`PhKczzy z95q=7`QN&lkc6P?j*?B#m=CNE*HO-QyMN}lNXkL4C(&`WUZQ2+&*;0c$i4FNWuVfb4jz`X*Flx1n9``o5Q%xFs*`KY zf7mNaux!?BGgCD8Nlv&6^w|D9WL&@fXFY)@*fXV;X7GnSW9RP-m(73Lhv)$Ile^~gZk8D zF2`6+AIuu}pdWkf*-ZD{t(l>$GKYEuV-v)q@~H2rROyaRMW2{cizxQ2+Ts1cAvP9+ zwaR}Rq0WJq@+D(!VysL<=$VLVBD1=RUyR3c#t$QA=$$$8Tn&5zr%YFl{`0Mn2zupL>_PAO zZUj*jw7*N&3v$FSaAT+#z-}ExcYYyKje;h7W3}q_SG_i)N!6cs4pBE3GxgyNQ1d}E zmVQZ;lEZQFSGSVfzegnJdC|T8($%%V#!bVVGPx?r$ts=3v=C*yz@%y+tMkoPY&6?B zogm*a#Qnvw^fE>K*!Q$cG}SgLu`6$)L`26dcRq&NDs~9*X69p%n5Sl%$Xo#=o&}iD zC%Dz+e^b?}t);%&*JuoE_Uvfv^5$vClN%Gs>mgf?uF@~h15~OV(-b`zfUkq4s4~{w+}Fz_Kx2yY?yw3wh`Mwlj=}7%bWlxec|&qWBMK6 z*NESAYpXQQBbeh?=dEr&10vTSrCl-aSJ5YFKAvmH`N&o$die*^jPR=0x!c}V3-JWf zV^oYhe@d@q)gP~%x~3eZChEAKY4HobPqc!-w^AkfBh|RkgYPLED-hx*R0185FX)~y z>%_ySdN!jJyZ4eXk*TostbovsJ~}3*i})Nvh2I3)y#sscAK0dvHU0yl(8+6?TgC!bkO}HMJ}JGy zhrtyIEh#un6M1$9i6WA*RHJi)j0XQ$St}8cL77Y8v%*70;G+E2pUGX~evcyV6eLY+ z@V-EL+XVww*X5W_bfHE$n=|od>gWmyxlAFf*nHWOqB4oFeXayd!h@z}DJV{Viz!H5 zP^!&y)l7G1D?(10LpC1HFFJj=HG$G^IIR}^nnM`o-3qNM&_^&~3v!E6OgSIb*%=`3 z@ug{esKcqOK3+z|6Di#BV_hrp%_@c)guvcsM0p`xJ91#jvk;mZ0?W%ihD*No+ph81 zKLQv=WqL=$NcB1@nV7&@qZij{F^!?-=b7AXj)jKew9hMmt;2!?nuu1dq!?XmGP2{Z zm%uezdi>U-x4cJ%2F}e$Zh)l7eDD|->)RKa@hs$eDWtB_{O^; zt0tOtDB||h_*9HuOj*XZ6|HbOs{@Dx$sdMIyg06HSJ9_DEO&Ic`sT@Yu(^^1wWIwd z%pga|(whP$X6FrAq2KUTEc)z~OG8#9XXb+()dsY7JZv|E?<@P(N^?!mL_Rs^xDCT5 z&$qJX%P@znvWLMwd_5@D`GAx}lipK;OO#3QJQ^v&Lb%-~M*&rBM#3Q{9U8o&+H(nLm}lS7odf!>kih#cgTvG9A$jq%yE=?N&&H z)Yu=+vZ~hxo5L-5>!9iYT)7!adohG`h4B`eu0n#IviE4UaWF^a=V3aLWs>Mk_TmJ+ zq92{$3e-9=uBFap($xg{sZY`ccj6`(<34BZ>b&by&iMe`P>?0#kSO+O$kB121)YPe zIQ!r`A>G=A;k+%YZ)K?e8O6fXdCUDGACmsoze~AR(r@5<9fG$oo%Y!LR*Fv|&Xi0|9 zhnM%tRyT{W^*dY^y2W>91kXuIck*o*q#7XlrKg*0OMtBgev?>*6+jG&u!g88hZFL# z{o!j~Pv0tU(Ox!|vcaNY+HI%X`xZhe2~V&tm5l|bH+aLu4g4uTzs=+c7?q(vd*)QJ zzA?V2IlX=50BgUvhd&2ebf*r{Z^3Ty-jsPY(66FigKPYrQ*qR#HoY*_R;!;P08eUa z0srEH^SF0E=#F{$K#;z0(RF$4wL|o}7H48(j+}7%U5%akbn5j4Qqf2$m0dpHOx#)0 z4eq2*Mm~8rqQ2en3l=XdvW*R20ufH?T*?6s2aib#lMk|e<%1t4Wds;>>}}oN{C{aF zNbz&h_&zn^Ll_F}+js^sjw;``*1nSZ5t2vcAR_ejLTiY3rlb*8_|iUSfu`Xac!kfn zom(;T#^;)fS2PcD$<^ZS9ilZhg9`w3dRNkP+P8hzp5VLmJwIoihEiFO52|s<_3|99 zfhf9!S>)24>z2shIgf!~9Sx@@$N^BKOV4YU91H_q_;J^)L7WG<9;*K`cw?a*QIO_y zWZd&q0ITss>>E;-7!@Fpm7Nfk5yc+XornhDjF%Xi#{dfd}Z>@BT*s<=M3(#0~K z9(%1iC9xsTMMr}F)D__wh|IaQ4>nipuX*I%SvT_? zj8H!7QF0lL?7wG~zV6O<#S_K=4*u1v{CBk+VbTI{+i_$s4%nYfEIqS*O605W;rE3v z3?-obc9|_=ikIKANKUefGl+Z*H}3aLRS4I9cnLC}ItFg-L$?4v_p~3oqDZGMvg diff --git a/spec/fixtures/test_certs/client_from_root.key b/spec/fixtures/test_certs/client_from_root.key deleted file mode 100644 index 046deb11..00000000 --- a/spec/fixtures/test_certs/client_from_root.key +++ /dev/null @@ -1,51 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIJJwIBAAKCAgEA3buIigEAaZurkKsC7SEm0a0k+ZK9OhqvS/zNSA5KeKdBYZAx -mIJrpRKMEE6quvlFHyb6QlWRpp4iZUGW2Q8H0Xaz+o6gDIvxwkAHHfkINH7bUNWj -ykBjmKy566qo7aNES2lW9kcf89N1f1nSPD+8zUnLSXuRyu/XbDuiS58F2JmfFUBB -ZmMYZldWJ2PpflK/yAyIh8LoMo1ScURX8uW1nv9desB7JK5gY9LSA7xucBAoVGfG -SjITkAeWYA7I0AKBDNDyjAGnkPgOBa2L/Efx59yx85u6evhMeDV/6UkL63nSr8dp -D6x0Yg4W5bL9F7lHm4xuZ87rIaqQ9H0dwYJKEVuApp7DCKpUXZ8d+BEyxbyVySqj -MiDdi+Jq8ZGhZQrjU4mczbOWmP5uxkXQp1Npj7PEGcQSU3QvAnKjmWyb1da2SJp5 -weD8C3quOoudHOct8n+MTIcq7r9ZcqX9dAOA29HQ9RW85iA/SLPkBlCaFF4i0veE -mztlxWcKOwHmmjGHaAE7ChTuZa/snmU6c9Dp78HAo5JhjBewfJsrGzLfkR45kOcE -bSfkDGsetLkgiYUvRozJKfLovZKwRoUR/Y60mEIbzD8xRN14ifN31OsSo4oY3I6X -OEAKx8gMkPQMZWX8eQE+llY+bqlRwfyuZp37T4R7k9125QeibLQILpaxf7MCAwEA -AQKCAgBPKbMXwj/JdKCOJ+AFlT5swapfyDny0rAfKwSHY0LHTL+U+4wZbQbNio+j -CtL9qh05gAr9P9ueZvrUt9QJbspVyFF9dQpDMHuB5KYl11FMnLXkaEHv5YkpaxF9 -yBJDtXSej99SUhZgUPC0JPdgN0lK6bvAYnOsxnBc3fWVlhLaQA6B4cz3pw2BDFFg -AtXMGfMKkx7ziWypD7eNZN8Zg1WSjI1tU+cjM3aKbSw51T6Al+QuLlanCrXdSDgx -11VunlZAoyDVR4nxwf4PnORLj8wYAb0uwjyTxq5WhJNEUKYGzhmgVEt4IxPyJiGa -pIqju6yLJloMid18yY6zGzBSdBfI7HoRYPNdZbjnPieHMVmxKyOdvJSUiINqBqY4 -NIK6WjdksjTxC7rQ58+ADeR8WfDRUlV5VD0IVToHRVHKbnApf1rd6CwtAz/rLHaT -1E4etLl6jZGs4W7wIvLv7F/t15imwb07Fzr0vDd+Vw29W679+xjVvGH8nNhYRK3J -aVH67+GnAZ7op/4rZgiE79vFZy/Tn0xzG3k0GdU97EkuKOwHF1XZDXDXCJmfzNJx -mImcJ/+8ULW7WKt8c1u8eudQcbtIRpJnAP4N+i9D2OXkceGQkm9q39nDjkH+EtkO -+NVWOMSndFy75zN8+a78aRocGg1Au8NyOIIGZCR6ohY2ypZP8QKCAQEA9IONBJno -JIn5gsofeN+AqIrOrVe+9+EGeFXs70NxYwbiip4p9b/EXMQvznFLrBTbIEN1fXN+ -+2vd1OwxllOUjbvDww1b6BTQq++WjLn/t/5EhOZ5Oathzq9672x8ouzR7cQZ7jMN -ll7AulN+0Jz9rcoO8oVIpraMvDOnbA4KSFr8ZxCCI1ej46VYgZgeEWBgHVGJbI6f -1xVGiQxMLpcVJp4yNs9yTioxRg5oqrTFsuYtwr0p4cbFQ2mhX8rPXjmg7QvKihYb -4/DyjVy6V/zVpqhOYGjzGtYV7KhCqG+9OlbhqO1t0NYrMH3Erv8mN+v2yHoM7Tx4 -Re656JHGqyQnXwKCAQEA6CYFdZv2CY/eEg5rw+IRRiUCO8w8ghz9CzK5jGMVrBZP -Ut+IAmtnY36bIkRD4ogG+NSQTPDALx/rDRXUgGjyn7Gdjpk41edE01IfntjArdEM -BHLQI7oiSZTdFwvri08P4dy0xJvEjBtHX2GyZTkMsA2oJm+4eicaEJcB+A9aNqFO -LbgEtMqD3nw9PdjDm7l/BXsW0o8G6lqS5nmjCEkYyDi+FKXBcAyynTHAG92F4I3N -tN1H96yw4Hv5TC/W2JUdhLFTtOthbZ+CIKeSqqb3RIf6Fu9SS9rSJVz6Lmrt0geT -yfietSkydOleCzNik7EA+cFvLMBxjAmIqlLWddXsLQKCAQA9UGeiSb3Ou9KXm3u8 -4b7vhK9DBIfcvM7Uiid58B2UyXsxa2v2NfpVkNS0HfDt2+T++CuUI8wp2+iqpffh -TGAqEnWKieUME3woQVItQ87+IoKoGOs5LOK/430eYMP4Tw5tYwllk+PKW0RU9O8N -/PAYDl0lL4sCUzCDWSiYjgTCFB7K8XbQyf9M7H9/L9gKX3J6p6GgWTt3wdwILc9E -t5oULwNEf0yYkTf960sP03jn3ZSICstf1GpO90QCM2dAp47VImnNqrGfvSH1lNUd -j0c8HWRaBLdBeYHR8HeWqT54TKUVqUQqZCo8ZK1XfJ/m0gL2TrTDILDASJbR3QxG -ijBdAoIBAA1/4INlTVpi/lPoeMXMSJrenhGiH8alLuXOzlFmlaULKxOzofIaEsoL -W7QTaisrI9Smb7m5qkNTRNTe9xt8ftdgebwIFvEBYNQ1C1euXQ3+gQdlMctSEJpc -yLqFW+4e69qDfhOMx1IqZ+0Y/km6lo1KTgPmLUEVMwPR9DBbnDBfEu+/qq5ktGRk -rx8AkudkUwmbjckyvgE0wSQb4Kojrgg+nHcQ6H2+j0hq0zQLnrRfKp4g3AWACk0T -iHywr3qquSu1MBvuMB0y0Ftbw0CfMvPOQHHC+vMkR2Ia1QWL/EZhYGu3RGteeOup -gml+VHYoLdlYMUHV8wRkrYjSBlyV0wUCggEATq0sZbJV5rNOrzlNeT3y8T30MQ7x -QanQpS1VbrGCFLQD9WrG5QXeIUwiPwTR1IS6SLvANjcqoxv13G1v69FLJaX7k3qX -iYZPhhZlp0wyQcpVfscGmyFBQVAN6ylsCrRl5nZcdc2eS74Ky7svlR9ux4b4iCmO -7SaqcRP1K6fgp7aVbJWadnhH12GGuuE94PBxZ2S1gf9NvRErWM1UeyI9oyxH0V6l -A/d+/3q3WpNfh22aFhVp3Fpy5wHNc+RnKoKMEUUoZqUpkPAw0WudH2IWGeoF0DCw -drC2BJ85Mi6JKAFH4YCUgb+rHv8NsIZ28CCE9+57fS7CnXrQoIACRlE56A== ------END RSA PRIVATE KEY----- diff --git a/spec/fixtures/test_certs/client_from_root.key.pkcs8 b/spec/fixtures/test_certs/client_from_root.key.pkcs8 deleted file mode 100644 index f8a76dfd..00000000 --- a/spec/fixtures/test_certs/client_from_root.key.pkcs8 +++ /dev/null @@ -1,53 +0,0 @@ ------BEGIN ENCRYPTED PRIVATE KEY----- -MIIJajAcBgoqhkiG9w0BDAEDMA4ECGnCQwAFEn4QAgIIAASCCUgml66NcSlFsuDj -2NnR4ge26hMvVccQzHMbf4g3SZMYuwmqCusjYP7UpFvaG4axCC5TQMCm/xOYxmPi -nTglLmicUX52T9A80L0bPRlQ+//JaARHo28Rw3ATOW+Vnd4IKlus1f0/JmJ7xFED -f9YXvz4VG59KZlNl+OowCo+4q7KUZ7ZCdtOVK/jOpHTHPyQ8ZWPDrx/Go4oBSbBn -t3NTF0IyoKavEPHuTxLB+VAS1KoFRaZ9RfuXjMGOd1erLLSZ5J2wp81Yzo5ztPUx -xpkC749ZtVsNoOVvB5GGqNYCnlpPfhsiYLKcaKvH3RArHLsevpo0+t4VWPsZMcC0 -eVpWCNHFnj9AGppTMy207cNeJIdkGVtMCNDVL40eWQ80zHaLuAOkjseXMhmldfav -OWyBkf1EVqgXAL28Jg/4LxprQX6zZpJv57I6SVUwbINh2mokR+S74bb9Z2DRO9jY -pC23pB9hXt967AsDOxaNXP8oeZgxzCW7kzt5fft5SFUpAkd5hvXPIX77eLTZpkkT -ZDBRr0sC040GPpiKagBQX2UcFCI+LRcrHl3C4J8rn50Cp7fxFszMTgorAiAmktRQ -l6VjKD1uRV8Sq3KP5suX4l3jJRXtVE1RbtzgeeLXOsK/TlCAxnEvZ/wbBRtZW9Ac -il6mGCaKTgt8Oweepa3p3CRNVwmgVkM90GHvxiQhzpBayyDACBUP1i2NzAeTTsBv -lDa8GDLxZq3khOsjSfnmjRsmlPt9BK1kIEN730Timkods1QbsfIk37aCoVmA2AuD -JUUS7iM8JaiWSA0kIK8zT14XwZdPOyhCG8EPwQsnvaz8ebdmmeVHfywyFZEkDqwm -dZzl3aw7lHmH1sTtBjWLCFrtRYhBzO/B0nAURRJmHO7zW3wXGsUC6ipzQowOSVQQ -8IR9Fx8Uf8Pt6AEc7bqiW0p0cqWaT2R79K4gE4AInSYeDGCYjdfoRIP19MdLDde9 -g/wnYkUWYemePIR+kdlqGHPoiMRZYsd8ApI11VRJHXM0AH0vrcNR2pWxM2dNLHDD -+//zetYqLE3k0EcXlqZTRzUjo6cKfxP0aY48CV68+bJBOgX+eDsaIBrPRehzsv4x -+egNXsquBRWCgzFLEO5zbmgJNmJodjxdCshXokXMKViYG/lx/xaaOOctYoe5zO2a -66Yg3AfOVve/HyrjhVmO2651PLmNhuqlZtqosonwnCHNoEG8YBtBP7VMxZXJ4soj -VkQ2dBsOrTYS75IsYDcY3y5grTEBY0pyjmR0tlCmoiOua4xjX7vT6a1917ObK73Z -1la1//CY6VY4beo/bGmr41zHYYsRm4DJnegaUXKTTlSV7WMf1d9iN0ttiB2soSQX -hUBelAZ0OsgVfepKvFImnw9vs96X/gu8jm/1ys2dDWQIIPDPpDbuBLVhq/bjS+ny -nM7aLDOJHZJXQL9j01h9qN5r2eHpGAByWb5yvG0Jo+kBinj67IhrNEcypgb8XTFV -fTQXPT1jl8j+PIr3SaCv5pJrXP1Pl87jny/g+0NmEZy/5/hvSpEz+9lzKHTzPUcd -jgo1eT2p+Ztba/zpafefP2dXQ8GNerymtOARSXGYQ2TcT+nXFZj9YpKMLDdZz+5h -MJL0hbtKZv4znDwyY2plHCDTCvr7tQNFcRZavaH7GNU57M6tbnmWUHFm94UZUTCh -eZH2V82LQf7/AfEW8k7WpNJSxnYSkLz1QhCgeh3puW71RAmo404k9ENr8qwC8GMC -gQ60OogGzytk69dQbwDI0XshbhFWGA0oRF3QMncfrl1e8R1PC9pGrQfBK/DEhsiZ -msR+l500NluRVvY95eQ5wX33t0Ff8rl05XJgffAeav21Zu9MtDbcSlOkr/UQt0ju -aBIGxwczp9hfXrwioe6m2squB0Ph81uURMjYxVBrGR1b5aX3LgIUUQKFbuiARLHj -QAs8CLDQj07ujHSc9u4kg3vYTmOo4EX9JQIbr8ephskXOtIXrYQawfzjqyOcu2jj -ko46KjDc9E2hMWIF5mrvMJh3ObhBuI6ditoXDUZyZWq7xi/SX6VpzCZjp0eAYM1q -VTZThJBIXWvWznVGJrzyprS9DEE2hs1iBbILGsudFxZkwjbd5yYe6dSdpiCkF/un -o4BHE2a0yKVaW6DwNMfrDNMnRUvXgbnd0r+TYXizWIjLB4epmp0xZaK1y0deefys -g2lEd8PhRT4XiHXBxTimItAGKNNeYWIwJUVy3QtVTOzMU1W87ffhOEbO7ktZ7t0P -jSOlypanAfiNv6qRyT+6w82ybwjePCFlV35vOXXiTggLB1W3tbgm5atN8EqI55IK -g0s7ZCNv4X6TM2yzzBFBRwaVQm3BOTyElWhLWncMMwMCOerleNGc97QkadeMMbOx -Etfzu4PfxD11gdSDWK02TU/ZjLgqqonJJ4y9Y0PDZs/ondvTZFnvzo00FcUQc5id -zT1Wk3wBlDIigV7+IpfaqqqFnLGg/JzytA2bfl/gn9CY1v9JcSBsRR7Ofa2tJvGT -kcIGL0c9RtYa6hJtMl0JYPlcXQXKTj3i7+fUyDMYePg4ZYvHtzowxxGcaE778S9K -pC1QFPzMVhXK79Q8Xp1imCh6uj0ZlNNRrCWNJqQvBOaCssahfsgSukf+E/OkBUwC -1IndoXV5o3nHCEwDj/18JV+R4h+FCqaTryHdC2n6awQMlATQXVyVVT7zJ9ygACwd -jOb8cakT6h/JIToiWiA6azxTzG43kG7bkG/QpqTe/ZVFQvMBHQUWzvE6Eb+P4Uih -Srfhe8jV1+7Tc2o5mm1Gx6H8gUhGpyi5Pct1ichor897vKhFsA3Tki2K97Akv6zY -kxVXu2wNsibAY6XsZnB6JVodGEvHfLNqbStvz5MALtzZrGeD50HE7WWMZTgCPRZq -0Zl+p2eQwALURjpcVk8iELSDDKagSs8mhMe843bS6Kv1Szdwmh+ur02qp7Q2YeTx -RSs+kUKwI1vOJ+kHh1CDFYamfyUNUvdJ2Obg8LOMXRaHo0z8u0Itx7+8ltW6DTYQ -yF9yPPnHTyCrwyrTcNsrvvJVPL6k1KBgm75IxDYi2x1CCX2fl5eDGCaQ9n1buzCF -bWFtx33+XYdlt0KAnP/dpyKB969GFHI4iaVBZmgKI79W0nCOTbhtwTm5c5eMxpQ8 -7tlmtU4mqqAf7C1fxEM= ------END ENCRYPTED PRIVATE KEY----- diff --git a/spec/fixtures/test_certs/client_from_root.p12 b/spec/fixtures/test_certs/client_from_root.p12 deleted file mode 100644 index aa4645fff618a38688f1205ed6c37e80893b85d7..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4390 zcmY+GWmFW5v&NTNSVB4kq(oX+dMW8xTDm(IL>g&XIs_z?6a;C3B_*Z1yFq%Dc!^~} zm$<&?+# zF8wD07Q%tUf31FOEWlss{7-@fW&{%c_XT1sAovk30ehtxUn~C(JvKH0;4K`O+V&}G z`)M=^Rkf3vFfSYKTfn6kWKuMwN(bwbAk}Wr44IM_)bQJ2^xrP*qst8}+m3co_V!SX z2iPaumu;Eb*-)1@=1~h{tTR zFBjYMlzaTz9uS-?9|>Gzg!SzIAdkW?*@IC<>DF|wXi@~ICkdsT8(PilBIb|{@8cOp z0&SP1twMfZ`PU}bedOs*e&v`&&7VSc_B^ffCT|>*wypIATI8OQoqOQytA1Rl5*j8H zl{sqc4y~VwYVzf)u^hT*+Maz>Ua;x(>~~}VZP;0HK>}VOzm&sZS9acFY7^TzRy~`U zQ6t)bm-S$=-$T~!(B`FVF6XY{fPtBeN^q99_H6u>!Y9W?Obv^mq!rD4cCu9tzE6tW z994G3S4m9=La&1%JvhUjlHa_D%DLHN7$CMm&_+6%g_pKX$TGoaRIipceF)Fx&8aK` z<>TO4o=w7|hKq_6YhQ%RH(Y20v@%rli9h~Sas;wF0$wr@kW|aZ!l!)C8%_FBLo(f| zVNyd~AqRr|pXGy59Fi^b=yv%*5QqE1&&JRUg~vVA;Bezrg0>j+cjog-v)FcB2*$7) zm>*S2>R~VTWktc}&CrcyLk5Tk5b#JMJv+|beKUwMd^A2y{G~}7g4&NlhP0hxyqTD9 z$`8U+GU_#$6K|pZ4e`zJ^TK{TFM+}&secS~g_AL#iNGQ?)twB=e&>8W z3#=l@)h)2xoC$o-O2&XcQRwNU%lLAA?&9FkB!tz`Y~c4{>pLHDkX}XG{-uK^`8B_s z`LK6gbc_6{9y|-Q$921+XtJY6eD{i3cZpYl_(!)|>5-L*rwC)JdVk9hj9u@XKRe)9 zdpyzRSW3N{-N^CRnnuEPM@%z|K_{;`kk8^Ji*2Q}q9|*&zit>C)hSQ%>lf#EUx)T{ z*?(|iMv#Y2)I4&#QetC6Q`}ry7=v1TaUp%tW8PmLo^d@7{12x!sed}YO3;$LpRMen z&GCZXz1Ei8d=o-6iyWm&eSHOrsUSih!;9ngOB5_ z_?x224@%s-Q{;r^|X#z)h4U+A$h&N(y zml8Ia2iGM;{_NKA;@R=x$FbF$brUBGXBv&Hk~ED+yOaB?*UabeD}*}&p|b6Nil0iT z{)6M_gOl<-9!z!giwW!HX*OndF|SJj=--lKYJ(gAWax2fzm8?36}#^uu{kU z#3j>U2cwWP*hnQxZ8XItP}(tF^LNvTkYXSvbwdle`M=yi8Ur$B4Y$l4GJJgg9rlyW-ZSsWAudeCkE1Hgg z*rm}@R`is@C<(b#qwS}HTMy44^QR9Yxw^wDrLyx~E?Eg^?=U>Y8 z%lTP7xOrCpOS!-6YSp^|NnCDH_8s-RREaE`zx2=Y>|j~zJpq=x`sD4=Ew}q8ES-`| zyCKrw_WbQPMumSqwsB2clXw%BUVxZ3@;x21GivCYUb2tN>PX$2S3eN@QN*CMz_bOqK6Al`kexwJxkzUio zZWgdb8)-iJ4T#sSO(inS+Z+cB_3>Otv-#~CK5~?1 z->ipPZ=%dCky^c2ULeWNw`NPUQbqngt!&LV1(8C-nx@7N5@kb&OQdnGgwUxvW{%DO@4HU0$9T#hL;ya7!ZKix9HP5f#y# zff=5$BWsJ>(v}vzA6SF8L+$I$JBXW4v!8k?K5ai+&*T$<>&;AK5#P2%WM=TdL8v7a zVKvEHdv0aG^u6%z;Y@qjuR7a1C_#Ti^e+F><+xzMOMK21wsvK_0=hTpieEXEKQ7^a ztE>y z3!9Fj#4Rk-{VRnzkkkqndo(A*7?cYs==&nESEu%Oy>ajLwr&XQ^pF#*Lhw1lub`hA(0JlH_^}G?iw!@ zO}BAX-n%kT?4S>nYAgN>6V=W?gtpl2C_iypci=M%)`2Q!qE1QjDF1P23o*hK?lKxo z6nU@ z=L7H^s;ecDO>^so&-HC`ht>PEx~PR-=yQCV0?HQ#-?RlQWyq#)@>}Vj*}F~;6mA!a zhMttU%GDMqq;KMcXw`h}fhJ&}LS_e#T@kA;b3e$#JW7I3kfh-q^=ArhV>$YS?vQV( z2|t@Rtm&%agc4Fc@bd45e0N#%Q$AQQK8uIg37O{MbQWw-YSne2A2 zuU+X#j?*pL#!vKke>Fa%Md@f0RZyq`KX=4HNvG*UY+_l=QI-Hma?~GOTRg1@bY9lyE;^$5U*9QPAd7_f@v1~PB25IGDmtnecvYUt9)>IM$#CYo zW)q`bR6#hxYG_d#q(+t;`rgWYF7nA|vUrM#S0<0^tuH*HCuOE#s^jnt()?NW*wb6y%=sJDZan`9Z5 z&d)M2hT%8ivabmFBx5o``Jb|;&lcKov7ZY0A6{!JFLH>@@nkbSIB<

VSF9Oru3N z3YXhPzNFIp(ubZVcvX1|=7O|l8NF@QamSp~QR~L+;A6t5aM+?G)+OPe*JL&^@>vb>fw z9s>kiJ@rBu`g7+UUq^gOzQV3LcprB-Dmh9WVbYuctJS!;LE0ygaT~- z5}{7*XW^D+&b<)9v)46m$=~-E^BEtrgHdD+MskRW)nlzFS-F|{7m)!_sEuuT9Yx{y z!YEo}7KP%KItnU#I}q0)`Xqw3T{B5Rh#5`taIjPksD6$PPtxQ47CEV&NmxDDZE}b; z+G#u5mD!pj+Cd#I6y3ygIT=zWcImInu`3RQyy{jCu&cs0mVsOiZ{H7Kw6Au+ zMd0vW*E#3?z8^Dl&GXF6-+Mp^DmQE_91wy^2%ktGRwwp?42uA(071oyi=bk>muW!= z{JVcG`~n32@xAm58w+q>Hve_7KrHyg|9gQH3m-&|OBfoy?+7K66U4?Q1Vke6o6p^r zpZ?tYDYjVjjn_M=-0&0;=ftL2k8H^Lou~bdM00n`!)$c@n#$Hj|8%I5 z3{j#)bwr9+v32Kv-?9_XX}YR<(pXKl>!nb%y5_fJb;MC!;Z4kEJzc8^gq^+|=A=0u zs&9cD8ROaU4=46erzTIZ1qm%&3mHiR+l4f9kIJzkV>DG5UhDf88NO!s)xs%O73Ru$ z3Z}Os`a&Q%8W7wvMpi60c1eXs#~I}g|LDs4>}sI7_9qS@!SdB`g=~G>S8>)c1@b1T z_BzboAhWU4AmGk8UN7clGM*cyyOp)r2A2$%7iC@1BV-lwm$ta&4AfnWJ3Xl}vnAK)+I8*N3BLDXUriYQwb*8YuPq_g>fM`#NmpYcXQ4 zsW%_Wy|PzG&yF)v1HylGh99m!7O8(2^bKE=8;8i(>6P6iC$W&whyB04@CPN718yJA zlGf>2*=Iu69L_&vUE2>oN*)>#`LC=z0sZs+)bQpMEy}2CyeV zVZ9o@B^N;{+2w3!MN+oi{w$q%55HL-zVMr@?E91do3U=;4YP=%^sl*SjyPRY?^Uyb zQ~p|`rniNr)X-d^$3;mGq^PT;DY>}^Vm0fpC`}tmDV6C|#={$Ac5xz7>zhH!mh)pV zG33M|IVUJlb8o{T0~r1D)G|(q8w@Fp zp1q(_iFLMd=OVQ;q_=o1EBoWKCrq!tAE=1`Wc}6kLpZ_Wy^hvbT=kMFR<`mpD9}oS zZ?{*E*5w?WVx5Eh?n{65F;Tn3Ma>|`n^2#&@vbrBIhNP!rm%-aA= zFx7WdQ|#;qQIZIz_ZWdyJ@tu#A;*<0WlrF}pjtaHWxi>TD@a?ls;i1zsE4`xyx0Ty z-O>4s>HSVSH|VD%8lt1C(wyc`Y;qOMJK7UUbC_6DY`)RZRA7x~`zQHA5O=~Kt*h_= ztN;(0rnz1oZSJWNJM3b*j%2t?ZW%|2*xz`5{Wy%$@upMVC!U~BcEN;|Ol z-X~nVZ67QFNQ@y-H#~bqfZ(cVmth#!oiu4ZanI7lt zjQ-Ah&^bCWvNyd5!{}W3HzL$qzq&Z_yQNu z#rvoq+7V~QBI6U%wZKdGH-CgB?#YqWYJok4Q*T#m6FEOb=X0s(vE%k=6ksWj`5CIa zX^s{bd2OyN#-ObtzLGj_YksNKsXZQm=bPZi7JfcmlQOIOsj#Cz%3I~H=---|7BMoF zIG}t%i(CaVR$Rj|ZzRXL=$6`CXizJ~Tzim6j=^|m$qwS=Y_ea@<60-F>#GQ1M=+2} zOBGF@8<@Iv48K?0F5#&_%AA$WG195kPg?YnjOLPN}Yjrzw9R3Rd-2J!+s&dG=}Pq;l(vuK;RI+DjO*NBK6en(sYsaZ#5RI2oZWSTb@+ zg%;e@?vG~8Pl;K}`N1pesNS-QgmLu0aT*i~BgkC;30@5o2NBo3MNF*?-Xx=N}p}kQOw1XZ@A` zhlcm-kD16#SnB0E!fR5_-lPMWcIIRUs(+5}ZjjvhmSyf1;iL0sUtnSAFc|jYQK8jd zwHwU1fybD?sJInig~W%cny&R*Jn0u6x6Fv4jULc8VmRk?{M5S~5e((fOo9?LY((jC zTQiN|J`$;vu~oej$IGFP3-n6MmX#)5S-L|~;cB5OiB+u7#wlpI7T0$!7jbowZ#ATy zYe*tR=G8vxa>{h^%-d?W4=B)M9#jG+#gU3CG(0H5m-?Z6u*3Yx; zf4Ied^RJ*61%wb7Md4>$z)Uj(SK|1ZN^H#p(GQ^JM_G1YNdvsJ%s-6rws%JpUlJIv zg`NgdddhjU^?*6MCb|1D;K$FxW}*pKJqM?j4tA9@5@dYLic^NuFPD@Y%IOxhGO|!y z)AgcnPY#?$u*h@TuKC3)r?U8$vVhJTczf(NioM%c?!z#p6sBZ#nOP&>)9r6YOkuN_ zc-3DSHZBTPwan)}$v4`Mzq%vK|J3&(}nT&gkQM^hWFHr8J3HEgP>hDImCfqEPR&jkzqn>{?0Yli6U*s>ZW)uf| z)49?zd@^ms>sF!?0(N~BwGfO2<)y-WK9`O(UArb=A)4`n*XbZkpdM`4H&j1xNFXDr~A*CBZ0c{fJL6 zM!_*f35r9$EEWthWBu2!#zgT|WZqTmNAoF;Z9Z~;b}Ht3dz02CTcCd{1c~0Z(N6BQ zm=LxpBJ?W0NC};}DO<|p<;*|yl>^3l=2Hy$yqA#EQTOmYhW|C44UFPNah0`hDT2vX zDDgAN8c#db+01mi;f|9Y*U-8asJg2MyD$?I4I-JkKxu8W7cqY2LkBLSun4Fo%&u)#7nZbip)Dn**U(18&N^G1#y9RP zK0nD4KaO#}+!4X{W0>mG;`CEimt?XJYdsm3$61<~roEy#)$HD!R zLknClYv~KTVA`G6Pxy^z*IWWN8A$$hU`$_ zPVE-)Ba-oFw&h_594u+!@vDaMluX-hiv4cnZ6%#4f&@NOIgWRIHM07y!jf_@)~gDt z4dEJ6A}cOcE!ey(L!e|4T(yC7HQURGeu9wOSW}0LC=M}Me_g@L0kY{2`HctJ(HU)S70Fn>^Zr5?>uoUx7rpUYA>JdR4z56^Ng8k=$rb(i=dCkJ z&x1)bjZh$&LRoC(5lVJAeWpzQ;4Yx;GC9gi5Zo_-Z=#LWVeZ3+gv!+%lw zoas0vkNP*Mci{0rlHv^zY~-#16iZ2vWjDU954{V_FHY2MJrKuIU4|G>l~G)TmCC3+ z+<+jTmt7mR_-;&}B~rSjXbDr07Gq zJnx|_NGSUY9p;+6-%JZR%Z-vTqAuM=+1Am1=8CXgoTyr}%jAR%!g?k6jr-Epjd-rE zGwnPNZOn(8|AgelvJzTx8S#(;EC;LIe;7G_nQ24#R7$fM1eLSYIj0}anZ7l6mOL?j zEy=i{qALHvtUq{G(d43|G}FPH4|)QrdqX`3)rG^7^6leT?3FP*z| zv577>yu(^OEs1J_7nQBiI7|+OWpW$6k=S1i>^5_3kC;nNYqy>Y8Q4iz7hffL$R?ze zM_t6pe798do4?I+jJdirE!vT}w&NS8lUyIj>7b6-G z>8KD7A(Z>Q$zVbR>c zeeUj0jS1u^5tN z9vP<92=)(hJ65UJZ7j`4wY;9Rm?9S5+U>d~BCEm!t9YEf<^M)iS^Kvw{5khJvT}u)Uv5*(~pe4Q5w(hLb@d;9J~qS9}=jTQfOK3;>6m7#$~9>Mu}1q7RqWs(^?!$GM5Wjy04@M8fF}R~@Bst@9PYF4 zef9=8-FGekk9)@l;C`Jo_Ve=jglfKZG;+Ek?eVoqvbG9@J~ zARI?s7svj|Wfml~M<5EX^90%F{?>a>K+Z8}=9ozdU%nN$#>s2(iHarwaE0_{PApT6 z6(Qs+Jz%kA$~aDo(8g;A_Jh=O;|Va887aziOnFdlBdbpx_PTSK3wrFHYkc+Q&wghn zyi|thmix~@d9y&8LgN?aVvvz$vx?{ZJ3-CyZSkQr#uuD`bYzR_tD)y3@PJ5n@s&m% zhSCimsr>9o6*+w(e$mEb7FZq9zaNqYGB>J@@DNajwZU2vC|ZW%7qe+Xx^ufgNJM?; zb1N@hlXr|{>N}vQ!)(vX#z*9j0%>kF6xLv?O+~a9(@3W&?|9g+$75TfT;dduLm?`* z8tf0%1@21rBYm3!AVN+*B;y#DM&`7|?;a+*aYsEm`iitl#Hg4vhTWIf&;MpJ&++bm4QUuf}+@Blc`ejG#sCv|_Nq|8d|`HYDRnl;J3)(@B9 z;gx$4!_DeB+7jSYs?=4PeDK12s{1H{QRqgKH!nwHz8}luU_{R0pS9;2CE~o)OgbTf zFG-#&>fe=0#A3#*y*l~z$0JJb?M$jqhq}@*(FwK>%ptpEYtj${1-85%+ZkUcHh)19Yp}@i4)?7czOie)>tG>WC1;@RZk{V5SQn--MKftCd`bsnOFAfL ziby%4oYe9A7E2DMd1^nw5d^9Gx*JHb!{wy4S0JZv^z_uvq~kZc ziO(ornMyvW=+y@eiK=RxIE*CH@VPZx%@SMs<1EN=D^IGuwOZ`>Avkk1j$bcaXeuH> za9t=PEZ``^kQLVLcPZtv+KC`MhVuqBY4;^lDR3PjLk=yyuvGtDTJIst=NSsyemHiI zqo?%6I$Pl2d~1B?n!ltc8DY}tV#@LiFLc|MyQVPX$uPO} z=7*M~cMs;|v!rcHm_s)P6R>Hw*uRh-zxrtPNP_B3Ld%f-0vmzD!sKY&Fhb=v6BRV( zXY1tSn8)Y-+?jud(u2|#HTZ%X2CdB-=2Ho*Vh4%@W;APw=%ko-Ko-18MCML-9)HbY zmXPR&-Sacl*x;rfbe83V)SQmN$;i7%aB&e|cpQt;;9hjIuUY7;1wLtB7uyZBB z|7S4|^J=!zvcX%;Ho0lFYRvsQ;xlUdLYg4@vqugAQL>nVH+RU%Fk|*qx;%Y?1o-F} ze<$O*-o_%{sOs+Ww?ChcYcUlnZ}3f6Kv7V+4grHw+^%7+fP6OI$Htrg5O@%{wu*^f zPh$Aw`WQPrK3ULtRc1Gt|Jp+DW{GJBVh|^d*!zcZF`Yzw(9ozc8@U9mut>uehbDSh7&rjOkOydvIcw;*wPiV z2oKyQ4s7SnRH_D!w>1gh|NSwB;e}8P7yU@|kl4ZZWyN^eEVlRgYtX&lP*!J=>Gm2^ zNTR}(Wc3_>D?2>~aWZJK^;)?ZOqJ4{yv)O^@iACOF`+0b$gV^`E%>eRh_E78k81~r?x7TJgphbQ6R$4zZuUMI(vfs>t z+e*iB0sm?vZ9}gqRsfa?-CuDyWsKT?YkGogkB2j}GrMQFZ~u^(X;0&JQN)ye^t=H_ zX140bN81*8;vpMW(?o5o@FZms0E<|&kf^Li9nR?@w zO{WG{CXW(kkMoVJTIo_6EU202;!ij5F6K&)$DblSZGtC z_+bN6Eq&E)-sCx#DwTkmWRGuJH(7BaPC?W(<9H=Nm)^+7JGPu4+ch)hV92p9XP3_C zHl&w%$F%AqVaz&obn|zKkH>W8^)A^%n(Q!ojTV(0FtS7NfWt7qLa@h8rrubVU|kze zxO>xXx*7xvsn)``0{KzPAw@^Z?!l)&C^3iFRu>6O3Z||IXrvuc^*T8{{wmJuL5=du zt04vk1pR1nN*lPxc!5RJ1_4-cMY7dCu>z!>P5p-!5h#X2*a117^`Ru?=TCPnU%UsE*+H|Dr62K$F2I{v(n$lyE0 z(438%JDLO696*_xw4sBF`kv7Nv&$My^7n_s{P)SxC*4j9nu;$UX={e+PtOpKyn&ni z5Ph-L#rMGuz{nX7)GAu&5;kcKs6M{YwqCIMe=ogvLr-eIfrI_oLXT?3zrpUH6O)@c=vYN+z` z_dHPdkZN-^R-dj;uV(nP(yU22z88z%COJrkhcO*T`+Foj`hdMf-{fYFFe1qv2y@Td zt}DDxj@Ri&tQ&OY_M)ubhVWwkv>HgNKL32Mv?1VF^G4&`Q(aTj{fP?q+AJ^M(mB+v z$uv*)iR|I)*OOn$#+$j;j2IDyr-m>M=ukNTb!(g&pU{}rZSlJZMDa4 zl=y%{zn5g)U@W@Ac;-L8!E~i4mi2|{$!!L#cr~lw;S1_mB`dJ|4s?%6)v4Mwx=$!b zcn^xU5_b?9|J9r06K1V)jrptP?Ug=M?U`0Kdewm4bHq3kun|Y_(R!Xr+^HD9vF#|& zx-5_jeFidS+vW{S-?9Dl$HsA+`8*}iZD?Tq*ja_RsPWBZL%Y#1Yx&wXgiS~cOJjWu zOS_?1C%KL~chT z#$Ev;OX_nO#ydT@E1spI-H|ZkAcWbB<9)qv(+L7#j^^Cjq;;Dp>!lVt06mnE^KhTt z{pcR<98`)Yj}%KhFxk^(G#jLx;I0I6RkFc<;+<~V>2nMBS&kZ;>%4yaGS(ChP7xzi zBNPlqkKNm4{ekqV&xwUw*-TT_BHUPNTjt<+&V6IXW>qlM&sJk0D*5Xk-unGJ=-bO# zOM#&(mxFgW*0nzd{VHgo@`HS(=|&)u(B-o)q6{e&4X?SDH*LTBedO52ur5AG+7?x<1^Ras&rel{ zRlTLKe6F=vv9R230U>g-hUJ80zlg-o<};&f9B;8c5JRu1574<_z9L#5DmChJy8Pe+ zy_v}z7LU=wNLK7#?Ni-HKU#*9d3my_?hd2hoesGtEsHEbE9&RY1$I)M!dl<3o4=k9 zX6?P1D0|Rrzd|O_Wc8RC8E=O-NXY!GkkN{a?h=R*iA#m*yMKN?-H}Y5F*Fh_*OBtA zC=yh_eef@UrvA}Pc~sx~VRqw9U4{Cd7+o!Fg_?zouVeXx?apL(!#_}V7}{1wM89S9 z7XTnl*2BWOoyFpF-dTrRoGR_pj=Q)zx^B^$&gFV+yGP2TRzOBom zlicviwO&XBb^0tgs7kC>>DABSb+IcA)jb?q4ft%S+FEL!-A+2a^yT*7iH);#VuBA? z@34;~cyE|o#Tkjl{%Cd~6P7EvMaW7h4VLuyb@F7kz1QhXOrGnJ|Jt!)IXQ&Pi}Z&P5Wo@O4sZcH1b6~`0k!}qfHwdO@c7&P zgIIts3XOuIz#wV_BNZhtH2}z7oHUn83A;TJ?ed|)1mOcEDGCi+(v6hPsN z|7(HsQ23mGB{mQc@V7Ah>i`8FfC>Kl!hIlEfEf2){(S!L3O!^82y_n+gaZGXLv?-} zb6B*hbh1(8fFi4blz;z!lelNPP$(HLDA{T#XHd837+@z50dNI+D%Jb z=U$vDlW*}*&qD0$COBFRdfg|zL6%v&O#dij_~8_mtC`}~`ngVXBp;kA!n?8b5RWmf z5^%*|f%&5^ITR%|n&8@5ZP2ebT4$B`3=@EyQ=+HHn~xGi#N69~HYbGt)*?GnOx7o` z71T~*bS&(m)u;x}49=mXpwd*L`v;Evl{ZxTqgZz0gOo@Bwru%)l{88JSD=nv3 z#>*mA!HFQEXAs>Mcej0{Z&cmpz+E>eXXmsXQ$^Tg7Gq-Au(ZveqN#ciBq!E+$x0~T zuc~FN?xSR;)gy~&oKXK!42JNCs68gA_I9$tQKd=N@FMfIO@IEz1;wsBQzqfSa7lnm z(mjsGY{;otue0K2(cAeQUIC?~Q(`Tv8k7X|qFaBni#6f}P_oELYS_M|7GydbFn)$S z&k^VY1hL$0U#((5?P>}Iteou+^#f|jR_q9KPlwMm5(u@bqs6qldI?7C!-K;+C|ES5 z7q>YS2`A#v0lzBLq>GhFVwPa+8Of?NKqi~71xZd4StfH|g`cZw`J}5Kb3Sz-@23Wh zFV1lZO;yw4Gse$WL&#NJoWRUxVB|e;UGWur3Be1+3%4(=gaww{i=A%Ww6O`W?@PC< zem&5Sk(9Z8ReANzosnw2i~fZVgNWX~<`hd9wthb}~F zFfr<}q~0xV5~#cVuCKsybWH^9uGQKCy-2_IYYV9v%MIA_v8a1NUZBquc3+@| zamKsf#;k1wji~Hpqv3_6h3chzcyoBVc*6TfqL}x@8VBa!Z1wP>v1DQooLP*>+Mz~f zo-{9#J_rxbn50m+Wm;m>A1Kd?Mz#yoAr*r%TWztGiBRs3#-7jE$_{*}D9Z*K@K+9% zAW8>|N1>Y9RteaI>8ZD~mQJ>bdMb(xM68K+k6GHD2HR+)uY9%VzldJy%n46id8x24 z&O70+H9tz$-FN>s!m1`A!x%1Aa#^nm`Y`97Lecc@}Cp`RjaCnn5Z zWX9c3haGb6d%*d+1tYO5w{mD6&#FLb4h<6Q3D{0Px*w@FVg=UplVS{zldh?lx=kM_ zfo=|%oZ#H%90|EbEE-}4E4ALS!jQA)%~)>{_g%S@JFT)k0MOr5lAbLzYn69Ws;>4i z4gsI#P;~-W`{`IM%s1Dc;9#<4jc>!{(_DB?XLgveOO^1MU%^H9WSjzac}Gj)xQO=8 zf_~_G60A_F6{~GI#wOg5D}K)RV|`FvZS(W$Pe6z*dPvUanzPB9OJMzhGTYKUH?%x ztyCe^uo&zH`ZWmNBgzSCd~c=UYeWZU=6_|VfM+)B!IHSE&iQ6*g_txA4NPKBIqBCI z+jq{nGn3}IvG&0G>cA0y^=7|^iGXedrA-r6gCj2 zQ~fXlUD)E1r!{W314mxo(kibS`eh+Z-P^nQXCQ$iNSUZ3r{9$KZo*#W$P*nrz=efV zdFF%jZ7lD6DvFkJhhN>%s|3XjZevt+Cb+&u-9yGDL>wpYKWH!vv6^?{5&z|)qrh(M zJUnD$x!9lex_w@Qg6Ye7xn^dgkttRA{P5cVi~WNu4}^@i5L0;y-8EJzpMIdKG@c~P znJtidG#rCZFm2U8G9ke;)SEEsEak9%n)um-m)PF|it%IK_0WJV%nr*AQP_(2^C+5t%8lD8$h(4ODBuGDSrBKAouy=o{{tV z5wx>Syv)kD(_3vZ?CauJ5lMU8bZ2?x@Yuy>ekeZo~%!Y z%X&v17Za3!;mp6p(|4z=Vthyh6Og`*!jQIiQ!Z^;Hd!m4U$$Rx7}RHIlP8y!2WC_k zy1f%XK~DY;AoEa=4O|pt^{>46H)g?v|AR{cAn32@@>g{De-y>}hoagKMrS!TkUalT z^zXV#_ni$5E&w?qsQrE(=xYV~SXS)OEAlnq$y`n&#?NLq1Mgix@d7-d+YDdq3f5Yf zoX?Wud(!JQ3>rKBQoU7(R+=8av^pjgEy?3hQJQo`llepHS%X)P_T8riV|t5g?q@So zKWzl;mtOS`0DI|bC*{4mik>+=^Xu5mNiSz-s6P&-!v#!!)Vjb~#)kQZUh#m@x9#a` z-$Q<}?AL|Lp?k0{T4wH#{|IY{qtd8Xndvc~duRlU#xyQd7v<$-u;!X`DscZDBh?wH z&22h<3yR>2H~M`HxqNW$D3|^s?v#9ACHH(~OVK;CgQ2g54{=XiC0G4ZRIWj3hKA)5 z@>Qh}TCeDLs_>fyzN9`9`2h*8r9X$V4!_qB#=m~dQyuH^nAz8J%@$UKdi>fWhl{X!`Bx_{9EfI5hd^Koy;k}_pLB%W>@|B4jC)=^F zQQ6kFq@P7N#THUu4?$v?i>{@+lZ1{P4$ZtVZ2m&ZQ6KGXqrwZ{=F$BWtIa@*y3|iB z87M+wGkUH5nruU+!mY)fkn-5vulxt;O22E4#Kcrvt7ZZ_lqM+s;ETd77f)ux#RD_#hMh;}K z)6<=&#&^$~j2VcInYu?NW1y5&9}M*g4N&lTT$A;bo9?$|)eK`gZA zy-b#P&n!A}PXTm#(q?QS4hi~wx|9TD4MF)$zm)Rr`t$P_i;v@Ob7S{v$eczRv(*{k zQwaf&&8=aet%+s5EpaK4uxHVt$vg;8chc+H;Ela@8mPnc=0;@Y9#ZJp!n>hDUVb&% zR&T#y{QjQXn>KTJ?)wW>Xckzc$*ToHp3WN;r^eCTh^~ncS?z|BK zm?nLDBt|pPR3JV!0m}LD(J)DMf6L<>LdC4&so~U4`i}AacuDESZH!EuY<5$&P>9+m z>hYhuG~Nh;kSa4l)pgAMouCVDVtgIVQHRW><(mlutb#rDNz{pwzxHYysn+z_+ME>l z;q#&zFPdW73amY!bBE_Wyds`!cH%n_&2-RXO04oQ5Ygk7y|`vuYOu<0%5Z8f@6PC=3?U5 zjI-k4{P$Xg5$9C?1#*WitfSbpqrkZ5s~$i`F+ejBS|5(8H`e%!Ey%-q6vfP)TPT3% z1=^+4z}l}Kv>M`|Xycc!OYrP=DD)Zn{7>3tC@(b2edlFyWeljrxA$9Rf}4*ngEq>hg89X1ky- z_AHQeyOsRc#>!Y%I~{8)I~&TdtKfTq#qStSH_hji)r$O6Hu3P1LszaEQM@F$X>ZMikr0VE zX{qu=(7h{zcJJ`?(1hpG4+PffIXruM1ezzu%1)9mN-ndQ)%7fES9G*p#6U-^r5Z288!fVB^mgVEVm z$5O3%o3F#pw2~W|?eTT5PROTekZZ%Z5@bNYrRABa!aH3gBL5J_1KhCLH+`%%Dxt-p z-tjsP?`5rhp}(t^Z8mknjZAp~jg+sxLRiuEN95V<7N^9p!a0u<@*jrlhB^xCZbR97S>$Lf_^T$^cD$tsTTyN1LmE)hjeHZ zi!&PbK;9Rwy9~PeA`rH4bv&N3E~iK4au~JsQ8JhmS;FdS(s`q1gN+wg*4lBd0A|@} zw$DqU#eivrKXRfAnTJ@!@yq1ACD+PJ`HF^>h5O`gYGV0M{p-@d!HLB_)#i37N6(W= z#YPQPb1iv4C7N@-NcA0O9pcBab(Y^sHB{lCadvV^I&`8K^BA{nb6fPF>rSFTdx2;< z>p3_;^<;-n=(3z)E|=!7Nqwv8mqX&tL#$V$D9d{nn-!L6_Y@K>!lz#z4@WK5+$RgsAxMrGOiilWIeJzZ(eZ_`I+wQG_ zx%-^-rB1u+aKGx8VM`XE%K;G?uFer^eIHYcAeuX+>5bs~`NdbaLFF=IM=xTlO;%_2 zAzn*3SrAAJAuqhW;oMJI!g2Gn*~q2Q(SA!I?Kim%&C9|atY#k(8*-2>LEXzQE>{nf zN*#!)gqubiJZqD5F7hf`qVd%>Pee54j&;J4l2w#a(}o501s?wIcLt#pq{5|`{$qD! zwh^&A!3JXBN(jm$%U*;D@c%nRA;`+e4DbNh0NerI|Hl&kx6Hm!MZ{2?ZG3{|h diff --git a/spec/integration/elastic_integration_spec.rb b/spec/integration/elastic_integration_spec.rb index f8c053cb..47afa601 100644 --- a/spec/integration/elastic_integration_spec.rb +++ b/spec/integration/elastic_integration_spec.rb @@ -6,10 +6,12 @@ # requires xpack enabled & SSL enabled describe 'Logstash executes ingest pipeline', :secure_integration => true do + let(:test_certs_dir) { 'utils/ssl-certs-generator/generated' } + let(:es_http_client_options) { { ssl: { - ca_file: 'spec/fixtures/test_certs/root.crt', + ca_file: "#{test_certs_dir}/root.crt", verify: :none }, socket_timeout: 60, @@ -29,8 +31,8 @@ "password" => integ_user_password, "ssl_enabled" => true, "ssl_verification_mode" => "certificate", - "ssl_certificate" => "spec/fixtures/test_certs/client_from_root.crt", - "ssl_key" => "spec/fixtures/test_certs/client_from_root.key.pkcs8", + "ssl_certificate" => "#{test_certs_dir}/client_from_root.crt", + "ssl_key" => "#{test_certs_dir}/client_from_root.key.pkcs8", "ssl_key_passphrase" => "12345678" } } @@ -116,7 +118,7 @@ context '#pipeline execution' do let(:settings) { super().merge( - "ssl_certificate_authorities" => "spec/fixtures/test_certs/root.crt" + "ssl_certificate_authorities" => "#{test_certs_dir}/root.crt" ) } @@ -1168,7 +1170,7 @@ def path; @path; end context '#multi-pipeline execution' do let(:settings) { super().merge( - "ssl_certificate_authorities" => "spec/fixtures/test_certs/root.crt" + "ssl_certificate_authorities" => "#{test_certs_dir}/root.crt" ) } @@ -1209,7 +1211,7 @@ def path; @path; end context '#failures' do let(:settings) { super().merge( - "ssl_certificate_authorities" => "spec/fixtures/test_certs/root.crt" + "ssl_certificate_authorities" => "#{test_certs_dir}/root.crt" ) } @@ -1273,7 +1275,7 @@ def path; @path; end context '#privileges' do let(:settings) { super().merge( - "ssl_certificate_authorities" => "spec/fixtures/test_certs/root.crt" + "ssl_certificate_authorities" => "#{test_certs_dir}/root.crt" ) } # a user who doesn't have pipeline privileges @@ -1375,7 +1377,7 @@ def path; @path; end context '#emulating real scenario' do let(:settings) { super().merge( - "ssl_certificate_authorities" => "spec/fixtures/test_certs/root.crt" + "ssl_certificate_authorities" => "#{test_certs_dir}/root.crt" ) } let(:index_settings) { @@ -1462,7 +1464,7 @@ def path; @path; end super().merge( # certificate is signed with localhost/127.0.0.1, should complain "ssl_verification_mode" => "full", - "ssl_certificate_authorities" => "spec/fixtures/test_certs/root.crt" + "ssl_certificate_authorities" => "#{test_certs_dir}/root.crt" ) } @@ -1510,4 +1512,64 @@ def path; @path; end end end +<<<<<<< HEAD +======= + context '#unsupported processors' do + let(:settings) { + super().merge( + "ssl_certificate_authorities" => "#{test_certs_dir}/root.crt" + ) + } + + unsupported_processors = { + 'set_security_user' => + '{ + "set_security_user": { + "field": "user" + } + }', + 'inference' => + '{ + "inference": { + "model_id": "model_deployment_for_inference", + "input_output": [{"input_field": "content", "output_field": "content_embedding"}] + } + }', + 'enrich' => + '{ + "enrich": { + "policy_name": "enrich_policy_name", + "field": "source_field", + "target_field": "target_field" + } + }' + } + + before(:each) do + subject.register + end + + shared_examples 'processor failure' do + it 'adds failure tag to metadata' do + events = [LogStash::Event.new( + "message" => "55.3.244.1 GET /index.html 15824 0.043", + "data_stream" => data_stream + )] + + subject.multi_filter(events).each do |event| + failure_reason = event.get("[@metadata][_ingest_pipeline_failure]") + expect(failure_reason).to be_truthy + end + end + end + + unsupported_processors.each do |name, config| + describe "with #{name} processor" do + let(:pipeline_processor) { config } + include_examples 'processor failure' + end + end + end + +>>>>>>> 254e669 (Autorenew SSL certs and use them everywhere (#431)) end \ No newline at end of file diff --git a/src/test/java/co/elastic/logstash/filters/elasticintegration/ElasticsearchRestClientWireMockTest.java b/src/test/java/co/elastic/logstash/filters/elasticintegration/ElasticsearchRestClientWireMockTest.java index 3e3c1aca..26bcb620 100644 --- a/src/test/java/co/elastic/logstash/filters/elasticintegration/ElasticsearchRestClientWireMockTest.java +++ b/src/test/java/co/elastic/logstash/filters/elasticintegration/ElasticsearchRestClientWireMockTest.java @@ -344,6 +344,6 @@ static String getMockResponseBody(final String name) { } static Path generatedCertificateMaterial(final String name) { - return getResourcePath(ElasticsearchRestClientWireMockTest.class, Path.of("ssl-test-certs","generated", name).toString()).orElseThrow(); + return Path.of(System.getProperty("ssl.test.certs.dir")).resolve(name); } } diff --git a/src/test/resources/co/elastic/logstash/filters/elasticintegration/ssl-test-certs/.gitignore b/utils/ssl-certs-generator/.gitignore similarity index 100% rename from src/test/resources/co/elastic/logstash/filters/elasticintegration/ssl-test-certs/.gitignore rename to utils/ssl-certs-generator/.gitignore diff --git a/src/test/resources/co/elastic/logstash/filters/elasticintegration/ssl-test-certs/generate.sh b/utils/ssl-certs-generator/generate.sh similarity index 92% rename from src/test/resources/co/elastic/logstash/filters/elasticintegration/ssl-test-certs/generate.sh rename to utils/ssl-certs-generator/generate.sh index ad5b8686..b6dbff0e 100755 --- a/src/test/resources/co/elastic/logstash/filters/elasticintegration/ssl-test-certs/generate.sh +++ b/utils/ssl-certs-generator/generate.sh @@ -5,6 +5,13 @@ cd "$(dirname "$0")" # This is for testing purposes only set -e +# Check if both `root.crt` created by openssl and the `client_from_root.jks` created by keytool exist. +# There might be cases where keytool is not available on the host but openssl is available. +if [[ -f generated/root.crt ]] && [[ -f generated/client_from_root.jks ]]; then + echo "Certificates already exist. Skipping generation." + exit 0 +fi + rm -rf generated mkdir generated cd generated diff --git a/src/test/resources/co/elastic/logstash/filters/elasticintegration/ssl-test-certs/openssl.cnf b/utils/ssl-certs-generator/openssl.cnf similarity index 100% rename from src/test/resources/co/elastic/logstash/filters/elasticintegration/ssl-test-certs/openssl.cnf rename to utils/ssl-certs-generator/openssl.cnf From bfb4f32b3b6c9fc479eda1da526337bf8fc5b4c5 Mon Sep 17 00:00:00 2001 From: Mashhur Date: Sat, 18 Apr 2026 08:29:00 -0700 Subject: [PATCH 2/5] Resolve conflicts. --- build.gradle | 9 --------- 1 file changed, 9 deletions(-) diff --git a/build.gradle b/build.gradle index d1934783..94cda376 100644 --- a/build.gradle +++ b/build.gradle @@ -107,14 +107,6 @@ dependencies { mockitoAgent('org.mockito:mockito-core:5.23.0') { transitive = false } -<<<<<<< HEAD - testImplementation 'org.junit.jupiter:junit-jupiter-api:5.1.0' - testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.1.0' - testImplementation 'org.mockito:mockito-junit-jupiter:5.14.1' - testImplementation 'org.hamcrest:hamcrest-library:2.2' - testImplementation "com.github.seregamorph:hamcrest-more-matchers:0.1" - testImplementation 'com.github.tomakehurst:wiremock-jre8:2.35.1' -======= testImplementation 'org.junit.jupiter:junit-jupiter-api:5.14.3' testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.14.3' testRuntimeOnly 'org.junit.platform:junit-platform-launcher:1.14.3' @@ -122,7 +114,6 @@ dependencies { testImplementation 'org.hamcrest:hamcrest-library:3.0' testImplementation "com.github.seregamorph:hamcrest-more-matchers:1.0" testImplementation 'org.wiremock:wiremock:3.13.2' ->>>>>>> 254e669 (Autorenew SSL certs and use them everywhere (#431)) testRuntimeOnly requiredLogstashCoreJar("log4j-core") geolite2('org.elasticsearch:geolite2-databases:20191119') { From b16f49e316ef11bd4c423cfa3d02b417251b2589 Mon Sep 17 00:00:00 2001 From: Mashhur Date: Sat, 18 Apr 2026 08:33:33 -0700 Subject: [PATCH 3/5] Resolve spec conflicts. --- spec/integration/elastic_integration_spec.rb | 3 --- 1 file changed, 3 deletions(-) diff --git a/spec/integration/elastic_integration_spec.rb b/spec/integration/elastic_integration_spec.rb index 47afa601..7ff24984 100644 --- a/spec/integration/elastic_integration_spec.rb +++ b/spec/integration/elastic_integration_spec.rb @@ -1512,8 +1512,6 @@ def path; @path; end end end -<<<<<<< HEAD -======= context '#unsupported processors' do let(:settings) { super().merge( @@ -1571,5 +1569,4 @@ def path; @path; end end end ->>>>>>> 254e669 (Autorenew SSL certs and use them everywhere (#431)) end \ No newline at end of file From 3a552a718491d6454a58e653928645777517b9b3 Mon Sep 17 00:00:00 2001 From: Mashhur Date: Mon, 20 Apr 2026 11:03:51 -0700 Subject: [PATCH 4/5] Fix unit tests impacted by test dependencies upgrade. --- .../filters/elasticintegration/PreflightCheckTest.java | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/test/java/co/elastic/logstash/filters/elasticintegration/PreflightCheckTest.java b/src/test/java/co/elastic/logstash/filters/elasticintegration/PreflightCheckTest.java index 95cbafa9..a63e69e0 100644 --- a/src/test/java/co/elastic/logstash/filters/elasticintegration/PreflightCheckTest.java +++ b/src/test/java/co/elastic/logstash/filters/elasticintegration/PreflightCheckTest.java @@ -6,7 +6,6 @@ */ package co.elastic.logstash.filters.elasticintegration; -import com.github.tomakehurst.wiremock.extension.responsetemplating.ResponseTemplateTransformer; import com.github.tomakehurst.wiremock.http.Fault; import com.github.tomakehurst.wiremock.junit5.WireMockExtension; import org.apache.logging.log4j.Logger; @@ -35,7 +34,7 @@ class PreflightCheckTest { static WireMockExtension wireMock = WireMockExtension.newInstance() .options(wireMockConfig() .dynamicPort() - .extensions(new ResponseTemplateTransformer(false))).build(); + .globalTemplating(false)).build(); @Test void checkCredentialsPrivilegesOK() throws Exception { From 6f4f2afad64dac1168d6bac688d22443ec515358 Mon Sep 17 00:00:00 2001 From: Mashhur Date: Mon, 20 Apr 2026 11:23:11 -0700 Subject: [PATCH 5/5] Remove set_security_user processor tests came through backport because no-op set-user processor still exist --- spec/integration/elastic_integration_spec.rb | 6 ------ 1 file changed, 6 deletions(-) diff --git a/spec/integration/elastic_integration_spec.rb b/spec/integration/elastic_integration_spec.rb index 7ff24984..cfe8b291 100644 --- a/spec/integration/elastic_integration_spec.rb +++ b/spec/integration/elastic_integration_spec.rb @@ -1520,12 +1520,6 @@ def path; @path; end } unsupported_processors = { - 'set_security_user' => - '{ - "set_security_user": { - "field": "user" - } - }', 'inference' => '{ "inference": {