You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@qpid.apache.org by "Robbie Gemmell (JIRA)" <ji...@apache.org> on 2017/11/20 15:12:01 UTC
[jira] [Commented] (QPID-8043) some broker SSL tests fail on Fedora
26
[ https://issues.apache.org/jira/browse/QPID-8043?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16259341#comment-16259341 ]
Robbie Gemmell commented on QPID-8043:
--------------------------------------
The tests use certutil for generating the certs/database and it unfortunately seems that it can only generate comparable certificates to the other components tests by using options that force responses to be entered via a selection prompt process. However, there are a couple of options for adding slightly different extensions that still allowed me to get OpenSSL/Python to validate the server key and allow the tests to pass on Fedora 26 (and still 25) so I'm going with one of those.
> some broker SSL tests fail on Fedora 26
> ---------------------------------------
>
> Key: QPID-8043
> URL: https://issues.apache.org/jira/browse/QPID-8043
> Project: Qpid
> Issue Type: Test
> Components: C++ Tests
> Affects Versions: qpid-cpp-1.36.0
> Reporter: Robbie Gemmell
> Assignee: Robbie Gemmell
> Fix For: qpid-cpp-1.37.0
>
>
> Some of the broker SSL tests fail on Fedora 26, because connection attempts expected to succeed actually fail instead. The same tests pass on Fedora 25 as well as other OSes.
> This seems to be due to behaviour in newer 1.1.0 versions of OpenSSL, which Python uses, and in turn this affects the clients used in the test. The server uses NSS.
> After some sleuthing the issue was identified as OpenSSL saying the CA was invalid, eventually narrowing down to it being due to 'unsupported certificate purpose', and the CA not being marked as applicable for use as a CA when printing out its purposes. The original cert generated in an NSS cert db is marked for CA use, but this doesn't carry through to the exported PEM based cert file. Comparing the CA cert used on the client side to some from other components tests, the rest all have an extension indicating use for CA purposes.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org