sync cert key from apache thrift

cocolato · Nov 10, 2022 · 6b61841 · 6b61841
1 parent 85caf66
commit 6b61841
Show file tree

Hide file tree

Showing 17 changed files with 642 additions and 261 deletions.
diff --git a/tests/ssl/CA.pem b/tests/ssl/CA.pem
@@ -1,82 +1,133 @@
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number: 16582080088954381212 (0xe61f61fc3b34239c)
-    Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=US, ST=Maryland, L=Forest Hill, O=The Apache Software Foundation, OU=Apache Thrift, CN=localhost/[email protected]
+        Serial Number:
+            0c:6f:84:20:71:35:10:57:ae:8f:47:5d:5a:dc:46:40:03:da:b6:df
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN = localhost, emailAddress = [email protected], OU = Apache Thrift, O = The Apache Software Foundation, L = Forest Hill, ST = Maryland, C = US
         Validity
-            Not Before: Oct  8 08:58:03 2019 GMT
-            Not After : Dec 29 08:58:06 2049 GMT
-        Subject: C=US, ST=Maryland, L=Forest Hill, O=The Apache Software Foundation, OU=Apache Thrift, CN=localhost/[email protected]
+            Not Before: Jun 30 22:37:28 2022 GMT
+            Not After : Sep 16 22:37:28 2030 GMT
+        Subject: CN = localhost, emailAddress = [email protected], OU = Apache Thrift, O = The Apache Software Foundation, L = Forest Hill, ST = Maryland, C = US
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
+                RSA Public-Key: (4096 bit)
                 Modulus:
-                    00:aa:13:d4:c4:f7:01:17:a7:92:d1:b4:b4:15:0d:
-                    21:90:19:5e:fc:fb:b6:6d:3f:f2:3f:65:a2:7a:43:
-                    a6:46:95:fc:43:16:f6:63:14:5e:f7:b1:e3:61:02:
-                    f9:4a:95:89:bf:8d:f9:48:1d:82:e7:34:e0:b2:48:
-                    df:08:d9:7c:3a:2f:d3:1b:0b:e8:ef:c2:41:0a:7d:
-                    0a:38:78:3a:31:66:73:99:8c:d1:79:27:5f:e5:66:
-                    d0:5e:3a:8c:0c:92:18:73:04:c1:f5:45:db:37:e7:
-                    5f:c7:8c:a3:60:e9:92:a0:d8:29:5d:77:48:fb:1d:
-                    b0:ed:12:2c:4e:2e:02:db:3d:1a:41:71:a6:2b:2e:
-                    b3:4c:6a:c7:f7:1d:a9:7e:c7:cf:db:f2:e7:b6:f3:
-                    1f:77:1d:24:01:1a:66:66:30:85:30:02:29:c4:bb:
-                    f7:cd:3f:89:4b:1a:5f:f4:91:96:fb:e9:39:f2:46:
-                    96:12:3d:8a:23:b5:2e:82:9e:41:fe:40:b6:27:b1:
-                    14:44:5c:96:30:0f:55:e4:bb:ad:8b:8a:99:17:c0:
-                    29:11:4e:76:79:9d:4b:03:31:7e:85:3c:a8:23:40:
-                    54:02:58:35:c6:fc:dd:3d:eb:e3:d1:51:00:02:86:
-                    1a:d7:b0:9f:a0:17:73:6a:5a:d0:e6:b6:b8:55:40:
-                    5e:27
+                    00:cf:ee:6a:6d:c1:5e:32:34:c7:a8:5f:76:a7:6b:
+                    e0:04:db:88:30:3b:9e:20:fc:31:28:69:ca:a0:66:
+                    76:93:16:bb:b9:e0:f7:58:2b:64:f0:83:97:b4:ff:
+                    eb:10:ab:75:3f:76:34:8e:e6:0a:99:c0:e6:10:4a:
+                    ff:45:bc:fb:96:3c:36:72:a3:93:06:72:9b:d1:f9:
+                    90:ed:7c:15:0f:a1:1f:59:89:ab:76:f1:e7:b9:b1:
+                    b1:90:04:d4:8c:1b:af:6d:56:fc:ac:61:e8:9c:76:
+                    ef:d6:b2:cb:05:40:53:a9:7d:70:7f:da:4b:9b:77:
+                    a6:5d:2a:65:4c:ac:06:2d:e6:7b:62:7c:f3:3e:a8:
+                    60:0d:c5:35:16:b1:5f:79:0e:e0:8f:22:26:36:2e:
+                    bc:87:e9:5a:65:df:f0:1c:bf:4c:e2:f3:36:44:75:
+                    a4:92:d7:7b:ce:3d:b4:01:ab:4e:d9:be:82:82:f0:
+                    e7:d4:4c:84:88:31:95:2d:39:0c:7d:e7:18:d2:9a:
+                    99:64:38:82:bd:87:e5:da:3e:da:91:73:2a:8a:26:
+                    e2:f0:ab:c8:a8:1c:fc:d5:f2:11:03:5c:ff:51:51:
+                    26:c8:b7:fd:72:bf:36:57:b3:a0:fc:3e:c5:5d:f7:
+                    01:e0:e8:a6:69:8a:56:c4:38:44:93:8d:c9:59:60:
+                    92:c0:83:d9:0d:a8:76:b0:91:fe:bc:aa:8a:b0:39:
+                    05:31:fc:a5:01:5f:bc:24:1f:af:81:ba:ce:44:b3:
+                    48:30:53:0b:d6:48:d8:82:31:24:5b:3c:ee:65:69:
+                    72:ef:b4:9f:eb:b8:f3:6b:dd:c2:c5:00:78:1c:84:
+                    de:8a:40:f7:d3:18:ae:5a:d9:0e:32:d8:97:8d:18:
+                    d2:4c:d6:1c:ae:36:22:cd:e2:07:3d:37:07:85:45:
+                    29:4a:ec:51:76:b9:6d:ca:ae:60:f9:2b:d6:85:72:
+                    71:a9:87:d5:04:f0:5e:d8:24:53:a0:ec:a4:08:ee:
+                    47:7b:54:41:3e:22:ee:c4:84:9e:85:7c:a4:69:74:
+                    80:b5:a9:18:00:71:84:67:5e:d1:9d:15:ff:1d:78:
+                    04:d1:49:f9:91:b6:ba:25:29:2e:f3:09:b2:1a:81:
+                    95:ed:64:22:3f:82:ab:24:90:31:cd:e6:16:99:1d:
+                    05:35:19:9f:25:55:b9:54:5c:eb:ea:06:19:f0:6e:
+                    8c:eb:ea:14:ab:92:f6:b3:a1:a4:24:81:05:5c:1b:
+                    ab:9f:e5:3d:28:2d:bf:2d:ae:06:28:93:c2:51:4b:
+                    32:03:ef:57:ae:97:c5:01:9b:6e:04:f1:3a:32:1d:
+                    ac:bd:62:ea:c9:83:ff:a4:57:91:b2:0c:28:e1:5b:
+                    fe:8e:0d
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                28:F2:FD:30:CD:03:F1:DC:41:1E:C4:93:C6:97:13:CA:D4:FA:60:2A
+                A8:04:E1:24:70:5A:ED:9C:C4:38:63:CD:E7:F8:79:49:94:9D:1D:DA
             X509v3 Authority Key Identifier: 
-                keyid:28:F2:FD:30:CD:03:F1:DC:41:1E:C4:93:C6:97:13:CA:D4:FA:60:2A
+                keyid:A8:04:E1:24:70:5A:ED:9C:C4:38:63:CD:E7:F8:79:49:94:9D:1D:DA
 
-            X509v3 Basic Constraints: 
-                CA:TRUE
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment, Certificate Sign, CRL Sign
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 Subject Alternative Name: 
+                IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1, IP Address:0:0:0:0:0:FFFF:7F00:1, DNS:localhost
     Signature Algorithm: sha256WithRSAEncryption
-         62:9e:2c:f4:05:3e:01:39:37:91:17:eb:c1:07:4f:a0:08:ea:
-         d4:04:b4:cd:45:3e:19:69:df:98:f3:f4:d4:d6:00:c5:06:56:
-         c4:69:7b:9c:bb:94:c7:ce:20:4d:77:59:2d:0c:af:ea:fe:24:
-         49:17:1f:36:41:30:50:6b:d2:09:5d:3c:02:26:42:ff:be:7c:
-         9f:20:b5:12:a3:74:86:bc:13:12:95:d4:62:3c:9d:e2:89:ff:
-         d9:b9:db:93:79:06:75:65:56:81:b9:81:ca:5f:49:ba:c3:56:
-         68:4a:39:c4:12:6d:8e:4c:a8:a4:7d:5e:14:65:48:c8:94:ac:
-         c0:6a:83:57:e8:71:14:e1:e1:97:8e:12:7d:d6:3b:19:33:3b:
-         d2:43:63:50:f1:d9:15:1e:f6:46:d0:34:4a:8d:a9:52:fa:f9:
-         28:d0:a0:5a:6b:4f:89:f8:a7:0e:47:ff:49:50:01:a3:7c:d7:
-         bf:63:3c:be:d8:95:3a:5b:b7:68:ca:55:49:b8:28:86:21:86:
-         80:ad:c6:9c:c0:7e:41:1e:d5:02:eb:99:88:45:90:a8:f6:1a:
-         24:79:31:30:19:cc:28:27:e5:44:09:fa:e5:95:7b:bc:ee:66:
-         67:38:4b:15:de:6e:bb:ca:6f:8c:d8:36:cc:e9:c6:96:62:a2:
-         5e:1a:37:27
+         8b:25:e2:34:d2:d9:d6:eb:b7:b0:92:b6:fc:08:9d:ff:08:9e:
+         36:86:a8:ea:e3:e1:cd:07:0d:85:58:06:2d:f7:26:41:f1:59:
+         ab:02:25:b8:ec:f9:85:ac:41:87:0a:df:fa:c4:f6:26:32:64:
+         0f:dc:c0:81:3c:f7:1d:9e:73:52:57:e3:64:ab:6b:23:cb:21:
+         d5:05:e5:54:a8:f8:33:f7:92:74:c7:4a:2e:f3:b7:78:a0:9b:
+         38:b2:29:3b:0b:a2:58:88:4b:03:8a:c0:5e:66:75:cf:aa:78:
+         e1:3c:0a:e1:31:8b:bc:48:57:8c:65:27:17:cc:f9:75:ba:69:
+         e1:dd:b2:4a:1f:29:24:dd:e2:aa:b3:c8:ef:b0:31:ec:ca:6f:
+         cb:bd:fd:bd:2b:30:63:42:bd:a3:35:7a:d7:16:36:5a:df:3f:
+         64:97:6b:22:c0:7c:59:0a:ca:94:9b:11:1d:6e:21:4c:e0:66:
+         78:52:1b:27:d8:79:ee:83:ac:80:13:8a:13:f2:3a:87:e3:6d:
+         46:ea:7c:5e:cc:26:d0:d3:a9:32:e1:aa:19:27:74:5f:93:ec:
+         84:76:2d:c4:78:5d:db:64:c6:d7:53:17:55:b0:29:c3:36:15:
+         7f:dc:8e:97:6d:19:7e:fa:53:a8:4f:0f:ab:96:5c:32:12:93:
+         c2:22:4b:c1:d7:d7:4c:74:c1:a9:a5:56:f2:b7:cf:3f:54:b1:
+         6c:10:a7:90:c3:12:31:bf:5e:d3:14:e7:da:00:ca:28:86:21:
+         b6:65:95:45:8a:38:e6:9b:09:c2:1d:f1:db:d8:67:0e:33:a0:
+         e6:c2:ad:88:98:6f:6a:af:3d:c2:4f:c9:43:b3:70:23:e7:c2:
+         c3:92:db:69:60:4e:a1:1f:a0:dc:e5:ae:68:77:f5:82:3c:a6:
+         f3:43:87:eb:74:4a:42:bc:36:19:65:9b:8a:3f:84:84:24:23:
+         16:25:aa:ca:78:22:40:a7:cb:1a:4e:76:04:4c:b7:61:fe:f7:
+         c1:42:34:b1:ac:dc:42:24:99:a7:8a:0f:8d:8e:ca:09:6f:77:
+         33:34:21:81:d3:d9:50:d1:7e:1c:29:8c:fb:d2:13:0f:e5:27:
+         26:08:8b:74:74:04:45:8d:18:0f:49:c7:e0:4a:65:1c:66:c8:
+         e7:ab:52:a0:8c:98:89:b0:32:82:ed:2a:e7:44:1e:95:b3:e5:
+         b5:dc:52:49:aa:b2:61:97:68:76:9b:55:6e:d9:de:77:cd:67:
+         07:52:2c:d1:e0:1c:b3:58:04:67:ba:02:4d:7d:f0:21:47:1a:
+         63:ff:f5:76:d5:e3:57:06:35:77:2d:7d:ef:76:6d:a0:ef:e4:
+         83:20:58:e8:b7:e5:7e:70
 -----BEGIN CERTIFICATE-----
-MIIENzCCAx+gAwIBAgIJAOYfYfw7NCOcMA0GCSqGSIb3DQEBCwUAMIGxMQswCQYD
-VQQGEwJVUzERMA8GA1UECAwITWFyeWxhbmQxFDASBgNVBAcMC0ZvcmVzdCBIaWxs
-MScwJQYDVQQKDB5UaGUgQXBhY2hlIFNvZnR3YXJlIEZvdW5kYXRpb24xFjAUBgNV
-BAsMDUFwYWNoZSBUaHJpZnQxEjAQBgNVBAMMCWxvY2FsaG9zdDEkMCIGCSqGSIb3
-DQEJARYVZGV2QHRocmlmdC5hcGFjaGUub3JnMB4XDTE5MTAwODA4NTgwM1oXDTQ5
-MTIyOTA4NTgwNlowgbExCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhNYXJ5bGFuZDEU
-MBIGA1UEBwwLRm9yZXN0IEhpbGwxJzAlBgNVBAoMHlRoZSBBcGFjaGUgU29mdHdh
-cmUgRm91bmRhdGlvbjEWMBQGA1UECwwNQXBhY2hlIFRocmlmdDESMBAGA1UEAwwJ
-bG9jYWxob3N0MSQwIgYJKoZIhvcNAQkBFhVkZXZAdGhyaWZ0LmFwYWNoZS5vcmcw
-ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqE9TE9wEXp5LRtLQVDSGQ
-GV78+7ZtP/I/ZaJ6Q6ZGlfxDFvZjFF73seNhAvlKlYm/jflIHYLnNOCySN8I2Xw6
-L9MbC+jvwkEKfQo4eDoxZnOZjNF5J1/lZtBeOowMkhhzBMH1Rds351/HjKNg6ZKg
-2Cldd0j7HbDtEixOLgLbPRpBcaYrLrNMasf3Hal+x8/b8ue28x93HSQBGmZmMIUw
-AinEu/fNP4lLGl/0kZb76TnyRpYSPYojtS6CnkH+QLYnsRREXJYwD1Xku62LipkX
-wCkRTnZ5nUsDMX6FPKgjQFQCWDXG/N096+PRUQAChhrXsJ+gF3NqWtDmtrhVQF4n
-AgMBAAGjUDBOMB0GA1UdDgQWBBQo8v0wzQPx3EEexJPGlxPK1PpgKjAfBgNVHSME
-GDAWgBQo8v0wzQPx3EEexJPGlxPK1PpgKjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3
-DQEBCwUAA4IBAQBiniz0BT4BOTeRF+vBB0+gCOrUBLTNRT4Zad+Y8/TU1gDFBlbE
-aXucu5THziBNd1ktDK/q/iRJFx82QTBQa9IJXTwCJkL/vnyfILUSo3SGvBMSldRi
-PJ3iif/ZuduTeQZ1ZVaBuYHKX0m6w1ZoSjnEEm2OTKikfV4UZUjIlKzAaoNX6HEU
-4eGXjhJ91jsZMzvSQ2NQ8dkVHvZG0DRKjalS+vko0KBaa0+J+KcOR/9JUAGjfNe/
-Yzy+2JU6W7doylVJuCiGIYaArcacwH5BHtUC65mIRZCo9hokeTEwGcwoJ+VECfrl
-lXu87mZnOEsV3m67ym+M2DbM6caWYqJeGjcn
+MIIGuTCCBKGgAwIBAgIUDG+EIHE1EFeuj0ddWtxGQAPatt8wDQYJKoZIhvcNAQEL
+BQAwgbExEjAQBgNVBAMMCWxvY2FsaG9zdDEkMCIGCSqGSIb3DQEJARYVZGV2QHRo
+cmlmdC5hcGFjaGUub3JnMRYwFAYDVQQLDA1BcGFjaGUgVGhyaWZ0MScwJQYDVQQK
+DB5UaGUgQXBhY2hlIFNvZnR3YXJlIEZvdW5kYXRpb24xFDASBgNVBAcMC0ZvcmVz
+dCBIaWxsMREwDwYDVQQIDAhNYXJ5bGFuZDELMAkGA1UEBhMCVVMwHhcNMjIwNjMw
+MjIzNzI4WhcNMzAwOTE2MjIzNzI4WjCBsTESMBAGA1UEAwwJbG9jYWxob3N0MSQw
+IgYJKoZIhvcNAQkBFhVkZXZAdGhyaWZ0LmFwYWNoZS5vcmcxFjAUBgNVBAsMDUFw
+YWNoZSBUaHJpZnQxJzAlBgNVBAoMHlRoZSBBcGFjaGUgU29mdHdhcmUgRm91bmRh
+dGlvbjEUMBIGA1UEBwwLRm9yZXN0IEhpbGwxETAPBgNVBAgMCE1hcnlsYW5kMQsw
+CQYDVQQGEwJVUzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAM/uam3B
+XjI0x6hfdqdr4ATbiDA7niD8MShpyqBmdpMWu7ng91grZPCDl7T/6xCrdT92NI7m
+CpnA5hBK/0W8+5Y8NnKjkwZym9H5kO18FQ+hH1mJq3bx57mxsZAE1Iwbr21W/Kxh
+6Jx279ayywVAU6l9cH/aS5t3pl0qZUysBi3me2J88z6oYA3FNRaxX3kO4I8iJjYu
+vIfpWmXf8By/TOLzNkR1pJLXe849tAGrTtm+goLw59RMhIgxlS05DH3nGNKamWQ4
+gr2H5do+2pFzKoom4vCryKgc/NXyEQNc/1FRJsi3/XK/NlezoPw+xV33AeDopmmK
+VsQ4RJONyVlgksCD2Q2odrCR/ryqirA5BTH8pQFfvCQfr4G6zkSzSDBTC9ZI2IIx
+JFs87mVpcu+0n+u482vdwsUAeByE3opA99MYrlrZDjLYl40Y0kzWHK42Is3iBz03
+B4VFKUrsUXa5bcquYPkr1oVycamH1QTwXtgkU6DspAjuR3tUQT4i7sSEnoV8pGl0
+gLWpGABxhGde0Z0V/x14BNFJ+ZG2uiUpLvMJshqBle1kIj+CqySQMc3mFpkdBTUZ
+nyVVuVRc6+oGGfBujOvqFKuS9rOhpCSBBVwbq5/lPSgtvy2uBiiTwlFLMgPvV66X
+xQGbbgTxOjIdrL1i6smD/6RXkbIMKOFb/o4NAgMBAAGjgcYwgcMwHQYDVR0OBBYE
+FKgE4SRwWu2cxDhjzef4eUmUnR3aMB8GA1UdIwQYMBaAFKgE4SRwWu2cxDhjzef4
+eUmUnR3aMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgHmMB0GA1Ud
+JQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA+BgNVHREENzA1hwR/AAABhxAAAAAA
+AAAAAAAAAAAAAAABhxAAAAAAAAAAAAAA//9/AAABgglsb2NhbGhvc3QwDQYJKoZI
+hvcNAQELBQADggIBAIsl4jTS2dbrt7CStvwInf8InjaGqOrj4c0HDYVYBi33JkHx
+WasCJbjs+YWsQYcK3/rE9iYyZA/cwIE89x2ec1JX42SrayPLIdUF5VSo+DP3knTH
+Si7zt3igmziyKTsLoliISwOKwF5mdc+qeOE8CuExi7xIV4xlJxfM+XW6aeHdskof
+KSTd4qqzyO+wMezKb8u9/b0rMGNCvaM1etcWNlrfP2SXayLAfFkKypSbER1uIUzg
+ZnhSGyfYee6DrIATihPyOofjbUbqfF7MJtDTqTLhqhkndF+T7IR2LcR4XdtkxtdT
+F1WwKcM2FX/cjpdtGX76U6hPD6uWXDISk8IiS8HX10x0wamlVvK3zz9UsWwQp5DD
+EjG/XtMU59oAyiiGIbZllUWKOOabCcId8dvYZw4zoObCrYiYb2qvPcJPyUOzcCPn
+wsOS22lgTqEfoNzlrmh39YI8pvNDh+t0SkK8Nhllm4o/hIQkIxYlqsp4IkCnyxpO
+dgRMt2H+98FCNLGs3EIkmaeKD42OyglvdzM0IYHT2VDRfhwpjPvSEw/lJyYIi3R0
+BEWNGA9Jx+BKZRxmyOerUqCMmImwMoLtKudEHpWz5bXcUkmqsmGXaHabVW7Z3nfN
+ZwdSLNHgHLNYBGe6Ak198CFHGmP/9XbV41cGNXctfe92baDv5IMgWOi35X5w
 -----END CERTIFICATE-----
diff --git a/tests/ssl/README.md b/tests/ssl/README.md
@@ -1,16 +1,15 @@
 # Test Keys and Certificates
-
 This folder is dedicated to test keys and certificates provided in multiple formats.
 Primary use are unit test suites and cross language tests.
 
     test/keys
 
 **The files in this directory must never be used on production systems.**
 
-
 ## SSL Keys and Certificates
 
-### create certificates
+
+## create certificates
 
 we use the following parameters for test key and certificate creation
 
@@ -27,7 +26,7 @@ we use the following parameters for test key and certificate creation
     openssl x509 -in server.crt -text > CA.pem
     cat server.crt server.key > server.pem
 
-Export password is **thrift**
+Export password is "thrift" without the quotes
 
     openssl pkcs12 -export -clcerts -in server.crt -inkey server.key -out server.p12
 
@@ -41,20 +40,38 @@ create a signing request:
 
 sign the client certificate with the server.key
 
-    openssl x509 -req -days 365 -in client.csr -CA CA.pem -CAkey server.key -set_serial 01 -out client.crt
+    openssl x509 -req -days 3000 -in client.csr -CA CA.pem -CAkey server.key -set_serial 01 -out client.crt
 
-export certificate in PKCS12 format (Export password is **thrift**)
+export certificate in PKCS12 format (Export password is "thrift" without the quotes)
 
     openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12
 
 export certificate in PEM format for OpenSSL usage
 
     openssl pkcs12 -in client.p12 -out client.pem -clcerts
 
+### create client key and certificate with altnames
 
-## Java key and certificate import
+copy openssl.cnf from your system e.g. /etc/ssl/openssl.cnf and append following to the end of [ v3_req ]
+
+    subjectAltName=@alternate_names
+
+    [ alternate_names ]
+    IP.1=127.0.0.1
+    IP.2=::1
+    IP.3=::ffff:127.0.0.1
+
+create a signing request:
 
-Java Test Environment uses key and trust store password **thrift**
+    openssl req -new -key client_v3.key -out client_v3.csr -config openssl.cnf \
+        -subj "/C=US/ST=Maryland/L=Forest Hill/O=The Apache Software Foundation/OU=Apache Thrift/CN=localhost" -extensions v3_req
+
+sign the client certificate with the server.key
+
+    openssl x509 -req -days 3000 -in client_v3.csr -CA CA.pem -CAkey server.key -set_serial 01 -out client_v3.crt -extensions v3_req -extfile openssl.cnf
+
+## Java key and certificate import
+Java Test Environment uses key and trust store password "thrift" without the quotes
 
 list keystore entries
 
@@ -64,9 +81,11 @@ list truststore entries
 
     keytool -list -storepass thrift -keystore ../../lib/java/test/.truststore
 
+
 delete an entry
 
-    keytool -delete -storepass thrift -keystore ../../lib/java/test/.truststore -alias ssltest 
+    keytool -delete -storepass thrift -keystore ../../lib/java/test/.truststore -alias ssltest
+
 
 import certificate into truststore
 

diff --git a/tests/ssl/cert.cer b/tests/ssl/cert.cer
diff --git a/tests/ssl/client.crt b/tests/ssl/client.crt
@@ -1,20 +1,28 @@
 -----BEGIN CERTIFICATE-----
-MIIDVDCCAjwCAQEwDQYJKoZIhvcNAQEFBQAwgbExCzAJBgNVBAYTAlVTMREwDwYD
-VQQIDAhNYXJ5bGFuZDEUMBIGA1UEBwwLRm9yZXN0IEhpbGwxJzAlBgNVBAoMHlRo
-ZSBBcGFjaGUgU29mdHdhcmUgRm91bmRhdGlvbjEWMBQGA1UECwwNQXBhY2hlIFRo
-cmlmdDESMBAGA1UEAwwJbG9jYWxob3N0MSQwIgYJKoZIhvcNAQkBFhVkZXZAdGhy
-aWZ0LmFwYWNoZS5vcmcwHhcNMTQwNDA3MTkwMDMzWhcNMTUwNDA3MTkwMDMzWjCB
-sTELMAkGA1UEBhMCVVMxETAPBgNVBAgMCE1hcnlsYW5kMRQwEgYDVQQHDAtGb3Jl
-c3QgSGlsbDEnMCUGA1UECgweVGhlIEFwYWNoZSBTb2Z0d2FyZSBGb3VuZGF0aW9u
-MRYwFAYDVQQLDA1BcGFjaGUgVGhyaWZ0MRIwEAYDVQQDDAlsb2NhbGhvc3QxJDAi
-BgkqhkiG9w0BCQEWFWRldkB0aHJpZnQuYXBhY2hlLm9yZzCBnzANBgkqhkiG9w0B
-AQEFAAOBjQAwgYkCgYEArrM2HiTf5LT1Qh1JAALWUlJxVJNc1uC8//wZIW8Ekk6z
-H2XkrAOW8Cs7rVfz6Q+x00q7xSH825v9RL6pv4l7sPDSGK5lvc+WkTxDpiR2EjIm
-uWStUzCRq7EXhV50pUno6MFABVtqpRP87TiE1l7Yb8S33v+gAVdsrpJewYIDwWcC
-AwEAATANBgkqhkiG9w0BAQUFAAOCAQEAbGjHLamDm1FQpgatYiZ/ic7Z8DFB+CJo
-FcZH4hww27BD/WpQLsj6T1540B35hsmZ73yev4xgLybc/SEIducT9BHyc1DrDZtf
-CFeSq6OOJu/1pJZ9m/d0i+sBJaWg5w1yT8+aEKJaWYfF+C9jZ6+3+I9agID5OplE
-Wwwzg3xXllz3jfmtNlc0f+hE1/XLWFE2nY+5cBhlxReWH3HAhU/qZL9n/WdxCjHd
-NyeWxlDlmzc2+uOeVF5sIGzFOj/qjGxc+UyUXaaEuSvh7j3rvYlZtnhvhJ+tMkoR
-Kbxl1VUYxx+jzfhBy+bKu5uGZB3F1qtyY9fI5DQut75nNbueQPG+qw==
+MIIE2DCCAsACAQEwDQYJKoZIhvcNAQELBQAwgbExEjAQBgNVBAMMCWxvY2FsaG9z
+dDEkMCIGCSqGSIb3DQEJARYVZGV2QHRocmlmdC5hcGFjaGUub3JnMRYwFAYDVQQL
+DA1BcGFjaGUgVGhyaWZ0MScwJQYDVQQKDB5UaGUgQXBhY2hlIFNvZnR3YXJlIEZv
+dW5kYXRpb24xFDASBgNVBAcMC0ZvcmVzdCBIaWxsMREwDwYDVQQIDAhNYXJ5bGFu
+ZDELMAkGA1UEBhMCVVMwHhcNMjIwNjMwMjIzNzMxWhcNMzAwOTE2MjIzNzMxWjCB
+sTESMBAGA1UEAwwJbG9jYWxob3N0MSQwIgYJKoZIhvcNAQkBFhVkZXZAdGhyaWZ0
+LmFwYWNoZS5vcmcxFjAUBgNVBAsMDUFwYWNoZSBUaHJpZnQxJzAlBgNVBAoMHlRo
+ZSBBcGFjaGUgU29mdHdhcmUgRm91bmRhdGlvbjEUMBIGA1UEBwwLRm9yZXN0IEhp
+bGwxETAPBgNVBAgMCE1hcnlsYW5kMQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMkGl9ZGVq/mTrcojrq7eqZTww1gmgOPNWN1QNzv
+i+cPI8Egbik04n/AFWvgtnvKKnKQfOLkBHJHyTdXmPqvdU9w8Zd9dvXk75mBvbtx
+yse6UZCxZnXrqv5YfMGb2BEvcsL5I5s6d3gL4eNObYzFD7vUjAbpamUSE7NOeMn7
+qO0rPIcODDXL+Okr9/TBcO/XvRSUK0exsX03FC07gtTddV9lEYCkJvQMCCQmFdQ5
+al7Vz4iLleG5hsCwz/W5zHcsqVtzm8CEQzr00AoR8Ar/WkGh1ibmissi5Bo2DcvR
+Ko3pvDVOAY+gj9Ypxe2z7MImn1T7ZVdr0JXUu9jmMgKMQz8CAwEAATANBgkqhkiG
+9w0BAQsFAAOCAgEAH3QwBNbb2IP+ozcM5w4WppG7W/ha0WUcEKgf8Ay7w4/+X79Y
+Z7mxltoCz5Bc54EMXDaoTg5PbwPSmTNDqoFSRf07Fhp8IG5n19CvrTCMFcM8BbDx
+g5CZ6W1WoHpCW6/zNlflsSVFbGSrkwzmpgnn3+EJcVWzMDcQXufpkefbH2x7bHC/
+0JsfEYh5iPyJeDWx0CyiyoqfRx08cDuB/OLZgq63dkDNnd4zqDTT8zLT6zMTq1Ka
+pApb+5o0rapgHQP5+O3QAZrfnWLYXOPk17yQTekvwVpiSzwdPlOija5X+BLrLyNu
+EEYlR7Vz2qj/DAUN9vhCIdF4Bk8Yfk9txH5oJUmC0c2bfUkrCJgfbyK1GL00BkON
+aso8whDf8LF5BAl/ooofzvZXt+bw4Sp+LuX+OAcJUlqeK7IUdHQqnhhw5FOfenVO
+Z7MkMt2qtm3BlPzMWlZoeLNrkx4BzsBElFJ0Ds37uLk+LIg3whg+MYMFJPwXqUhs
+6Ss76/cu/AhoHoX8k5wT5eNpzyWL8hNyDSosGDAgejjYFBXMlNzFYvG5zVE0EP7C
+i78cIdgSARKocOOeFpA3GEJL+ISi0g1ut8A1/kxgFp5dxGjfOAGHeDeaVWhWuhjz
+m7CjPwlfAvIBJJlC96MhPakY6tbyA0hW0/GiOfaoanJvVdWJF7lEdKle1Zs=
 -----END CERTIFICATE-----