server-https-nss-test.yml

name: HTTPS connector with NSS database

on: workflow_call

env:
  DS_IMAGE: ${{ vars.DS_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  # docs/admin/server/Configuring-HTTPS-Connector-with-NSS-Database.adoc
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v4

      - name: Retrieve PKI images
        uses: actions/cache@v4
        with:
          key: pki-images-${{ github.sha }}
          path: pki-images.tar

      - name: Load PKI images
        run: docker load --input pki-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up server container
        run: |
          tests/bin/runner-init.sh pki
        env:
          HOSTNAME: pki.example.com

      - name: Connect server container to network
        run: docker network connect example pki --alias pki.example.com --alias server.example.com

      - name: Create PKI server
        run: |
          docker exec pki pki-server create -v

      - name: Create NSS database in PKI server
        run: |
          docker exec pki pki-server nss-create --no-password

      - name: Create CA signing cert
        run: |
          # generate CA signing CSR
          docker exec pki pki \
              -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-request \
              --subject "CN=CA Signing Certificate" \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --csr $SHARED/ca_signing.csr

          # create CA signing cert
          docker exec pki pki \
              -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-issue \
              --csr $SHARED/ca_signing.csr \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --validity-length 1 \
              --validity-unit year \
              --cert $SHARED/ca_signing.crt

          # check CA signing cert
          openssl x509 -text -noout -in ca_signing.crt

          # import CA signing cert
          docker exec pki pki \
              -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-import \
              --cert $SHARED/ca_signing.crt \
              --trust CT,C,C \
              ca_signing

          # check CA signing cert
          docker exec pki pki \
              -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-show \
              ca_signing

      - name: Create SSL server cert
        run: |
          # generate SSL server CSR
          docker exec pki pki \
              -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-request \
              --subject "CN=pki.example.com" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --csr $SHARED/sslserver.csr

          # issue SSL server cert that expires in 2 minutes
          docker exec pki pki \
              -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-issue \
              --issuer ca_signing \
              --csr $SHARED/sslserver.csr \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --validity-length 2 \
              --validity-unit minute \
              --cert $SHARED/sslserver.crt

          # check SSL server cert
          openssl x509 -text -noout -in sslserver.crt

          # import SSL server cert
          docker exec pki pki \
              -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-import \
              --cert $SHARED/sslserver.crt \
              sslserver

      - name: Create HTTPS connector with NSS database
        run: |
          docker exec pki pki-server jss-enable
          docker exec pki pki-server http-connector-add \
              --port 8443 \
              --scheme https \
              --secure true \
              --sslEnabled true \
              --sslProtocol SSL \
              --sslImpl org.dogtagpki.jss.tomcat.JSSImplementation \
              Secure
          docker exec pki pki-server http-connector-cert-add \
              --keyAlias sslserver \
              --keystoreType pkcs11 \
              --keystoreProvider Mozilla-JSS

      - name: Deploy webapps
        run: |
          docker exec pki pki-server webapp-deploy \
              --descriptor /usr/share/pki/server/conf/Catalina/localhost/ROOT.xml \
              ROOT

          docker exec pki pki-server webapp-deploy \
              --descriptor /usr/share/pki/server/conf/Catalina/localhost/pki.xml \
              pki

      - name: Start PKI server
        run: |
          docker exec pki pki-server start

      - name: Set up client container
        run: |
          tests/bin/runner-init.sh client
        env:
          HOSTNAME: client.example.com

      - name: Connect client container to network
        run: docker network connect example client --alias client.example.com

      - name: Wait for PKI server to start
        run: |
          docker exec client curl \
              --retry 60 \
              --retry-delay 0 \
              --retry-connrefused \
              -s \
              -k \
              -o /dev/null \
              https://pki.example.com:8443

      - name: Check PKI CLI with unknown issuer
        run: |
          # run PKI CLI but don't trust the cert
          echo n | docker exec -i client pki \
              -D org.dogtagpki.client.socketFactory=org.dogtagpki.client.NonBlockingSocketFactory \
              -U https://pki.example.com:8443 \
              info \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          # check stdout
          cat > expected << EOF
            Server URL: https://pki.example.com:8443
          EOF

          diff expected stdout

          # check stderr
          cat > expected << EOF
          WARNING: UNKNOWN_ISSUER encountered on 'CN=pki.example.com' indicates an unknown CA cert 'CN=CA Signing Certificate'
          Trust this certificate (y/N)? IOException: Unable to write to socket: Unable to validate CN=pki.example.com: Unknown issuer: CN=CA Signing Certificate
          EOF

          # TODO: Update the expected stderr once the missing SSL alert is fixed
          # Trust this certificate (y/N)? SEVERE: FATAL: SSL alert sent: UNKNOWN_CA
          # IOException: Unable to write to socket: Unable to validate CN=pki.example.com: Unknown issuer: CN=CA Signing Certificate

          diff expected stderr

          # the cert should not be stored
          docker exec client pki nss-cert-find --subject CN=pki.example.com | tee output

          diff /dev/null output

      - name: Check PKI CLI with unknown issuer with wrong hostname
        run: |
          # run PKI CLI with wrong hostname
          echo n | docker exec -i client pki \
              -D org.dogtagpki.client.socketFactory=org.dogtagpki.client.NonBlockingSocketFactory \
              -U https://server.example.com:8443 \
              info \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          # check stdout
          cat > expected << EOF
            Server URL: https://server.example.com:8443
          EOF

          diff expected stdout

          # check stderr
          cat > expected << EOF
          WARNING: BAD_CERT_DOMAIN encountered on 'CN=pki.example.com' indicates a common-name mismatch
          WARNING: UNKNOWN_ISSUER encountered on 'CN=pki.example.com' indicates an unknown CA cert 'CN=CA Signing Certificate'
          Trust this certificate (y/N)? IOException: Unable to write to socket: Unable to validate CN=pki.example.com: Bad certificate domain: CN=pki.example.com
          EOF

          # TODO: Update the expected stderr once the missing SSL alert is fixed
          # Trust this certificate (y/N)? SEVERE: FATAL: SSL alert sent: ACCESS_DENIED
          # IOException: Unable to write to socket: Unable to validate CN=pki.example.com: Bad certificate domain: CN=pki.example.com

          diff expected stderr

          # the cert should not be stored
          docker exec client pki nss-cert-find --subject CN=pki.example.com | tee output

          diff /dev/null output

      - name: Check PKI CLI with newly trusted server cert
        run: |
          # run PKI CLI and trust the cert
          echo y | docker exec -i client pki \
              -D org.dogtagpki.client.socketFactory=org.dogtagpki.client.NonBlockingSocketFactory \
              -U https://pki.example.com:8443 \
              info \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          # check stdout
          cat > expected << EOF
            Server URL: https://pki.example.com:8443
            Server Name: Dogtag Certificate System
            Server Version: 11.6.0
          EOF

          diff expected stdout

          # check stderr
          cat > expected << EOF
          WARNING: UNKNOWN_ISSUER encountered on 'CN=pki.example.com' indicates an unknown CA cert 'CN=CA Signing Certificate'
          Trust this certificate (y/N)?
          EOF

          # remove trailing whitespace
          sed -i 's/ *$//' stderr

          # append end of line
          echo >> stderr

          diff expected stderr

          # the cert should be stored and trusted
          docker exec client pki nss-cert-find --subject CN=pki.example.com | tee output

          sed -i \
              -e '/^ *Serial Number:/d' \
              -e '/^ *Not Valid Before:/d' \
              -e '/^ *Not Valid After:/d' \
              output

          cat > expected << EOF
            Nickname: CN=pki.example.com
            Subject DN: CN=pki.example.com
            Issuer DN: CN=CA Signing Certificate
            Trust Flags: P,,
          EOF

          diff expected output

      - name: Check PKI CLI with trusted server cert with wrong hostname
        run: |
          # run PKI CLI with wrong hostname
          docker exec client pki \
              -D org.dogtagpki.client.socketFactory=org.dogtagpki.client.NonBlockingSocketFactory \
              -U https://server.example.com:8443 \
              info \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          # check stdout
          cat > expected << EOF
            Server URL: https://server.example.com:8443
            Server Name: Dogtag Certificate System
            Server Version: 11.6.0
          EOF

          diff expected stdout

          # check stderr
          cat > expected << EOF
          WARNING: BAD_CERT_DOMAIN encountered on 'CN=pki.example.com' indicates a common-name mismatch
          EOF

          diff expected stderr

      - name: Check PKI CLI with already trusted server cert
        run: |
          # run PKI CLI with correct hostname
          docker exec client pki \
              -D org.dogtagpki.client.socketFactory=org.dogtagpki.client.NonBlockingSocketFactory \
              -U https://pki.example.com:8443 \
              info \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          # check stdout
          cat > expected << EOF
            Server URL: https://pki.example.com:8443
            Server Name: Dogtag Certificate System
            Server Version: 11.6.0
          EOF

          diff expected stdout

          # check stderr
          diff /dev/null stderr

      - name: Check PKI CLI with expired server cert
        run: |
          sleep 120

          docker exec client pki \
              -D org.dogtagpki.client.socketFactory=org.dogtagpki.client.NonBlockingSocketFactory \
              -U https://pki.example.com:8443 \
              info \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          # check stdout
          cat > expected << EOF
            Server URL: https://pki.example.com:8443
          EOF

          diff expected stdout

          # check stderr
          cat > expected << EOF
          ERROR: EXPIRED_CERTIFICATE encountered on 'CN=pki.example.com' results in a denied SSL server cert!
          IOException: Unable to write to socket: Unable to validate CN=pki.example.com: Expired certificate: CN=pki.example.com
          EOF

          # TODO: Update the expected stderr once the missing SSL alert is fixed
          # SEVERE: FATAL: SSL alert sent: CERTIFICATE_EXPIRED

          diff expected stderr

      - name: Stop PKI server
        run: |
          docker exec pki pki-server stop --wait -v

      - name: Remove PKI server
        run: |
          docker exec pki pki-server remove -v

      - name: Check PKI server systemd journal
        if: always()
        run: |
          docker exec pki journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

      - name: Check PKI debug log
        if: always()
        run: |
          docker exec pki find /var/lib/pki/pki-tomcat/logs/pki -name "debug.*" -exec cat {} \;

      - name: Gather artifacts from server container
        if: always()
        run: |
          tests/bin/pki-artifacts-save.sh pki
        continue-on-error: true

      - name: Upload artifacts from server container
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: server-https-nss-test
          path: |
            /tmp/artifacts/pki