openssl: Test certificates will expire soon

While working on reproducible builds for openSUSE, some tests fail with expired certificates when setting the build date after 2022-06-01. Originally reported by Bernhard Wiedemann in openSUSE bugzilla. See also:

for cert in `find test -name \*pem` ; do openssl x509 -text < $cert | grep After |grep 2022 && echo $cert ; done 2>&1 |grep -A1 2022
            Not After : Apr 13 10:00:00 2022 GMT
test/ocsp-tests/D1_Issuer_ICA.pem
            Not After : Apr 13 10:00:00 2022 GMT
test/ocsp-tests/ISIC_D1_Issuer_ICA.pem
            Not After : Apr 13 10:00:00 2022 GMT
test/ocsp-tests/WSNIC_D1_Issuer_ICA.pem
            Not After : Apr 13 10:00:00 2022 GMT
test/ocsp-tests/WKIC_D1_Issuer_ICA.pem
            Not After : Jun  1 00:00:00 2022 GMT
test/certs/embeddedSCTs1_issuer.pem
            Not After : Jun  1 00:00:00 2022 GMT
test/certs/embeddedSCTs1.pem

The verbose ouput of test 80-test_ssl_new.t shows:

# ERROR: (int) 'result->result == test_ctx->expected_result' failed @ test/ssl_test.c:33
# [2] compared to [0]
# INFO:  @ test/ssl_test.c:34
# ExpectedResult mismatch: expected Success, got ClientFail.
# 139919277639040:error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired:ssl/record/rec_layer_s3.c:1543:SSL alert number 45
not ok 2 - iteration 2

Since the expiring date is a year from now, could you update these certificates?

About this issue

  • Original URL
  • State: closed
  • Created 3 years ago
  • Reactions: 1
  • Comments: 18 (10 by maintainers)

Commits related to this issue

Most upvoted comments

The setup.sh script (via mkcert) defaults to generating 100-year certs. If some certs in the test-suite are not expiring the early 2100’s, they were generated outside those scripts, which perhaps presently don’t have support for creating certs with SCTs, but that could perhaps be added.

In any case, if new test certs are created, they should have ridiculously long expiration times, so that if QCs some day obsolete RSA, ECDSA, … it’ll be well before these certs expire…