mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-19 09:12:39 +00:00
109 lines
3.6 KiB
Gherkin
109 lines
3.6 KiB
Gherkin
Feature: External CA
|
|
|
|
Scenario: Issue a certificate from an external CA
|
|
Given I create a Cloudflare connection as cloudflare
|
|
Then I memorize cloudflare with jq ".appConnection.id" as app_conn_id
|
|
Given I create a external ACME CA with the following config as ext_ca
|
|
"""
|
|
{
|
|
"dnsProviderConfig": {
|
|
"provider": "cloudflare",
|
|
"hostedZoneId": "MOCK_ZONE_ID"
|
|
},
|
|
"directoryUrl": "{PEBBLE_URL}",
|
|
"accountEmail": "[email protected]",
|
|
"dnsAppConnectionId": "{app_conn_id}",
|
|
"eabKid": "",
|
|
"eabHmacKey": ""
|
|
}
|
|
"""
|
|
Then I memorize ext_ca with jq ".id" as ext_ca_id
|
|
Given I create a certificate template with the following config as cert_template
|
|
"""
|
|
{
|
|
"subject": [
|
|
{
|
|
"type": "common_name",
|
|
"allowed": [
|
|
"*"
|
|
]
|
|
}
|
|
],
|
|
"sans": [
|
|
{
|
|
"type": "dns_name",
|
|
"allowed": [
|
|
"*"
|
|
]
|
|
}
|
|
],
|
|
"keyUsages": {
|
|
"required": [],
|
|
"allowed": [
|
|
"digital_signature",
|
|
"key_encipherment",
|
|
"non_repudiation",
|
|
"data_encipherment",
|
|
"key_agreement",
|
|
"key_cert_sign",
|
|
"crl_sign",
|
|
"encipher_only",
|
|
"decipher_only"
|
|
]
|
|
},
|
|
"extendedKeyUsages": {
|
|
"required": [],
|
|
"allowed": [
|
|
"client_auth",
|
|
"server_auth",
|
|
"code_signing",
|
|
"email_protection",
|
|
"ocsp_signing",
|
|
"time_stamping"
|
|
]
|
|
},
|
|
"algorithms": {
|
|
"signature": [
|
|
"SHA256-RSA",
|
|
"SHA512-RSA",
|
|
"SHA384-ECDSA",
|
|
"SHA384-RSA",
|
|
"SHA256-ECDSA",
|
|
"SHA512-ECDSA"
|
|
],
|
|
"keyAlgorithm": [
|
|
"RSA-2048",
|
|
"RSA-4096",
|
|
"ECDSA-P384",
|
|
"RSA-3072",
|
|
"ECDSA-P256",
|
|
"ECDSA-P521"
|
|
]
|
|
},
|
|
"validity": {
|
|
"max": "365d"
|
|
}
|
|
}
|
|
"""
|
|
Then I memorize cert_template with jq ".certificateTemplate.id" as cert_template_id
|
|
Given I create an ACME profile with ca {ext_ca_id} and template {cert_template_id} as "acme_profile"
|
|
When I have an ACME client connecting to "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory"
|
|
Then I register a new ACME account with email [email protected] and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
|
|
When I create certificate signing request as csr
|
|
Then I add names to certificate signing request csr
|
|
"""
|
|
{
|
|
"COMMON_NAME": "localhost"
|
|
}
|
|
"""
|
|
And I create a RSA private key pair as cert_key
|
|
And I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
|
|
And I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
|
|
And I select challenge with type http-01 for domain localhost from order in order as challenge
|
|
And I serve challenge response for challenge at localhost
|
|
And I tell ACME server that challenge is ready to be verified
|
|
And I poll and finalize the ACME order order as finalized_order
|
|
And the value finalized_order.body with jq ".status" should be equal to "valid"
|
|
And I parse the full-chain certificate from order finalized_order as cert
|
|
And the value cert with jq ".subject.common_name" should be equal to "localhost"
|