6 # Check if running in CI environment
7 if [[ ! "${CI:-false}" == "true" ]]; then
8 echo "ERROR: Not running in CI environment!"
20 echo -e "[\u001B[32mPASS\u001B[0m]"
23 echo -e "[\u001B[31mFAIL\u001B[0m]"
35 _SUBTEST "Checking if file '${1}' exists..."
36 if [[ -e "${1}" ]]; then
39 _FAIL "Missing file: ${1}"
43 _SUBTEST "Checking if log contains '${1}'..."
44 if grep -- "${1}" tmplog > /dev/null; then
47 _FAIL "Missing in log: ${1}"
51 _SUBTEST "Checking if log doesn't contain '${1}'..."
52 if grep -- "${1}" tmplog > /dev/null; then
53 _FAIL "Found in log: ${1}"
59 _SUBTEST "Checking if errorlog is empty..."
60 if [[ -z "$(cat errorlog)" ]]; then
63 _FAIL "Non-empty errorlog"
67 # If not found (should be cached in travis) download ngrok
68 if [[ ! -e "ngrok/ngrok" ]]; then
72 wget https://bin.equinox.io/c/4VmDzA7iaHb/ngrok-stable-linux-amd64.zip -O ngrok.zip
78 # Run ngrok and grab temporary url from logfile
79 ngrok/ngrok http 8080 --log stdout --log-format logfmt --log-level debug > tmp.log &
80 ngrok/ngrok http 8080 --log stdout --log-format logfmt --log-level debug > tmp2.log &
81 ngrok/ngrok http 8080 --log stdout --log-format logfmt --log-level debug > tmp3.log &
83 TMP_URL="$(grep -Eo "Hostname:[a-z0-9]+.ngrok.io" tmp.log | head -1 | cut -d':' -f2)"
84 TMP2_URL="$(grep -Eo "Hostname:[a-z0-9]+.ngrok.io" tmp2.log | head -1 | cut -d':' -f2)"
85 TMP3_URL="$(grep -Eo "Hostname:[a-z0-9]+.ngrok.io" tmp3.log | head -1 | cut -d':' -f2)"
86 if [[ -z "${TMP_URL}" ]] || [[ -z "${TMP2_URL}" ]] || [[ -z "${TMP3_URL}" ]]; then
87 echo "Couldn't get an url from ngrok, not a dehydrated bug, tests can't continue."
91 # Run python webserver in .acme-challenges directory to serve challenge responses
92 mkdir -p .acme-challenges/.well-known/acme-challenge
95 python -m SimpleHTTPServer 8080 > /dev/null 2> /dev/null
98 # Generate config and create empty domains.txt
99 echo 'CA="https://testca.kurz.pw/directory"' > config
100 echo 'CA_TERMS="https://testca.kurz.pw/terms"' >> config
101 echo 'WELLKNOWN=".acme-challenges/.well-known/acme-challenge"' >> config
102 echo 'RENEW_DAYS="14"' >> config
105 # Check if help command is working
106 _TEST "Checking if help command is working..."
107 ./dehydrated --help > tmplog 2> errorlog || _FAIL "Script execution failed"
108 _CHECK_LOG "Default command: help"
109 _CHECK_LOG "--help (-h)"
110 _CHECK_LOG "--domain (-d) domain.tld"
113 # Register account key without LICENSE set
114 _TEST "Register account key without LICENSE set"
115 ./dehydrated --register > tmplog 2> errorlog && _FAIL "Script execution failed"
116 _CHECK_LOG "To accept these terms"
119 # Register account key and agreeing to terms
120 _TEST "Register account key without LICENSE set"
121 ./dehydrated --register --accept-terms > tmplog 2> errorlog || _FAIL "Script execution failed"
122 _CHECK_LOG "Registering account key"
123 _CHECK_FILE accounts/*/account_key.pem
126 # Delete accounts and add LICENSE to config for normal operation
128 echo 'LICENSE="https://testca.kurz.pw/terms/v1"' >> config
130 # Run in cron mode with empty domains.txt (should only generate private key and exit)
131 _TEST "First run in cron mode, checking if private key is generated and registered"
132 ./dehydrated --cron > tmplog 2> errorlog || _FAIL "Script execution failed"
133 _CHECK_LOG "Registering account key"
134 _CHECK_FILE accounts/*/account_key.pem
137 # Temporarily move config out of the way and try signing certificate by using temporary config location
138 _TEST "Try signing using temporary config location and with domain as command line parameter"
140 ./dehydrated --cron --domain "${TMP_URL}" --domain "${TMP2_URL}" --accept-terms -f tmp_config > tmplog 2> errorlog || _FAIL "Script execution failed"
141 _CHECK_NOT_LOG "Checking domain name(s) of existing cert"
142 _CHECK_LOG "Generating private key"
143 _CHECK_LOG "Requesting challenge for ${TMP_URL}"
144 _CHECK_LOG "Requesting challenge for ${TMP2_URL}"
145 _CHECK_LOG "Challenge is valid!"
146 _CHECK_LOG "Creating fullchain.pem"
151 # Add third domain to command-lime, should force renewal.
152 _TEST "Run in cron mode again, this time adding third domain, should force renewal."
153 ./dehydrated --cron --domain "${TMP_URL}" --domain "${TMP2_URL}" --domain "${TMP3_URL}" > tmplog 2> errorlog || _FAIL "Script execution failed"
154 _CHECK_LOG "Domain name(s) are not matching!"
155 _CHECK_LOG "Forcing renew."
156 _CHECK_LOG "Generating private key"
157 _CHECK_LOG "Requesting challenge for ${TMP_URL}"
158 _CHECK_LOG "Requesting challenge for ${TMP2_URL}"
159 _CHECK_LOG "Requesting challenge for ${TMP3_URL}"
160 _CHECK_LOG "Challenge is valid!"
161 _CHECK_LOG "Creating fullchain.pem"
165 # Prepare domains.txt
166 # Modify TMP3_URL to be uppercase to check for upper-lower-case mismatch bugs
167 echo "${TMP_URL} ${TMP2_URL} $(tr 'a-z' 'A-Z' <<<"${TMP3_URL}")" >> domains.txt
169 # Run in cron mode again (should find a non-expiring certificate and do nothing)
170 _TEST "Run in cron mode again, this time with domain in domains.txt, should find non-expiring certificate"
171 ./dehydrated --cron > tmplog 2> errorlog || _FAIL "Script execution failed"
172 _CHECK_LOG "Checking domain name(s) of existing cert... unchanged."
173 _CHECK_LOG "Skipping renew"
176 # Disable private key renew
177 echo 'PRIVATE_KEY_RENEW="no"' >> config
179 # Run in cron mode one last time, with domain in domains.txt and force-resign (should find certificate, resign anyway, and not generate private key)
180 _TEST "Run in cron mode one last time, with domain in domains.txt and force-resign"
181 ./dehydrated --cron --force > tmplog 2> errorlog || _FAIL "Script execution failed"
182 _CHECK_LOG "Checking domain name(s) of existing cert... unchanged."
183 _CHECK_LOG "Ignoring because renew was forced!"
184 _CHECK_NOT_LOG "Generating private key"
185 _CHECK_LOG "Requesting challenge for ${TMP_URL}"
186 _CHECK_LOG "Requesting challenge for ${TMP2_URL}"
187 _CHECK_LOG "Requesting challenge for ${TMP3_URL}"
188 _CHECK_LOG "Already validated!"
189 _CHECK_LOG "Creating fullchain.pem"
193 # Check if signcsr command is working
194 _TEST "Running signcsr command"
195 ./dehydrated --signcsr certs/${TMP_URL}/cert.csr > tmplog 2> errorlog || _FAIL "Script execution failed"
196 _CHECK_LOG "BEGIN CERTIFICATE"
197 _CHECK_LOG "END CERTIFICATE"
198 _CHECK_NOT_LOG "ERROR"
200 # Check if renewal works
201 _TEST "Run in cron mode again, to check if renewal works"
202 echo 'RENEW_DAYS="300"' >> config
203 ./dehydrated --cron > tmplog 2> errorlog || _FAIL "Script execution failed"
204 _CHECK_LOG "Checking domain name(s) of existing cert... unchanged."
205 _CHECK_LOG "Renewing!"
208 # Check if certificate is valid in various ways
209 _TEST "Verifying certificate..."
210 _SUBTEST "Verifying certificate on its own..."
211 openssl x509 -in "certs/${TMP_URL}/cert.pem" -noout -text > tmplog 2> errorlog && _PASS || _FAIL
212 _CHECK_LOG "CN=${TMP_URL}"
213 _CHECK_LOG "${TMP2_URL}"
214 _SUBTEST "Verifying file with full chain..."
215 openssl x509 -in "certs/${TMP_URL}/fullchain.pem" -noout -text > /dev/null 2>> errorlog && _PASS || _FAIL
216 _SUBTEST "Verifying certificate against CA certificate..."
217 curl -s https://testca.kurz.pw/acme/issuer-cert | openssl x509 -inform DER -outform PEM > ca.pem
218 (openssl verify -verbose -CAfile "ca.pem" -purpose sslserver "certs/${TMP_URL}/fullchain.pem" 2>&1 || true) | (grep -v ': OK$' || true) >> errorlog 2>> errorlog && _PASS || _FAIL
221 # Revoke certificate using certificate key
222 _TEST "Revoking certificate..."
223 ./dehydrated --revoke "certs/${TMP_URL}/cert.pem" --privkey "certs/${TMP_URL}/privkey.pem" > tmplog 2> errorlog || _FAIL "Script execution failed"
224 REAL_CERT="$(readlink -n "certs/${TMP_URL}/cert.pem")"
225 _CHECK_LOG "Revoking certs/${TMP_URL}/${REAL_CERT}"
227 _CHECK_FILE "certs/${TMP_URL}/${REAL_CERT}-revoked"
230 # Enable private key renew
231 echo 'PRIVATE_KEY_RENEW="yes"' >> config
232 echo 'PRIVATE_KEY_ROLLOVER="yes"' >> config
234 # Check if Rolloverkey creation works
235 _TEST "Testing Rolloverkeys..."
236 _SUBTEST "First Run: Creating rolloverkey"
237 ./dehydrated --cron --domain "${TMP2_URL}" > tmplog 2> errorlog || _FAIL "Script execution failed"
238 CERT_ROLL_HASH=$(openssl rsa -in certs/${TMP2_URL}/privkey.roll.pem -outform DER -pubout 2>/dev/null | openssl sha256)
239 _CHECK_LOG "Generating private key"
240 _CHECK_LOG "Generating private rollover key"
241 _SUBTEST "Second Run: Force Renew, Use rolloverkey"
242 ./dehydrated --cron --force --domain "${TMP2_URL}" > tmplog 2> errorlog || _FAIL "Script execution failed"
243 CERT_NEW_HASH=$(openssl rsa -in certs/${TMP2_URL}/privkey.pem -outform DER -pubout 2>/dev/null | openssl sha256)
244 _CHECK_LOG "Generating private key"
245 _CHECK_LOG "Moving Rolloverkey into position"
246 _SUBTEST "Verifying Hash Rolloverkey and private key second run"
247 [[ "${CERT_ROLL_HASH}" = "${CERT_NEW_HASH}" ]] && _PASS || _FAIL
250 # Test cleanup command
251 _TEST "Cleaning up certificates"
252 ./dehydrated --cleanup > tmplog 2> errorlog || _FAIL "Script execution failed"
253 _CHECK_LOG "Moving unused file to archive directory: ${TMP_URL}/cert-"
254 _CHECK_LOG "Moving unused file to archive directory: ${TMP_URL}/chain-"
255 _CHECK_LOG "Moving unused file to archive directory: ${TMP_URL}/fullchain-"