certificate_test.go

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"math/big"
	"strings"
	"testing"
	"time"
)

func newSelfSignedCA(t *testing.T, opts func(*x509.Certificate)) (*x509.Certificate, *rsa.PrivateKey) {
	t.Helper()
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		t.Fatalf("gen key: %v", err)
	}
	tmpl := &x509.Certificate{
		SerialNumber:          big.NewInt(1),
		Subject:               pkix.Name{CommonName: "test ca"},
		NotBefore:             time.Now().Add(-time.Hour),
		NotAfter:              time.Now().Add(time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true,
		IsCA:                  true,
	}
	if opts != nil {
		opts(tmpl)
	}
	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		t.Fatalf("create cert: %v", err)
	}
	cert, err := x509.ParseCertificate(der)
	if err != nil {
		t.Fatalf("parse cert: %v", err)
	}
	return cert, key
}

func TestValidateCAAccepts(t *testing.T) {
	cert, key := newSelfSignedCA(t, nil)
	if err := validateCA(cert, key); err != nil {
		t.Fatalf("expected valid CA, got error: %v", err)
	}
}

func TestValidateCARejectsNonCA(t *testing.T) {
	cert, key := newSelfSignedCA(t, func(c *x509.Certificate) {
		c.IsCA = false
		c.BasicConstraintsValid = false
	})
	err := validateCA(cert, key)
	if err == nil || !strings.Contains(err.Error(), "not a CA") {
		t.Fatalf("expected non-CA rejection, got %v", err)
	}
}

func TestValidateCARejectsMissingKeyUsage(t *testing.T) {
	cert, key := newSelfSignedCA(t, func(c *x509.Certificate) {
		c.KeyUsage = x509.KeyUsageDigitalSignature // no CertSign
	})
	err := validateCA(cert, key)
	if err == nil || !strings.Contains(err.Error(), "KeyUsageCertSign") {
		t.Fatalf("expected missing-key-usage rejection, got %v", err)
	}
}

func TestValidateCARejectsMismatchedKey(t *testing.T) {
	cert, _ := newSelfSignedCA(t, nil)
	otherKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		t.Fatalf("gen other key: %v", err)
	}
	err = validateCA(cert, otherKey)
	if err == nil || !strings.Contains(err.Error(), "does not match") {
		t.Fatalf("expected mismatch rejection, got %v", err)
	}
}

func TestLeafCertCacheLRUEviction(t *testing.T) {
	cert, key := newSelfSignedCA(t, nil)
	c := newLeafCertCache(cert, key)
	c.limit = 3

	hosts := []string{"a.example.com", "b.example.com", "c.example.com", "d.example.com"}
	for _, h := range hosts {
		if _, err := c.get(h); err != nil {
			t.Fatalf("get %s: %v", h, err)
		}
	}
	if got := c.lru.Len(); got != 3 {
		t.Fatalf("expected lru len 3 after eviction, got %d", got)
	}
	// "a" was the oldest; should have been evicted.
	if _, ok := c.index["a.example.com"]; ok {
		t.Fatalf("expected a.example.com to be evicted")
	}
	// "d" was the latest insertion; should be present.
	if _, ok := c.index["d.example.com"]; !ok {
		t.Fatalf("expected d.example.com to be present")
	}
}

func TestLeafCertCacheCaseInsensitive(t *testing.T) {
	cert, key := newSelfSignedCA(t, nil)
	c := newLeafCertCache(cert, key)

	c1, err := c.get("Example.com")
	if err != nil {
		t.Fatalf("get1: %v", err)
	}
	c2, err := c.get("example.COM")
	if err != nil {
		t.Fatalf("get2: %v", err)
	}
	if c1 != c2 {
		t.Fatalf("expected same cert for case variations; got distinct entries")
	}
}