Show More
@@ -1,26 +1,50 b'' | |||||
1 | Certificates created with: |
|
1 | Generate a private key (priv.pem): | |
2 | printf '.\n.\n.\n.\n.\nlocalhost\nhg@localhost\n' | \ |
|
2 | ||
3 | openssl req -newkey rsa:512 -keyout priv.pem -nodes -x509 -days 9000 -out pub.pem |
|
3 | $ openssl genrsa -out priv.pem 2048 | |
4 | Can be dumped with: |
|
4 | ||
5 | openssl x509 -in pub.pem -text |
|
5 | Generate 2 self-signed certificates from this key (pub.pem, pub-other.pem): | |
|
6 | ||||
|
7 | $ printf '.\n.\n.\n.\n.\nlocalhost\nhg@localhost\n' | \ | |||
|
8 | openssl req -new -x509 -key priv.pem -nodes -sha256 -days 9000 -out pub.pem | |||
|
9 | ||||
|
10 | $ printf '.\n.\n.\n.\n.\nlocalhost\nhg@localhost\n' | \ | |||
|
11 | openssl req -new -x509 -key priv.pem -nodes -sha256 -days 9000 -out pub-other.pem | |||
6 |
|
12 | |||
7 | - priv.pem |
|
13 | Now generate an expired certificate by turning back the system time: | |
8 | - pub.pem |
|
14 | ||
9 | - pub-other.pem |
|
15 | $ date --set='2016-01-01T00:00:00Z' | |
|
16 | $ printf '.\n.\n.\n.\n.\nlocalhost\nhg@localhost\n' | \ | |||
|
17 | openssl req -new -x509 -key priv.pem -nodes -sha256 -days 1 -out pub-expired.pem | |||
10 |
|
18 | |||
11 | pub.pem patched with other notBefore / notAfter: |
|
19 | Generate a certificate not yet active by advancing the system time: | |
|
20 | ||||
|
21 | $ date --set='2030-01-01T00:00:00Z' | |||
|
22 | $ printf '.\n.\n.\n.\n.\nlocalhost\nhg@localhost\n' | \ | |||
|
23 | openssl req -new -x509 -key priv.pem -nodes -sha256 -days 1 -out pub-not-yet.pem | |||
12 |
|
24 | |||
13 | - pub-not-yet.pem |
|
25 | Note: When adjusting system time, verify the time change sticks. If running | |
14 | - pub-expired.pem |
|
26 | systemd, you may want to use `timedatectl set-ntp false` and e.g. | |
|
27 | `timedatectl set-time '2016-01-01 00:00:00'` to set system time. | |||
|
28 | ||||
|
29 | Generate a passphrase protected client certificate private key: | |||
|
30 | ||||
|
31 | $ openssl genrsa -aes256 -passout pass:1234 -out client-key.pem 2048 | |||
|
32 | ||||
|
33 | Create a copy of the private key without a passphrase: | |||
|
34 | ||||
|
35 | $ openssl rsa -in client-key.pem -passin pass:1234 -out client-key-decrypted.pem | |||
15 |
|
36 | |||
16 | Client certificates created with: |
|
37 | Create a CSR and sign the key using the server keypair: | |
17 | openssl genrsa -aes128 -passout pass:1234 -out client-key.pem 512 |
|
38 | ||
18 | openssl rsa -in client-key.pem -passin pass:1234 -out client-key-decrypted.pem |
|
39 | $ printf '.\n.\n.\n.\n.\n.\nhg-client@localhost\n.\n.\n' | \ | |
19 | printf '.\n.\n.\n.\n.\n.\nhg-client@localhost\n.\n.\n' | \ |
|
40 | openssl req -new -key client-key.pem -passin pass:1234 -out client-csr.pem | |
20 | openssl req -new -key client-key.pem -passin pass:1234 -out client-csr.pem |
|
41 | $ openssl x509 -req -days 9000 -in client-csr.pem -CA pub.pem -CAkey priv.pem \ | |
21 | openssl x509 -req -days 9000 -in client-csr.pem -CA pub.pem -CAkey priv.pem \ |
|
42 | -set_serial 01 -out client-cert.pem | |
22 | -set_serial 01 -out client-cert.pem |
|
|||
23 |
|
43 | |||
24 | - client-key.pem |
|
44 | When replacing the certificates, references to certificate fingerprints will | |
25 | - client-key-decrypted.pem |
|
45 | need to be updated in test files. | |
26 | - client-cert.pem |
|
46 | ||
|
47 | Fingerprints for certs can be obtained by running: | |||
|
48 | ||||
|
49 | $ openssl x509 -in pub.pem -noout -sha1 -fingerprint | |||
|
50 | $ openssl x509 -in pub.pem -noout -sha256 -fingerprint |
@@ -1,9 +1,17 b'' | |||||
1 | -----BEGIN CERTIFICATE----- |
|
1 | -----BEGIN CERTIFICATE----- | |
2 | MIIBPjCB6QIBATANBgkqhkiG9w0BAQsFADAxMRIwEAYDVQQDDAlsb2NhbGhvc3Qx |
|
2 | MIICyTCCAbECAQEwDQYJKoZIhvcNAQELBQAwMTESMBAGA1UEAwwJbG9jYWxob3N0 | |
3 | GzAZBgkqhkiG9w0BCQEWDGhnQGxvY2FsaG9zdDAeFw0xNTA1MDcwNjI5NDVaFw0z |
|
3 | MRswGQYJKoZIhvcNAQkBFgxoZ0Bsb2NhbGhvc3QwHhcNMTYwNzEzMDQ0NzIxWhcN | |
4 | OTEyMjcwNjI5NDVaMCQxIjAgBgkqhkiG9w0BCQEWE2hnLWNsaWVudEBsb2NhbGhv |
|
4 | NDEwMzA0MDQ0NzIxWjAkMSIwIAYJKoZIhvcNAQkBFhNoZy1jbGllbnRAbG9jYWxo | |
5 | c3QwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAmzgtLeCUBhT3ZuDmQ+BE81bzh7AH |
|
5 | b3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6upuVmEs1dTpBWRe | |
6 | R9Yl8ApxwKnUAIcB1k95opsUKKdUxgoBVtWoGTKtn9PKvxpJ8zPjE7j4qwIDAQAB |
|
6 | 4LLM1ARhnMQpI6jaQ8JKzQghMU/3T3n6Qkimt2HmxuiczvsawAbUPpBAxZbBnKmX | |
7 | MA0GCSqGSIb3DQEBCwUAA0EAfBTqBG5pYhuGk+ZnyUufgS+d7Nk/sZAZjNdCAEj/ |
|
7 | bKMiXjtQaO4o4gnyNZVuBgkq2Grc2BREOf0vtUvnPumlnjyAcMNRm6iVbbOerPzV | |
8 | NFPo5fR1jM6jlEWoWbeg298+SkjV7tfO+2nt0otUFkdM6A== |
|
8 | Dn1nH7Ljf9UKyGl/Qj6eOAgez/TDui2fo5FUfaqUzF8B7FoaRmsErZZU9pJ+etKX | |
|
9 | M2DlLGofYNbOi+K0RbPypKNzeInNUnvh9JXKntmLQHRwXDSvcGveKepfVlmz/qme | |||
|
10 | DqhQSonIXTektdyZ5g9dOvxEjQSYHp+7exIKvrpXLfou3s9nCUTs6ekQLi1Tb4Pn | |||
|
11 | gbhauwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQDVgUHJlu4quQCfeHPoemj+6Jp+ | |||
|
12 | M140lY7DGFyiGfHP7KcxXiJHagbUC5D1IPYARwhh7Rdssy0FsmWQKYl8LXKvstz4 | |||
|
13 | zCgz9gxb7vydkZLF49lP1I13Pekoz99381RrXUYomHbx6jKPiOha7ikfAUefop0n | |||
|
14 | uwfeQ5f6mfr0AcXmu6W7PHYMcPTK0ZyzoZwobRktKZ+OiwjW/nyolbdXxwU+kRQs | |||
|
15 | r0224+GBuwPWmXAobHgPhtClHXYa2ltL1qFFQJETJt0HjhH89jl5HWJl8g3rqccn | |||
|
16 | AkyiRIGDAWJsiQTOK7iOy0JSbmT1ePrhAyUoZO8GPbBsOdSdBMM32Y3HAKQz | |||
9 | -----END CERTIFICATE----- |
|
17 | -----END CERTIFICATE----- |
@@ -1,9 +1,27 b'' | |||||
1 | -----BEGIN RSA PRIVATE KEY----- |
|
1 | -----BEGIN RSA PRIVATE KEY----- | |
2 | MIIBOgIBAAJBAJs4LS3glAYU92bg5kPgRPNW84ewB0fWJfAKccCp1ACHAdZPeaKb |
|
2 | MIIEpQIBAAKCAQEA6upuVmEs1dTpBWRe4LLM1ARhnMQpI6jaQ8JKzQghMU/3T3n6 | |
3 | FCinVMYKAVbVqBkyrZ/Tyr8aSfMz4xO4+KsCAwEAAQJAeKDr25+Q6jkZHEbkLRP6 |
|
3 | Qkimt2HmxuiczvsawAbUPpBAxZbBnKmXbKMiXjtQaO4o4gnyNZVuBgkq2Grc2BRE | |
4 | AfMtR+Ixhk6TJT24sbZKIC2V8KuJTDEvUhLU0CAr1nH79bDqiSsecOiVCr2HHyfT |
|
4 | Of0vtUvnPumlnjyAcMNRm6iVbbOerPzVDn1nH7Ljf9UKyGl/Qj6eOAgez/TDui2f | |
5 | AQIhAM2C5rHbTs9R3PkywFEqq1gU3ztCnpiWglO7/cIkuGBhAiEAwVpMSAf77kop |
|
5 | o5FUfaqUzF8B7FoaRmsErZZU9pJ+etKXM2DlLGofYNbOi+K0RbPypKNzeInNUnvh | |
6 | 4h/1kWsgMALQTJNsXd4CEUK4BOxvJIsCIQCbarVAKBQvoT81jfX27AfscsxnKnh5 |
|
6 | 9JXKntmLQHRwXDSvcGveKepfVlmz/qmeDqhQSonIXTektdyZ5g9dOvxEjQSYHp+7 | |
7 | +MjSvkanvdFZwQIgbbcTefwt1LV4trtz2SR0i0nNcOZmo40Kl0jIquKO3qkCIH01 |
|
7 | exIKvrpXLfou3s9nCUTs6ekQLi1Tb4PngbhauwIDAQABAoIBABATjQuCSPQ1RuEk | |
8 | mJHzZr3+jQqeIFtr5P+Xqi30DJxgrnEobbJ0KFjY |
|
8 | lk2gTt4vkpKM5hfXpWA/uqi/Zq4eP9mDinngyPAB1i5Emv6bNqBvlzTU4GnlQEi9 | |
|
9 | XmyD2YVDX+RecBPQBHBgUpA9Ll5zKbvr3yNszUgF8sRebwQeNdgBteMGLXu9cB18 | |||
|
10 | jAQa1uTXdDQ6WyuN9LSO3nsNKzal8uucnZxdfFDIHx0MahPlrPfAkqzeKxxfyyRE | |||
|
11 | jzia24oE+ewE8GHX/TvYnPybCPmBtRwbldA32vx8HbDCvlJanw3dyL98isBa5prr | |||
|
12 | DsFaDltWzTKdJOIntdTJXRUDwYp7526bUEdGo/1FddbjW6Th8sXiJu91nL3BD/Qk | |||
|
13 | mW102bECgYEA/zEtKgXjPeV9e3/vvAYU2Bsq8TkmhU6ZiZOQCdPWUNOsyfxibJBk | |||
|
14 | XXsldtZ111vX/+fdGVPFJRoL1Qf4Xjf3MILVhAAcmfTpnWkdbveOrdCjbACE/ReQ | |||
|
15 | xkExZdXhBd9YTS8IelL/Hv45FUo7UWWitgtvTG6caN3LaBTx1o2DiTkCgYEA66jS | |||
|
16 | RQrsjRNT+cf7HBmKrKd7EknAH2v83ZyPd49BSBiNnmWaqPG2NxCLWpKks20xvRo2 | |||
|
17 | j8nftCsu9vSXv+KLnSb2CfOefvNoui7wQyiiWxrMBEPn8DS5E7ctqAiIhQsWEK+e | |||
|
18 | n9E0PW/wyKI1Gk5U1nHwEJt196kYPzD8QgnwB5MCgYEAloVrHl5aqyex3CaaQU1U | |||
|
19 | /iMIMUCEeBzkc0GWtDU/NG2mfX1gkKiaiokYj//vgheqUEdzIn1Gy5uRXxZUaT6Z | |||
|
20 | jwOc7T8jn6vWIALgWZOrlNp7ijjEOISt4EKT4H1HPS9/5gbX+U77LEzHXsdqNZi9 | |||
|
21 | YKNeArc7ip9IWxv/iY3vCAECgYEAgMjOuGqC4Ynpf3x5T17p+PbB/DmPo9xY4ScZ | |||
|
22 | BEamb2bzpddy0NbfNHJ3JXU0StXms6gqnyO8e/KJhO4gK/37PFO5a7DWMhyFZBIY | |||
|
23 | vSrspwsa6U3O5+d4KT0W11hqewKW+WFwN3iVqumM1ahHiuu500OK5RiAPGsNVCNK | |||
|
24 | CDD0Gr8CgYEAzwTt62ke3zCFOZ2E6EIR6eM+0Q9+B5zceU8DAZaTTxP4532HnT6/ | |||
|
25 | iHMQvUh0KBE4Rxw3MeSgpe7gKIcMKXubrcDIsEz8vhhOM1xsYIzVEWLtoCLPTaSF | |||
|
26 | OWQsk98VDt3SgEjb25nOjJ24zZzUVk45OiGUoxfn1Bp6BbJH7IDihCk= | |||
9 | -----END RSA PRIVATE KEY----- |
|
27 | -----END RSA PRIVATE KEY----- |
@@ -1,12 +1,30 b'' | |||||
1 | -----BEGIN RSA PRIVATE KEY----- |
|
1 | -----BEGIN RSA PRIVATE KEY----- | |
2 | Proc-Type: 4,ENCRYPTED |
|
2 | Proc-Type: 4,ENCRYPTED | |
3 | DEK-Info: AES-128-CBC,C8B8F103A61A336FB0716D1C0F8BB2E8 |
|
3 | DEK-Info: AES-256-CBC,ADE9D82AA8D8023CD4E9B67FECD9FE08 | |
4 |
|
4 | |||
5 | JolMlCFjEW3q3JJjO9z99NJWeJbFgF5DpUOkfSCxH56hxxtZb9x++rBvBZkxX1bF |
|
5 | tjMPfTx/dFicleUbh4pH4f5RUtgZwamcU/uy246wk+f2EBG7pVKEEmoXm8rWW2tW | |
6 | BAIe+iI90+jdCLwxbILWuFcrJUaLC5WmO14XDKYVmr2eW9e4MiCYOlO0Q6a9rDFS |
|
6 | xlp9BjL6yCBxoB/GGPjFAoqjQmnUQMxy/P0OWqur3t0+GrB4Fw9hB82fxgnAaydF | |
7 | jctRCfvubOXFHbBGLH8uKEMpXEkP7Lc60FiIukqjuQEivJjrQirVtZCGwyk3qUi7 |
|
7 | 10fw+bRMCfxJMRfa2nEkLzL9za6TF0IOvAYYza/rCxgOQiLg/py9V29wjVnIW9Dt | |
8 | Eyh4Lo63IKGu8T1Bkmn2kaMvFhu7nC/CQLBjSq0YYI1tmCOkVb/3tPrz8oqgDJp2 |
|
8 | B/GxfblTv9K2JBEVdKNWIGT1ZGxem8qiXctbufIXDr+dEEoFUKh+wvkmwVhBaSXi | |
9 | u7bLS3q0xDNZ52nVrKIoZC/UlRXGlPyzPpa70/jPIdfCbkwDaBpRVXc+62Pj2n5/ |
|
9 | gw6fAoATz0Lpd+9d0bqEC1wC3NFdxABYUjZMQ7+xtNzaSCdXiWgv4ix1kzoY8rIi | |
10 | CnO2xaKwfOG6pDvanBhFD72vuBOkAYlFZPiEku4sc2WlNggsSWCPCIFwzmiHjKIl |
|
10 | mnaSH1VdO27fzA0aOgi6/FAYCT0H3bEQIPgcA47kpty8a27OCylHZGa+vnmBnEtv | |
11 | bWmdoTq3nb7sNfnBbV0OCa7fS1dFwCm4R1NC7ELENu0= |
|
11 | qZeO9kX3Dmoi7vzXL8vjf41ZY7eTU6kYWktdBw/gM65goGINPFx85gli3k5I7+TR | |
|
12 | DQ1shyAmmMU9rH+YamZ9Hs4SLfAe7xPI/7i/upMsz56c57/HlvUwHr0as+L7WDZP | |||
|
13 | iX/oW2DQmwN/C5owMPttM7dg2PvSw/Blte5lvloLbmhQTzzw0MDkPHkGt+5Hhjcl | |||
|
14 | NwoaVCzT4Kg3E7fcXrKr80vYP9fOQIbCT5qtZ2/cTNLk8XYmLJm8Q7e1XqvuY9sQ | |||
|
15 | K7xQ5iLz0PjWDtgbculcb3tQIIUcf/Ss9nCakWr6r4pPIQjDVJh07L7ou76n2PVs | |||
|
16 | zJh6cJBgTEUaRWTQgGVH9euyQU3pXHLR0nk5zN4uAOVWdR7eiiskYwT3pM6HiER8 | |||
|
17 | ZYTs+fJtQD9gJPhBAa3LX5L7kWADxGFdAH5qoTn1SSJY4RIVFVfRfxXmQuTGlRQB | |||
|
18 | UEh5Q3bdYKeauw3E9kBaYMYu19223XsAyuvs7/nB02DV6dFjTCGLsrv3JEgf+Wx6 | |||
|
19 | biCfoOrR1Kt2ez8QR9/6TIbz36kc2Jo3m2jKqUrNx1/gLj+coklSET09IwRZ0voi | |||
|
20 | 7ype+4mHFEzwiSxmugLfdnU8d9PkzFzUiu3qSYeD2DR9hBgnZtgu0fFnSCmqFDXG | |||
|
21 | H1yWy6X6Wiqx6abPVq1ODZgeTmsjJsMLDB6PUbQyESp9ICRJyPPCrMi6UpLrWMto | |||
|
22 | A764n5w8B2g/GPJfz1sPePZYi6sumd9UqTQ8UhM644oOlxPWufiBeTiPm1W73PSZ | |||
|
23 | 6DmLyVEh+kcfID6xq3tWVAuiPO1jMpQGoLKXO7oxGvmTNY/Va++j22DpzNoj1hTJ | |||
|
24 | cnFOQZARKrSooAnngwUP68tGVo/+fxzWG95t7IZy8BvszP09VT1jcHOfFIZqHa/V | |||
|
25 | rI/JrWSK+tu75Ot63QQpm1x7xSctMZg71w7riVipA+8F1FBdmp+lhOQkEMytngIA | |||
|
26 | jKovkuwo8AiQvYCDspEcGSroQmOh1d5TraRyhTuRdiefLVSh05kVGCd6/UsVqdZs | |||
|
27 | j+HEyepn4/A9xpHRBTWfCwBFFktAgSdCUOLh5xsT2MbbT/0wDoneD/uay0NakWXB | |||
|
28 | zuVsaasx0Yl2cqvXKVUMphmbqMa859BNVqEK3l3tYZdvHiwT8J1LnEEK4KiBa2zZ | |||
|
29 | +8FcFvD8x1NZBcCBArYP59MbCQOC2QBPJe/oCiUVhN8kRIwlwOhytbW+QIuLZHi4 | |||
12 | -----END RSA PRIVATE KEY----- |
|
30 | -----END RSA PRIVATE KEY----- |
@@ -1,10 +1,27 b'' | |||||
1 | -----BEGIN PRIVATE KEY----- |
|
1 | -----BEGIN RSA PRIVATE KEY----- | |
2 | MIIBVAIBADANBgkqhkiG9w0BAQEFAASCAT4wggE6AgEAAkEApjCWeYGrIa/Vo7LH |
|
2 | MIIEpQIBAAKCAQEA2Ugt7jQrD+u+JtIfXZpVepzOAufcX4CMoHV95qZXZml2juGp | |
3 | aRF8ou0tbgHKE33Use/whCnKEUm34rDaXQd4lxxX6aDWg06n9tiVStAKTgQAHJY8 |
|
3 | x3T7wjQPB/IPoOpRG9CoCaekKK+bIqQX1qNuiUa2CsqchNQcua2js5DTttmRYC+f | |
4 | j/xgSwIDAQABAkBxHC6+Qlf0VJXGlb6NL16yEVVTQxqDS6hA9zqu6TZjrr0YMfzc |
|
4 | wHaQc0UY1QKe/0r8NFX1XoeIWfuL+0UAERoI1zmhu9px5326C7PoyBPIubT0ejLV | |
5 | EGNIiZGt7HCBL0zO+cPDg/LeCZc6HQhf0KrhAiEAzlJq4hWWzvguWFIJWSoBeBUG |
|
5 | LfciFgyHDmqvYGu6cUBpNFrAi8csPNGcyie1Axh0wZ/9jvHdN+iGmaV9GZObGv0G | |
6 | MF1ACazQO7PYE8M0qfECIQDONHHP0SKZzz/ZwBZcAveC5K61f/v9hONFwbeYulzR |
|
6 | ZpbWlJm8fG+mH1qMFYA6mnknJbEBBTnV0IWdGJalGnz+5GfCvhxzYcEWmLDeO/7F | |
7 | +wIgc9SvbtgB/5Yzpp//4ZAEnR7oh5SClCvyB+KSx52K3nECICbhQphhoXmI10wy |
|
7 | NrWMVT9L8Ky65cygCeJ4lEW1XB1w/6rQYjaSnwIDAQABAoIBAAwDAH8FpUfJCYcN | |
8 | aMTellaq0bpNMHFDziqH9RsqAHhjAiEAgYGxfzkftt5IUUn/iFK89aaIpyrpuaAh |
|
8 | 4KwFByqzFnR0qusgqSWJuT8R/QztUZ+OfBtJrU1MIXSX/iMwMPGvtEpsWRfitVnR | |
9 | HY8gUVkVRVs= |
|
9 | 5nt4J3kxTokEMGjrbPca0Uzw+bNHDdFacKNsKookzL2h2nZUh+LAycLDDVekH1Xx | |
10 | -----END PRIVATE KEY----- |
|
10 | t5I6dTiot/cxmVBp0+ontPuylEsnyrQio6eljBfPzxBdRp2lkiymKf3jvbGXRnZ4 | |
|
11 | jSFTRuUlbnVbZ3CKnFPU+d5tvn2nEwU/DVbGpJNZAPl99Q0XUcNF3AtGlwGMvi0X | |||
|
12 | azcIIOn+swLjn+U2S6i3K234ItYS5I+c9Xi+9DO4fuVko+CQ8PWXP2HdAze7DENc | |||
|
13 | zADmd0kCgYEA7nN+qUFAmMOcRE8nSNLt7mcwq6fYQ1MVGikCIXn/PI/wfEqY0lws | |||
|
14 | ZhwykBXog0S7PzYkR3LcDOqN0wDcdJ3K4c/a6Z6IqbXMgxaosYfHCCMtdhy0g0F2 | |||
|
15 | ek0SaY3WQhpFRIG19hvB+ZJSc7JQt+TaXeb8HM1452kmOLpfQGiqqTsCgYEA6UXZ | |||
|
16 | bI7c2jO1X+rWF2tZfZdtdeVrIVcm8BunF7ETC4iK/iH2phRQQAh4TFZm6wkX57Tv | |||
|
17 | LKDGxmohFlEK7FOtSCeSSVfkvZYRBuHOYcwBgBr1XzXXjHcMoyr0+LflZysht151 | |||
|
18 | 9F0hJwdGQZrivZnv9clJ632RlgE4XlPGskQhRe0CgYEAxVGdhsIQilmUfpJhl8m0 | |||
|
19 | SovpoqKKO2wNElDNCpbBt4QFJVU1kR3lP7olvUXj2nyN1okfDGDn52hRZEJaK8ZH | |||
|
20 | lQVDyf7+aDGgwvmFLyOEeB9kB1FJrzQErsAIdICCxMCogUA1KytdIQEMaeEtGn+u | |||
|
21 | k/YIumztl9FTZ64SFGKIlvECgYEA25Kb7csrp1g0yWxKyRCK0+TNa8Pe6ysVw7zD | |||
|
22 | s1FCFAEak8t0Vy+Xui4+zdwmU+XjUn7FAsTzVaBgNJlkJr88xEY7ND4/WRUAQfIa | |||
|
23 | SYO1hdfaTxxnIBiPFKdCnzq5/DplKi0H6lQe+JWoU+hutPlJHZmysq8ncoMDhAZn | |||
|
24 | aTUn/KECgYEAvxGaWt4Fn2tRrHeaG0qT+nMBxd8cTiFInOcYDeS/FlQo3DTDK2Ai | |||
|
25 | qLBa4DinnGN2hSKwnN3R5R2VRxk4I6+ljG0yuNBhJBcAgAFpnHfkuY1maQJB+1xY | |||
|
26 | A07WcM4J3yuPfjcDkipNFQa4Y8oJCaS2yiOPvlUfNQrCLAV+YqHZiiQ= | |||
|
27 | -----END RSA PRIVATE KEY----- |
@@ -1,10 +1,20 b'' | |||||
1 | -----BEGIN CERTIFICATE----- |
|
1 | -----BEGIN CERTIFICATE----- | |
2 |
MII |
|
2 | MIIDNTCCAh2gAwIBAgIJANRJCnkBtkkOMA0GCSqGSIb3DQEBCwUAMDExEjAQBgNV | |
3 |
aG9zdDEbMBkGCSqGSIb3DQEJARYMaGdAbG9jYWxob3N0MB4XDTE |
|
3 | BAMMCWxvY2FsaG9zdDEbMBkGCSqGSIb3DQEJARYMaGdAbG9jYWxob3N0MB4XDTE2 | |
4 | NDIwMzAxNFowMTESMBAGA1UEAwwJbG9jYWxob3N0MRswGQYJKoZIhvcNAQkBFgxoZ0Bsb2NhbGhv |
|
4 | MDEwMTA4MDAzMFoXDTE2MDEwMjA4MDAzMFowMTESMBAGA1UEAwwJbG9jYWxob3N0 | |
5 | c3QwXDANBgkqhkiG9w0BAQEFAANLADBIAkEApjCWeYGrIa/Vo7LHaRF8ou0tbgHKE33Use/whCnK |
|
5 | MRswGQYJKoZIhvcNAQkBFgxoZ0Bsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUA | |
6 | EUm34rDaXQd4lxxX6aDWg06n9tiVStAKTgQAHJY8j/xgSwIDAQABo1AwTjAdBgNVHQ4EFgQUE6sA |
|
6 | A4IBDwAwggEKAoIBAQDZSC3uNCsP674m0h9dmlV6nM4C59xfgIygdX3mpldmaXaO | |
7 | +ammr24dGX0kpjxOgO45hzQwHwYDVR0jBBgwFoAUE6sA+ammr24dGX0kpjxOgO45hzQwDAYDVR0T |
|
7 | 4anHdPvCNA8H8g+g6lEb0KgJp6Qor5sipBfWo26JRrYKypyE1By5raOzkNO22ZFg | |
8 | BAUwAwEB/zANBgkqhkiG9w0BAQUFAANBAJfk57DTRf2nUbYaMSlVAARxMNbFGOjQhAUtY400GhKt |
|
8 | L5/AdpBzRRjVAp7/Svw0VfVeh4hZ+4v7RQARGgjXOaG72nHnfboLs+jIE8i5tPR6 | |
9 | 2uiKCNGKXVXD3AHWe13yHc5KttzbHQStE5Nm/DlWBWQ= |
|
9 | MtUt9yIWDIcOaq9ga7pxQGk0WsCLxyw80ZzKJ7UDGHTBn/2O8d036IaZpX0Zk5sa | |
|
10 | /QZmltaUmbx8b6YfWowVgDqaeSclsQEFOdXQhZ0YlqUafP7kZ8K+HHNhwRaYsN47 | |||
|
11 | /sU2tYxVP0vwrLrlzKAJ4niURbVcHXD/qtBiNpKfAgMBAAGjUDBOMB0GA1UdDgQW | |||
|
12 | BBT6fA08JcG+SWBN9Y+p575xcFfIVjAfBgNVHSMEGDAWgBT6fA08JcG+SWBN9Y+p | |||
|
13 | 575xcFfIVjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBnY2r60iGg | |||
|
14 | 0BqR5vOj//XjS1FZKNG6+n3MKgxBY3pqFbqsCJfX5GfWD3GHJRXzv3p1MXIP3BWj | |||
|
15 | zFutg+FE2QChQFwZjJu3E1VnIZN5ytYBltGHwaCEUdGq9sAZ9R2Jdf8xhQa5h+1U | |||
|
16 | NZJvYbhCyecnUh2/Dkj2pFoF7wv7BtWFJV20WzHesN/Dik51cr6yFSn4nJb6YAMw | |||
|
17 | t4/Vnf24v36WwnBoO5VqO+ntISTD6CS3EE5Gqv2ZMQtFaMoRfKIBaDIKHvbYeXdX | |||
|
18 | 2gDTKWnS5KJYWmsl6N2CPjrHJJphaFGSKFAivmT24Q+JSKcC9hww7gvnGcVmsFan | |||
|
19 | H5xwzFQW2cna | |||
10 | -----END CERTIFICATE----- |
|
20 | -----END CERTIFICATE----- |
@@ -1,10 +1,20 b'' | |||||
1 | -----BEGIN CERTIFICATE----- |
|
1 | -----BEGIN CERTIFICATE----- | |
2 |
MII |
|
2 | MIIDNTCCAh2gAwIBAgIJAJvD5nejIHr2MA0GCSqGSIb3DQEBCwUAMDExEjAQBgNV | |
3 |
aG9zdDEbMBkGCSqGSIb3DQEJARYMaGdAbG9jYWxob3N0MB4XDTM |
|
3 | BAMMCWxvY2FsaG9zdDEbMBkGCSqGSIb3DQEJARYMaGdAbG9jYWxob3N0MB4XDTMw | |
4 | NTIwMzAxNFowMTESMBAGA1UEAwwJbG9jYWxob3N0MRswGQYJKoZIhvcNAQkBFgxoZ0Bsb2NhbGhv |
|
4 | MDEwMTA4MDAwOFoXDTMwMDEwMjA4MDAwOFowMTESMBAGA1UEAwwJbG9jYWxob3N0 | |
5 | c3QwXDANBgkqhkiG9w0BAQEFAANLADBIAkEApjCWeYGrIa/Vo7LHaRF8ou0tbgHKE33Use/whCnK |
|
5 | MRswGQYJKoZIhvcNAQkBFgxoZ0Bsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUA | |
6 | EUm34rDaXQd4lxxX6aDWg06n9tiVStAKTgQAHJY8j/xgSwIDAQABo1AwTjAdBgNVHQ4EFgQUE6sA |
|
6 | A4IBDwAwggEKAoIBAQDZSC3uNCsP674m0h9dmlV6nM4C59xfgIygdX3mpldmaXaO | |
7 | +ammr24dGX0kpjxOgO45hzQwHwYDVR0jBBgwFoAUE6sA+ammr24dGX0kpjxOgO45hzQwDAYDVR0T |
|
7 | 4anHdPvCNA8H8g+g6lEb0KgJp6Qor5sipBfWo26JRrYKypyE1By5raOzkNO22ZFg | |
8 | BAUwAwEB/zANBgkqhkiG9w0BAQUFAANBAJXV41gWnkgC7jcpPpFRSUSZaxyzrXmD1CIqQf0WgVDb |
|
8 | L5/AdpBzRRjVAp7/Svw0VfVeh4hZ+4v7RQARGgjXOaG72nHnfboLs+jIE8i5tPR6 | |
9 | /12E0vR2DuZitgzUYtBaofM81aTtc0a2/YsrmqePGm0= |
|
9 | MtUt9yIWDIcOaq9ga7pxQGk0WsCLxyw80ZzKJ7UDGHTBn/2O8d036IaZpX0Zk5sa | |
|
10 | /QZmltaUmbx8b6YfWowVgDqaeSclsQEFOdXQhZ0YlqUafP7kZ8K+HHNhwRaYsN47 | |||
|
11 | /sU2tYxVP0vwrLrlzKAJ4niURbVcHXD/qtBiNpKfAgMBAAGjUDBOMB0GA1UdDgQW | |||
|
12 | BBT6fA08JcG+SWBN9Y+p575xcFfIVjAfBgNVHSMEGDAWgBT6fA08JcG+SWBN9Y+p | |||
|
13 | 575xcFfIVjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQC0VDzAqPiL | |||
|
14 | 6U8yqaQqXdS6iK49yDQe9qzxzNnAZnj4YCsa5+qYSf+jl49Rak+pGw3AmN9gl6xq | |||
|
15 | aaP5xAlS8F0lnfZ5NcXmmp4Lt25qdu9J9qIPEAL4/ucirDr/cphCbDtzaWsrfi9j | |||
|
16 | YjVzSqoSEdnV1x9GkkLVwQRmA+D/2+95pgx6UNchqMbXuEQkAv9kVOzSG62OOAzO | |||
|
17 | z2Wct6b+DFbfFI0xcvKeJRGogjkd5QrF1XxU7e5u17DAN7/nhahv43ol3eC/fUiH | |||
|
18 | ITZpEc+/WdVtUwZQtoEQuBLB1Mc8QvYUUksUv9+KVjZ4o2oqApup7k7oMSPYNPTf | |||
|
19 | 2O99CXjOCl9k | |||
10 | -----END CERTIFICATE----- |
|
20 | -----END CERTIFICATE----- |
@@ -1,11 +1,20 b'' | |||||
1 | -----BEGIN CERTIFICATE----- |
|
1 | -----BEGIN CERTIFICATE----- | |
2 |
MII |
|
2 | MIIDNTCCAh2gAwIBAgIJAMXBgtbkFDfwMA0GCSqGSIb3DQEBCwUAMDExEjAQBgNV | |
3 |
BAMMCWxvY2FsaG9zdDEbMBkGCSqGSIb3DQEJARYMaGdAbG9jYWxob3N0MB4XDTE |
|
3 | BAMMCWxvY2FsaG9zdDEbMBkGCSqGSIb3DQEJARYMaGdAbG9jYWxob3N0MB4XDTE2 | |
4 |
M |
|
4 | MDcxMzA0MTcyOFoXDTQxMDMwNDA0MTcyOFowMTESMBAGA1UEAwwJbG9jYWxob3N0 | |
5 |
MRswGQYJKoZIhvcNAQkBFgxoZ0Bsb2NhbGhvc3Qw |
|
5 | MRswGQYJKoZIhvcNAQkBFgxoZ0Bsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUA | |
6 | ADBIAkEAsxsapLbHrqqUKuQBxdpK4G3m2LjtyrTSdpzzzFlecxd5yhNP6AyWrufo |
|
6 | A4IBDwAwggEKAoIBAQDZSC3uNCsP674m0h9dmlV6nM4C59xfgIygdX3mpldmaXaO | |
7 | K4VMGo2xlu9xOo88nDSUNSKPuD09MwIDAQABo1AwTjAdBgNVHQ4EFgQUoIB1iMhN |
|
7 | 4anHdPvCNA8H8g+g6lEb0KgJp6Qor5sipBfWo26JRrYKypyE1By5raOzkNO22ZFg | |
8 | y868rpQ2qk9dHnU6ebswHwYDVR0jBBgwFoAUoIB1iMhNy868rpQ2qk9dHnU6ebsw |
|
8 | L5/AdpBzRRjVAp7/Svw0VfVeh4hZ+4v7RQARGgjXOaG72nHnfboLs+jIE8i5tPR6 | |
9 | DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAANBAJ544f125CsE7J2t55PdFaF6 |
|
9 | MtUt9yIWDIcOaq9ga7pxQGk0WsCLxyw80ZzKJ7UDGHTBn/2O8d036IaZpX0Zk5sa | |
10 | bBlNBb91FCywBgSjhBjf+GG3TNPwrPdc3yqeq+hzJiuInqbOBv9abmMyq8Wsoig= |
|
10 | /QZmltaUmbx8b6YfWowVgDqaeSclsQEFOdXQhZ0YlqUafP7kZ8K+HHNhwRaYsN47 | |
|
11 | /sU2tYxVP0vwrLrlzKAJ4niURbVcHXD/qtBiNpKfAgMBAAGjUDBOMB0GA1UdDgQW | |||
|
12 | BBT6fA08JcG+SWBN9Y+p575xcFfIVjAfBgNVHSMEGDAWgBT6fA08JcG+SWBN9Y+p | |||
|
13 | 575xcFfIVjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQDLxD+Q90Ue | |||
|
14 | zrkmq964pzl+9zd0Y1ODSBnwaZfJxaoyFwRpYva1GYyz2CnJZEDjh8nUbo/jmEU1 | |||
|
15 | 9D91YT8e3plgcpsuxp0YhCUJbTz56k2OOq/MyrX+KgrC2VAdGbhr/C3hNkGKBzdu | |||
|
16 | +8p+z3jBUkiQFRb8xc485v1zkOX1lPN3tSAEOcja/lslmHV1UQhEYI/Ne2z/i/rQ | |||
|
17 | uVtC28dTHoPnJykIhXBwgxuAL3G3eFpCRemHOyTlzNDQQxkgMNAYenutWpYXjM2Z | |||
|
18 | paplLANjV+X91wyAXZ1XZ+5m7yLA7463MwOPU3Ko+HcyKKjPO+wJwVJbEpXr3rPR | |||
|
19 | getT2CfPFLMe | |||
11 | -----END CERTIFICATE----- |
|
20 | -----END CERTIFICATE----- |
@@ -1,11 +1,20 b'' | |||||
1 | -----BEGIN CERTIFICATE----- |
|
1 | -----BEGIN CERTIFICATE----- | |
2 |
MII |
|
2 | MIIDNTCCAh2gAwIBAgIJAJ12yUL2zGhzMA0GCSqGSIb3DQEBCwUAMDExEjAQBgNV | |
3 |
BAMMCWxvY2FsaG9zdDEbMBkGCSqGSIb3DQEJARYMaGdAbG9jYWxob3N0MB4XDTE |
|
3 | BAMMCWxvY2FsaG9zdDEbMBkGCSqGSIb3DQEJARYMaGdAbG9jYWxob3N0MB4XDTE2 | |
4 |
M |
|
4 | MDcxMzA0MTcxMloXDTQxMDMwNDA0MTcxMlowMTESMBAGA1UEAwwJbG9jYWxob3N0 | |
5 |
MRswGQYJKoZIhvcNAQkBFgxoZ0Bsb2NhbGhvc3Qw |
|
5 | MRswGQYJKoZIhvcNAQkBFgxoZ0Bsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUA | |
6 | ADBIAkEApjCWeYGrIa/Vo7LHaRF8ou0tbgHKE33Use/whCnKEUm34rDaXQd4lxxX |
|
6 | A4IBDwAwggEKAoIBAQDZSC3uNCsP674m0h9dmlV6nM4C59xfgIygdX3mpldmaXaO | |
7 | 6aDWg06n9tiVStAKTgQAHJY8j/xgSwIDAQABo1AwTjAdBgNVHQ4EFgQUE6sA+amm |
|
7 | 4anHdPvCNA8H8g+g6lEb0KgJp6Qor5sipBfWo26JRrYKypyE1By5raOzkNO22ZFg | |
8 | r24dGX0kpjxOgO45hzQwHwYDVR0jBBgwFoAUE6sA+ammr24dGX0kpjxOgO45hzQw |
|
8 | L5/AdpBzRRjVAp7/Svw0VfVeh4hZ+4v7RQARGgjXOaG72nHnfboLs+jIE8i5tPR6 | |
9 | DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAANBAFArvQFiAZJgQczRsbYlG1xl |
|
9 | MtUt9yIWDIcOaq9ga7pxQGk0WsCLxyw80ZzKJ7UDGHTBn/2O8d036IaZpX0Zk5sa | |
10 | t+truk37w5B3m3Ick1ntRcQrqs+hf0CO1q6Squ144geYaQ8CDirSR92fICELI1c= |
|
10 | /QZmltaUmbx8b6YfWowVgDqaeSclsQEFOdXQhZ0YlqUafP7kZ8K+HHNhwRaYsN47 | |
|
11 | /sU2tYxVP0vwrLrlzKAJ4niURbVcHXD/qtBiNpKfAgMBAAGjUDBOMB0GA1UdDgQW | |||
|
12 | BBT6fA08JcG+SWBN9Y+p575xcFfIVjAfBgNVHSMEGDAWgBT6fA08JcG+SWBN9Y+p | |||
|
13 | 575xcFfIVjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCzJhM/OBoS | |||
|
14 | JXnjfLhZqi6hTmx1XC7MR05z4fWdyBhZx8PwSDEjxAj/omAm2RMEx/Fv1a7FO6hd | |||
|
15 | ClYsxxSfWJO7NQ3V4YLn9AvNr5gcxuXV/4bTtEFNebuzhV06u5nH7pGbHbkxCI+u | |||
|
16 | QekmRTvKIojr8F44cyszEk+MZQ5bFBElByjVzgXNvAaDP0ryUL5eQhLrkuwbNFLQ | |||
|
17 | mFf7EaerMuM28x1knhiH/39s7t92CJgm9+D60TmJ4XXwue1gZ0v9MVS18iOuWyio | |||
|
18 | BklppJsdtDLxHTHGNlBeHdam5VejbXRo7s0y5OfuATwlgcaCMYC/68hVJYwl/GZ7 | |||
|
19 | 3YpdNpMshSaE | |||
11 | -----END CERTIFICATE----- |
|
20 | -----END CERTIFICATE----- |
@@ -72,7 +72,7 b' we are able to load CA certs.' | |||||
72 | $ hg clone https://localhost:$HGPORT/ copy-pull |
|
72 | $ hg clone https://localhost:$HGPORT/ copy-pull | |
73 | (unable to load CA certificates; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message) |
|
73 | (unable to load CA certificates; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message) | |
74 | abort: localhost certificate error: no certificate received |
|
74 | abort: localhost certificate error: no certificate received | |
75 | (set hostsecurity.localhost:certfingerprints=sha256:62:09:97:2f:97:60:e3:65:8f:12:5d:78:9e:35:a1:36:7a:65:4b:0e:9f:ac:db:c3:bc:6e:b6:a3:c0:16:e0:30 config setting or use --insecure to connect insecurely) |
|
75 | (set hostsecurity.localhost:certfingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e config setting or use --insecure to connect insecurely) | |
76 | [255] |
|
76 | [255] | |
77 | #endif |
|
77 | #endif | |
78 |
|
78 | |||
@@ -87,7 +87,7 b' we are able to load CA certs.' | |||||
87 | $ hg clone https://localhost:$HGPORT/ copy-pull |
|
87 | $ hg clone https://localhost:$HGPORT/ copy-pull | |
88 | (unable to load * certificates; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message) (glob) (?) |
|
88 | (unable to load * certificates; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message) (glob) (?) | |
89 | abort: localhost certificate error: no certificate received |
|
89 | abort: localhost certificate error: no certificate received | |
90 | (set hostsecurity.localhost:certfingerprints=sha256:62:09:97:2f:97:60:e3:65:8f:12:5d:78:9e:35:a1:36:7a:65:4b:0e:9f:ac:db:c3:bc:6e:b6:a3:c0:16:e0:30 config setting or use --insecure to connect insecurely) |
|
90 | (set hostsecurity.localhost:certfingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e config setting or use --insecure to connect insecurely) | |
91 | [255] |
|
91 | [255] | |
92 | #endif |
|
92 | #endif | |
93 |
|
93 | |||
@@ -146,7 +146,7 b' A per-host certificate with multiple cer' | |||||
146 |
|
146 | |||
147 | Defining both per-host certificate and a fingerprint will print a warning |
|
147 | Defining both per-host certificate and a fingerprint will print a warning | |
148 |
|
148 | |||
149 |
$ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/pub.pem" --config hostsecurity.localhost:fingerprints=sha1: |
|
149 | $ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/pub.pem" --config hostsecurity.localhost:fingerprints=sha1:ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03 clone -U https://localhost:$HGPORT/ caandfingerwarning | |
150 | (hostsecurity.localhost:verifycertsfile ignored when host fingerprints defined; using host fingerprints for verification) |
|
150 | (hostsecurity.localhost:verifycertsfile ignored when host fingerprints defined; using host fingerprints for verification) | |
151 | requesting all changes |
|
151 | requesting all changes | |
152 | adding changesets |
|
152 | adding changesets | |
@@ -160,7 +160,7 b' Inability to verify peer certificate wil' | |||||
160 |
|
160 | |||
161 | $ hg clone https://localhost:$HGPORT/ copy-pull $DISABLECACERTS |
|
161 | $ hg clone https://localhost:$HGPORT/ copy-pull $DISABLECACERTS | |
162 | abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect |
|
162 | abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect | |
163 |
(see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256: |
|
163 | (see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server) | |
164 | [255] |
|
164 | [255] | |
165 |
|
165 | |||
166 | $ hg clone --insecure https://localhost:$HGPORT/ copy-pull |
|
166 | $ hg clone --insecure https://localhost:$HGPORT/ copy-pull | |
@@ -192,7 +192,7 b' pull without cacert' | |||||
192 | $ hg pull $DISABLECACERTS |
|
192 | $ hg pull $DISABLECACERTS | |
193 | pulling from https://localhost:$HGPORT/ |
|
193 | pulling from https://localhost:$HGPORT/ | |
194 | abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect |
|
194 | abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect | |
195 |
(see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256: |
|
195 | (see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server) | |
196 | [255] |
|
196 | [255] | |
197 |
|
197 | |||
198 | $ hg pull --insecure |
|
198 | $ hg pull --insecure | |
@@ -256,7 +256,7 b' cacert mismatch' | |||||
256 | > https://127.0.0.1:$HGPORT/ |
|
256 | > https://127.0.0.1:$HGPORT/ | |
257 | pulling from https://127.0.0.1:$HGPORT/ (glob) |
|
257 | pulling from https://127.0.0.1:$HGPORT/ (glob) | |
258 | abort: 127.0.0.1 certificate error: certificate is for localhost (glob) |
|
258 | abort: 127.0.0.1 certificate error: certificate is for localhost (glob) | |
259 | (set hostsecurity.127.0.0.1:certfingerprints=sha256:62:09:97:2f:97:60:e3:65:8f:12:5d:78:9e:35:a1:36:7a:65:4b:0e:9f:ac:db:c3:bc:6e:b6:a3:c0:16:e0:30 config setting or use --insecure to connect insecurely) |
|
259 | (set hostsecurity.127.0.0.1:certfingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e config setting or use --insecure to connect insecurely) (glob) | |
260 |
|
|
260 | [255] | |
261 | $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub.pem" \ |
|
261 | $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub.pem" \ | |
262 | > https://127.0.0.1:$HGPORT/ --insecure |
|
262 | > https://127.0.0.1:$HGPORT/ --insecure | |
@@ -298,51 +298,51 b' Test server cert which no longer is vali' | |||||
298 | Fingerprints |
|
298 | Fingerprints | |
299 |
|
299 | |||
300 | - works without cacerts (hostkeyfingerprints) |
|
300 | - works without cacerts (hostkeyfingerprints) | |
301 |
$ hg -R copy-pull id https://localhost:$HGPORT/ --insecure --config hostfingerprints.localhost= |
|
301 | $ hg -R copy-pull id https://localhost:$HGPORT/ --insecure --config hostfingerprints.localhost=ec:d8:7c:d6:b3:86:d0:4f:c1:b8:b4:1c:9d:8f:5e:16:8e:ef:1c:03 | |
302 | 5fed3813f7f5 |
|
302 | 5fed3813f7f5 | |
303 |
|
303 | |||
304 | - works without cacerts (hostsecurity) |
|
304 | - works without cacerts (hostsecurity) | |
305 |
$ hg -R copy-pull id https://localhost:$HGPORT/ --config hostsecurity.localhost:fingerprints=sha1: |
|
305 | $ hg -R copy-pull id https://localhost:$HGPORT/ --config hostsecurity.localhost:fingerprints=sha1:ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03 | |
306 | 5fed3813f7f5 |
|
306 | 5fed3813f7f5 | |
307 |
|
307 | |||
308 |
$ hg -R copy-pull id https://localhost:$HGPORT/ --config hostsecurity.localhost:fingerprints=sha256: |
|
308 | $ hg -R copy-pull id https://localhost:$HGPORT/ --config hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e | |
309 | 5fed3813f7f5 |
|
309 | 5fed3813f7f5 | |
310 |
|
310 | |||
311 | - multiple fingerprints specified and first matches |
|
311 | - multiple fingerprints specified and first matches | |
312 |
$ hg --config 'hostfingerprints.localhost= |
|
312 | $ hg --config 'hostfingerprints.localhost=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03, deadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ --insecure | |
313 | 5fed3813f7f5 |
|
313 | 5fed3813f7f5 | |
314 |
|
314 | |||
315 |
$ hg --config 'hostsecurity.localhost:fingerprints=sha1: |
|
315 | $ hg --config 'hostsecurity.localhost:fingerprints=sha1:ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03, sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ | |
316 | 5fed3813f7f5 |
|
316 | 5fed3813f7f5 | |
317 |
|
317 | |||
318 | - multiple fingerprints specified and last matches |
|
318 | - multiple fingerprints specified and last matches | |
319 |
$ hg --config 'hostfingerprints.localhost=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, |
|
319 | $ hg --config 'hostfingerprints.localhost=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03' -R copy-pull id https://localhost:$HGPORT/ --insecure | |
320 | 5fed3813f7f5 |
|
320 | 5fed3813f7f5 | |
321 |
|
321 | |||
322 |
$ hg --config 'hostsecurity.localhost:fingerprints=sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, sha1: |
|
322 | $ hg --config 'hostsecurity.localhost:fingerprints=sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, sha1:ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03' -R copy-pull id https://localhost:$HGPORT/ | |
323 | 5fed3813f7f5 |
|
323 | 5fed3813f7f5 | |
324 |
|
324 | |||
325 | - multiple fingerprints specified and none match |
|
325 | - multiple fingerprints specified and none match | |
326 |
|
326 | |||
327 | $ hg --config 'hostfingerprints.localhost=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, aeadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ --insecure |
|
327 | $ hg --config 'hostfingerprints.localhost=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, aeadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ --insecure | |
328 |
abort: certificate for localhost has unexpected fingerprint |
|
328 | abort: certificate for localhost has unexpected fingerprint ec:d8:7c:d6:b3:86:d0:4f:c1:b8:b4:1c:9d:8f:5e:16:8e:ef:1c:03 | |
329 | (check hostfingerprint configuration) |
|
329 | (check hostfingerprint configuration) | |
330 | [255] |
|
330 | [255] | |
331 |
|
331 | |||
332 | $ hg --config 'hostsecurity.localhost:fingerprints=sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, sha1:aeadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ |
|
332 | $ hg --config 'hostsecurity.localhost:fingerprints=sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, sha1:aeadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ | |
333 |
abort: certificate for localhost has unexpected fingerprint sha1: |
|
333 | abort: certificate for localhost has unexpected fingerprint sha1:ec:d8:7c:d6:b3:86:d0:4f:c1:b8:b4:1c:9d:8f:5e:16:8e:ef:1c:03 | |
334 | (check hostsecurity configuration) |
|
334 | (check hostsecurity configuration) | |
335 | [255] |
|
335 | [255] | |
336 |
|
336 | |||
337 | - fails when cert doesn't match hostname (port is ignored) |
|
337 | - fails when cert doesn't match hostname (port is ignored) | |
338 |
$ hg -R copy-pull id https://localhost:$HGPORT1/ --config hostfingerprints.localhost= |
|
338 | $ hg -R copy-pull id https://localhost:$HGPORT1/ --config hostfingerprints.localhost=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03 | |
339 |
abort: certificate for localhost has unexpected fingerprint |
|
339 | abort: certificate for localhost has unexpected fingerprint f4:2f:5a:0c:3e:52:5b:db:e7:24:a8:32:1d:18:97:6d:69:b5:87:84 | |
340 | (check hostfingerprint configuration) |
|
340 | (check hostfingerprint configuration) | |
341 | [255] |
|
341 | [255] | |
342 |
|
342 | |||
343 |
|
343 | |||
344 | - ignores that certificate doesn't match hostname |
|
344 | - ignores that certificate doesn't match hostname | |
345 |
$ hg -R copy-pull id https://127.0.0.1:$HGPORT/ --config hostfingerprints.127.0.0.1= |
|
345 | $ hg -R copy-pull id https://127.0.0.1:$HGPORT/ --config hostfingerprints.127.0.0.1=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03 | |
346 | 5fed3813f7f5 |
|
346 | 5fed3813f7f5 | |
347 |
|
347 | |||
348 | HGPORT1 is reused below for tinyproxy tests. Kill that server. |
|
348 | HGPORT1 is reused below for tinyproxy tests. Kill that server. | |
@@ -374,7 +374,7 b' Test https with cacert and fingerprint t' | |||||
374 | pulling from https://localhost:$HGPORT/ |
|
374 | pulling from https://localhost:$HGPORT/ | |
375 | searching for changes |
|
375 | searching for changes | |
376 | no changes found |
|
376 | no changes found | |
377 |
$ http_proxy=http://localhost:$HGPORT1/ hg -R copy-pull pull https://127.0.0.1:$HGPORT/ --config hostfingerprints.127.0.0.1= |
|
377 | $ http_proxy=http://localhost:$HGPORT1/ hg -R copy-pull pull https://127.0.0.1:$HGPORT/ --config hostfingerprints.127.0.0.1=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03 | |
378 | pulling from https://127.0.0.1:$HGPORT/ (glob) |
|
378 | pulling from https://127.0.0.1:$HGPORT/ (glob) | |
379 | searching for changes |
|
379 | searching for changes | |
380 | no changes found |
|
380 | no changes found |
@@ -97,7 +97,7 b' Without certificates:' | |||||
97 | sending mail: smtp host localhost, port * (glob) |
|
97 | sending mail: smtp host localhost, port * (glob) | |
98 | (verifying remote certificate) |
|
98 | (verifying remote certificate) | |
99 | abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect |
|
99 | abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect | |
100 |
(see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256: |
|
100 | (see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server) | |
101 | [255] |
|
101 | [255] | |
102 |
|
102 | |||
103 | With global certificates: |
|
103 | With global certificates: |
General Comments 0
You need to be logged in to leave comments.
Login now