github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: parse cert CN and subject on OpenSSL 3.x

Browse Source 
The `certs` plugin extracted a certificate's Common Name and formatted its subject using string assumptions that only held for pre-3.x OpenSSL output, so a certificate with only a Common Name and no Subject Alternative Name reported no hostnames from `certs:report` and was not recognized during nginx config generation, while the subject report retained the `subject=` prefix and used the wrong separators. Normalizing the subject with `-nameopt` before parsing makes the extraction version independent across OpenSSL and LibreSSL.
This commit is contained in:
Jose Diaz-Gonzalez
2026-07-10 15:05:27 -04:00
parent e47bae8f55
commit 5496029e07
5 changed files with 257 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

96
tests/unit/certs.bats
View File

@@ -80,6 +80,102 @@ teardown() {
assert_output_contains "Invalid flag passed"
}
@test "(certs:report) reports hostnames and subject for a CN-only certificate" {
run /bin/bash -c "dokku certs:add $TEST_APP $BATS_TMPDIR/tls/server.crt $BATS_TMPDIR/tls/server.key"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku certs:report $TEST_APP --ssl-hostnames"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "dokku.me"
run /bin/bash -c "dokku certs:report $TEST_APP --ssl-subject"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "CN=dokku.me"
}
@test "(certs:report) preserves multi-field subject order" {
run /bin/bash -c "dokku certs:add $TEST_APP $BATS_TMPDIR/tls/domain.com.crt $BATS_TMPDIR/tls/domain.com.key"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku certs:report $TEST_APP --ssl-subject"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "C=US; ST=California; L=San Francisco; O=Expa; OU=Operations; CN=node-js-app.dokku.me"
run /bin/bash -c "dokku certs:report $TEST_APP --ssl-hostnames"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "node-js-app.dokku.me"
}
@test "(certs:report) reports the CN and all SANs as hostnames" {
local SANS_TLS="$BATS_TMPDIR/tls-sans"
mkdir -p "$SANS_TLS"
tar xf "$BATS_TEST_DIRNAME/server_ssl_sans.tar" -C "$SANS_TLS"
sudo chown -R dokku:dokku "$SANS_TLS"
run /bin/bash -c "dokku certs:add $TEST_APP $SANS_TLS/server.crt $SANS_TLS/server.key"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku certs:report $TEST_APP --ssl-hostnames"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "test.dokku.me www.test.app.dokku.me www.test.dokku.me"
rm -rf "$SANS_TLS"
}
@test "(certs) get_ssl_hostnames parses a CN-only certificate" {
run /bin/bash -c "dokku certs:add $TEST_APP $BATS_TMPDIR/tls/server.crt $BATS_TMPDIR/tls/server.key"
echo "output: $output"
echo "status: $status"
assert_success
source "$PLUGIN_CORE_AVAILABLE_PATH/certs/functions"
run get_ssl_hostnames "$TEST_APP"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "dokku.me"
}
@test "(certs) get_ssl_hostnames includes the CN and SANs" {
local SANS_TLS="$BATS_TMPDIR/tls-sans"
mkdir -p "$SANS_TLS"
tar xf "$BATS_TEST_DIRNAME/server_ssl_sans.tar" -C "$SANS_TLS"
sudo chown -R dokku:dokku "$SANS_TLS"
run /bin/bash -c "dokku certs:add $TEST_APP $SANS_TLS/server.crt $SANS_TLS/server.key"
echo "output: $output"
echo "status: $status"
assert_success
source "$PLUGIN_CORE_AVAILABLE_PATH/certs/functions"
run get_ssl_hostnames "$TEST_APP"
echo "output: $output"
echo "status: $status"
assert_success
assert_line "test.dokku.me"
assert_line "www.test.dokku.me"
assert_line "www.test.app.dokku.me"
assert_line_count 3
rm -rf "$SANS_TLS"
}
@test "(certs) certs:add" {
run /bin/bash -c "dokku certs:add $TEST_APP $BATS_TMPDIR/tls/server.crt $BATS_TMPDIR/tls/server.key"
echo "output: $output"