mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-04 10:42:23 +00:00
Andras Bacsai
284adede6c
Server certificates now use a prime256v1 (P-256) EC key. The CA keeps secp521r1. BoringSSL-based Electron clients such as MongoDB Compass cannot use a P-521 server key. Add a feature test that checks the CA stays on P-521 and the server certificate uses P-256. It also checks that the server key matches its certificate and that the CA signature verifies.
37 lines
1.4 KiB
PHP
37 lines
1.4 KiB
PHP
<?php
|
|
|
|
use App\Helpers\SslHelper;
|
|
use App\Models\Server;
|
|
use App\Models\Team;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
function certificateCurve(string $certificate): ?string
|
|
{
|
|
return openssl_pkey_get_details(openssl_pkey_get_public($certificate))['ec']['curve_name'] ?? null;
|
|
}
|
|
|
|
it('keeps the CA on P-521 and gives server certificates a P-256 key that Electron clients such as MongoDB Compass accept', function () {
|
|
$server = Server::factory()->create(['team_id' => Team::factory()->create()->id]);
|
|
|
|
$caCertificate = SslHelper::generateSslCertificate(
|
|
commonName: 'Coolify CA Certificate',
|
|
serverId: $server->id,
|
|
isCaCertificate: true,
|
|
validityDays: 10 * 365,
|
|
);
|
|
|
|
$serverCertificate = SslHelper::generateSslCertificate(
|
|
commonName: 'database',
|
|
serverId: $server->id,
|
|
caCert: $caCertificate->ssl_certificate,
|
|
caKey: $caCertificate->ssl_private_key,
|
|
);
|
|
|
|
expect(certificateCurve($caCertificate->ssl_certificate))->toBe('secp521r1')
|
|
->and(certificateCurve($serverCertificate->ssl_certificate))->toBe('prime256v1')
|
|
->and(openssl_x509_check_private_key($serverCertificate->ssl_certificate, $serverCertificate->ssl_private_key))->toBeTrue()
|
|
->and(openssl_x509_verify($serverCertificate->ssl_certificate, openssl_pkey_get_public($caCertificate->ssl_certificate)))->toBe(1);
|
|
});
|