ZTSUtils { static boolean validateCertReqDNSNames(PKCS10CertificationRequest certReq, final String domain, final String service) { List<String> dnsNames = Crypto.extractX509CSRDnsNames(certReq); if (dnsNames.isEmpty()) { return true; } final String prefix = service + "." + domain.replace('.', '-') + "."; for (String dnsName : dnsNames) { if (dnsName.startsWith(prefix) && dnsName.endsWith(ZTS_CERT_DNS_SUFFIX)) { continue; } if (dnsName.contains(ZTSConsts.ZTS_CERT_INSTANCE_ID_DNS)) { continue; } LOGGER.error("validateServiceCertReqDNSNames - Invalid dnsName SAN entry: {}", dnsName); return false; } return true; }  static SslContextFactory createSSLContextObject(String[] clientProtocols); static SslContextFactory createSSLContextObject(final String[] clientProtocols,
            final PrivateKeyStore privateKeyStore); static boolean emitMonmetricError(int errorCode, String caller,
            String requestDomain, String principalDomain, Metric metric); static boolean verifyCertificateRequest(PKCS10CertificationRequest certReq,
            final String domain, final String service, X509CertRecord certRecord); static boolean validateCertReqCommonName(PKCS10CertificationRequest certReq, String cn); static String extractCertReqInstanceId(PKCS10CertificationRequest certReq); static Identity generateIdentity(InstanceCertManager certManager, final String csr,
            final String cn, final String certUsage, int expiryTime); static SSLContext createServerClientSSLContext(PrivateKeyStore privateKeyStore); static int parseInt(final String value, int defaultValue); static boolean parseBoolean(final String value, boolean defaultValue); static final String ZTS_CERT_DNS_SUFFIX; }
@Test public void testValidateCertReqDNSNames() throws IOException { Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String csr = new String(Files.readAllBytes(path)); PKCS10CertificationRequest certReq = Crypto.getPKCS10CertRequest(csr); boolean result = ZTSUtils.validateCertReqDNSNames(certReq, "athenz", "production"); assertTrue(result); result = ZTSUtils.validateCertReqDNSNames(certReq, "athenz2", "production"); assertFalse(result); result = ZTSUtils.validateCertReqDNSNames(certReq, "athenz2", "productio2"); assertFalse(result); }
@Test public void testValidateCertReqDNSNamesNoDNS() throws IOException { Path path = Paths.get("src/test/resources/valid.csr"); String csr = new String(Files.readAllBytes(path)); PKCS10CertificationRequest certReq = Crypto.getPKCS10CertRequest(csr); boolean result = ZTSUtils.validateCertReqDNSNames(certReq, "athenz", "production"); assertTrue(result); result = ZTSUtils.validateCertReqDNSNames(certReq, "athenz2", "production"); assertTrue(result); result = ZTSUtils.validateCertReqDNSNames(certReq, "athenz2", "productio2"); assertTrue(result); }
@Test public void testValidateCertReqDNSNamesUnknown() throws IOException { Path path = Paths.get("src/test/resources/invalid_dns.csr"); String csr = new String(Files.readAllBytes(path)); PKCS10CertificationRequest certReq = Crypto.getPKCS10CertRequest(csr); boolean result = ZTSUtils.validateCertReqDNSNames(certReq, "athenz", "production"); assertFalse(result); result = ZTSUtils.validateCertReqDNSNames(certReq, "athenz", "production"); assertFalse(result); }
@Test public void testValidateCertReqDNSNamesSubdomain() throws IOException { Path path = Paths.get("src/test/resources/subdomain.csr"); String csr = new String(Files.readAllBytes(path)); PKCS10CertificationRequest certReq = Crypto.getPKCS10CertRequest(csr); boolean result = ZTSUtils.validateCertReqDNSNames(certReq, "athenz.domain", "production"); assertTrue(result); }
@Test public void testValidateCertReqDNSNamesSubdomainInvalid() throws IOException { Path path = Paths.get("src/test/resources/subdomain_invalid.csr"); String csr = new String(Files.readAllBytes(path)); PKCS10CertificationRequest certReq = Crypto.getPKCS10CertRequest(csr); boolean result = ZTSUtils.validateCertReqDNSNames(certReq, "athenz.domain", "production"); assertFalse(result); }