Skip to content

[stable31] test: add integration tests for certificate engine switching #6055

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vitormattos merged 2 commits into from
Dec 9, 2025
+50 −1
Merged

[stable31] test: add integration tests for certificate engine switching #6055

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
05883d9
test: add integration tests for certificate engine switching
vitormattos Dec 9, 2025
e6ac718
fix: validate CFSSL-specific config files in isSetupOk()
vitormattos Dec 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion lib/Handler/CertificateEngine/CfsslHandler.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,9 @@ public function isSetupOk(): bool {
$configPath = $this->getCurrentConfigPath();
$certificate = file_exists($configPath . DIRECTORY_SEPARATOR . 'ca.pem');
$privateKey = file_exists($configPath . DIRECTORY_SEPARATOR . 'ca-key.pem');
if (!$certificate || !$privateKey) {
$csrServer = file_exists($configPath . DIRECTORY_SEPARATOR . 'csr_server.json');
$configServer = file_exists($configPath . DIRECTORY_SEPARATOR . 'config_server.json');
if (!$certificate || !$privateKey || !$csrServer || !$configServer) {
return false;
}
try {
Expand Down
47 changes: 47 additions & 0 deletions tests/integration/features/admin/certificate_engine_switch.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
Feature: admin/certificate_engine_switch
Background:
Given as user "admin"

Scenario: Set engine to OpenSSL, configure it, then switch engine and verify
# Define engine as OpenSSL
When sending "post" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/certificate_engine"
| value | openssl |
Then the response should have a status code 200
# Configure OpenSSL
When sending "post" to ocs "/apps/libresign/api/v1/admin/certificate/openssl"
| rootCert | {"commonName":"OpenSSL Root CA"} |
Then the response should have a status code 200
# Verify OpenSSL is configured correctly
And sending "get" to ocs "/apps/libresign/api/v1/admin/configure-check"
Then the response should have a status code 200
And the response should be a JSON array with the following mandatory values
| key | value |
| (jq).ocs.data\|map(select(.resource=="openssl-configure"))[0].status | success |
# Switch to CFSSL engine without configuring it
When sending "post" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/certificate_engine"
| value | cfssl |
Then the response should have a status code 200
# Verify CFSSL shows error because it's not configured
And sending "get" to ocs "/apps/libresign/api/v1/admin/configure-check"
Then the response should have a status code 200
And the response should be a JSON array with the following mandatory values
| key | value |
| (jq).ocs.data\|map(select(.resource=="cfssl-configure"))[0].status | error |
| (jq).ocs.data\|map(select(.resource=="cfssl-configure"))[0].tip | Run occ libresign:configure:cfssl --help |

Scenario: Set engine to none and verify error state
# Delete engine configuration (set to none)
When sending "delete" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/certificate_engine"
Then the response should have a status code 200
# Verify configure-check shows error for default engine (OpenSSL)
And sending "get" to ocs "/apps/libresign/api/v1/admin/configure-check"
Then the response should have a status code 200
And the response should be a JSON array with the following mandatory values
| key | value |
| (jq).ocs.data\|map(select(.resource=="openssl-configure"))[0].status | error |
# Verify has-root-cert returns false
And sending "get" to ocs "/apps/libresign/api/v1/setting/has-root-cert"
Then the response should have a status code 200
And the response should be a JSON array with the following mandatory values
| key | value |
| (jq).ocs.data.hasRootCert | false |
Loading