1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
// Check that rotation will fail if a certificate file is missing
(function() {
"use strict";
load('jstests/ssl/libs/ssl_helpers.js');
function deleteFile(file) {
if (_isWindows()) {
// correctly replace forward slashes for Windows
file = file.replace(/\//g, "\\");
assert.eq(0, runProgram("cmd.exe", "/c", "del", file));
return;
}
assert.eq(0, runProgram("rm", file));
}
const dbPath = MongoRunner.toRealDir("$dataDir/cluster_x509_rotate_test/");
mkdir(dbPath);
copyCertificateFile("jstests/libs/ca.pem", dbPath + "/ca-test.pem");
copyCertificateFile("jstests/libs/client.pem", dbPath + "/client-test.pem");
copyCertificateFile("jstests/libs/server.pem", dbPath + "/server-test.pem");
copyCertificateFile("jstests/libs/crl.pem", dbPath + "/crl-test.pem");
const mongod = MongoRunner.runMongod({
sslMode: "requireSSL",
sslPEMKeyFile: dbPath + "/server-test.pem",
sslCAFile: dbPath + "/ca-test.pem",
sslClusterFile: dbPath + "/client-test.pem",
sslCRLFile: dbPath + "/crl-test.pem",
});
// if we are on apple, don't do delete test on CRL -- it will succeed.
let certTypes = ["server", "ca", "client"];
if (determineSSLProvider() !== "apple") {
certTypes.push("crl");
}
for (let certType of certTypes) {
copyCertificateFile("jstests/libs/ca.pem", dbPath + "/ca-test.pem");
copyCertificateFile("jstests/libs/client.pem", dbPath + "/client-test.pem");
copyCertificateFile("jstests/libs/server.pem", dbPath + "/server-test.pem");
copyCertificateFile("jstests/libs/crl.pem", dbPath + "/crl-test.pem");
assert.commandWorked(mongod.adminCommand({rotateCertificates: 1}));
deleteFile(`${dbPath}/${certType}-test.pem`);
assert.commandFailed(mongod.adminCommand({rotateCertificates: 1}));
}
MongoRunner.stopMongod(mongod);
})();
|
