Merge pull request #6138 from st2sandbox/recreate-ssl-fixture

Renew certs in ssl_certs fixture

st2tests/st2tests/fixtures/ssl_certs/BUILD

@@ -14,3 +14,7 @@ resources(
 python_sources(
     dependencies=[":assets"],
 )
+
+shell_sources(
+    name="util",
+)

st2tests/st2tests/fixtures/ssl_certs/README.md

@@ -7,4 +7,4 @@ Those certificates are issues and signed by a custom CA which is contained in th
 
 Certificate passphrase is ``MySecretPassword``.
 
-NOTE: Those cerificates will expire on ``notAfter=Feb 11 15:58:38 2024 GMT``.
+NOTE: Those cerificates will expire on ``notAfter=Feb 12 04:43:45 2039 GMT``.

st2tests/st2tests/fixtures/ssl_certs/ca/ca_certificate_bundle.pem

@@ -1,17 +1,18 @@
 -----BEGIN CERTIFICATE-----
-MIICxjCCAa6gAwIBAgIJALjUApUWLemKMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNV
-BAMMCE15VGVzdENBMB4XDTE5MDIxMjE1NTcwM1oXDTI0MDIxMTE1NTcwM1owEzER
-MA8GA1UEAwwITXlUZXN0Q0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
-AQDxVR7nSFKXUMET0WTtVNjsgD1HDdvIZcDyPGFEMNhtftPv4RmkxeFnKNumHbIu
-s2eox6MCT7wK9CKG+38szyMMDkCObYkGCKzZG2yejkjs6Kv74hvML8p+NIz3Cxch
-WEuD6ubnSoKl35cVt4/LUTM/IFG36H6f7Q47NYYsWIBMaXUvY5Wbg5SqxD4LMKkx
-uDFzITyrA38xvwb96mTkXT/OJEyswAAeWjjoKHWdirknhiFvKXi1T9jdmJTwBnGz
-lFUS1Aavkj/Og7el9JjoL6S83mclDPbcD68/kWUliHHr8l1wfAP/oObOm7wpXViU
-64nFnHP0/WtTM50urnWjFYjVAgMBAAGjHTAbMAwGA1UdEwQFMAMBAf8wCwYDVR0P
-BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQDwqchOuO85hfRb25LMeB9T0iEpwQdY
-cKCD1ASg42Sp/mzlscPmODxILnvm3BItEKbq6mrG2s9i42FRmXu+6D2Bm7k1jDnh
-FW/hI5KG5ULQWfkFqgUAWyeSKTF7oK9FRAfROY3K9E/MXxsO10e+ibgZPZjY8RTC
-eUihRw3LvIFj3mY3OQ+sBQ4OTh/nPd66trzAJee15ATC0nK0YJTVhLv576DmxOyb
-yuESg2l8qvjXI0C/W+MyLCO4sH1hhg+5pjEwiXH3Z1Sk59l7qag21kp53xhvjL7W
-+zisXvuZC08wfCPc3RJ6ThRb8MZZKeFpOffVVHBtgv9Aes7IOyVG15XA
+MIIC8DCCAdigAwIBAgIUGtedwXj7Nm3q6uev7luAMFB53tQwDQYJKoZIhvcNAQEL
+BQAwEzERMA8GA1UEAwwITXlUZXN0Q0EwHhcNMjQwMjE2MDQ0MzQ1WhcNMzkwMjEy
+MDQ0MzQ1WjATMREwDwYDVQQDDAhNeVRlc3RDQTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAPFVHudIUpdQwRPRZO1U2OyAPUcN28hlwPI8YUQw2G1+0+/h
+GaTF4Wco26Ydsi6zZ6jHowJPvAr0Iob7fyzPIwwOQI5tiQYIrNkbbJ6OSOzoq/vi
+G8wvyn40jPcLFyFYS4Pq5udKgqXflxW3j8tRMz8gUbfofp/tDjs1hixYgExpdS9j
+lZuDlKrEPgswqTG4MXMhPKsDfzG/Bv3qZORdP84kTKzAAB5aOOgodZ2KuSeGIW8p
+eLVP2N2YlPAGcbOUVRLUBq+SP86Dt6X0mOgvpLzeZyUM9twPrz+RZSWIcevyXXB8
+A/+g5s6bvCldWJTricWcc/T9a1MznS6udaMViNUCAwEAAaM8MDowDAYDVR0TBAUw
+AwEB/zALBgNVHQ8EBAMCAQYwHQYDVR0OBBYEFGCZU1Sfg6rWWPvaYPavK4SPT0PE
+MA0GCSqGSIb3DQEBCwUAA4IBAQCpIVnSPl7gmfdBorOhue0F5Mzm5plPovu8QjUs
+lIpFook6Vn6uVcbfknvxXyDjqrhhVk/YBFnVfMlVM06ZlH7/afL0HbDBc3meXCfL
++iT0kP6YBLuYsd+TxwMwBm4Dl6CZ8shNTp3/DNePlyteVxgJFC5oQ8zOkkEJz1aH
+j16S5CVRVUy9JfX2/BaVWhFnBKMfZBOIPnEi/mk13hthBKAWxW93Sf+oEus1pliD
+jblKeTDVGhrJ0hHLZ6Jz2ZRfWHIJi4kgbr+Q+E3uAptQW4FnK2uEIxt2Fzagavyc
+q1UNlpjqjVy4oQHA6/PAdHFC2ObLU4OmVwkwnz4RCqtmkX7k
 -----END CERTIFICATE-----

st2tests/st2tests/fixtures/ssl_certs/ca/certs/03.pem

@@ -0,0 +1,76 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 3 (0x3)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=MyTestCA
+        Validity
+            Not Before: Feb 16 04:43:45 2024 GMT
+            Not After : Feb 12 04:43:45 2039 GMT
+        Subject: CN=localhost, O=server
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b8:b2:d4:75:b1:ea:3a:c5:22:46:79:2f:d9:2d:
+                    1f:89:a7:6b:ab:07:dd:81:a6:60:54:89:af:33:2a:
+                    2b:55:8c:e8:27:95:bb:6a:72:52:c9:63:e7:57:f9:
+                    72:fe:b8:cb:ee:da:22:3e:10:5c:56:00:ee:08:69:
+                    1f:ec:28:cf:37:81:39:b5:dc:48:f7:29:58:93:f5:
+                    07:12:d3:06:d6:59:7a:90:38:85:f2:15:9f:1c:37:
+                    64:b5:da:a7:42:fb:8b:91:43:00:03:9c:60:20:57:
+                    d7:f9:43:01:b9:36:64:ed:5a:30:ae:39:ce:ba:58:
+                    cd:e5:e5:4d:f3:dc:b6:7d:85:d7:b6:a0:b5:f7:51:
+                    e2:94:6f:55:c0:b7:b0:60:a4:1d:fc:8b:21:6f:8a:
+                    76:59:fc:62:04:85:4e:f9:c4:29:9d:80:7a:aa:eb:
+                    eb:11:80:b5:5c:f7:11:6c:9b:97:76:b7:3b:29:c6:
+                    27:75:67:68:8f:a3:3b:69:3d:73:3a:71:c9:ad:d2:
+                    ed:bf:b1:7b:76:46:20:57:db:ea:c0:de:f0:de:e7:
+                    7b:b8:d6:84:6e:c1:ef:5b:3d:22:fb:aa:a3:5f:fb:
+                    84:ef:9e:4d:66:82:7c:3b:c0:f1:e6:e8:3f:d6:5c:
+                    69:96:75:e5:7e:66:9d:22:26:d8:3c:12:5a:b5:1b:
+                    12:8b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Subject Key Identifier: 
+                64:EA:DA:BF:2B:78:10:EA:D5:29:CF:EC:6E:10:53:90:2D:F1:DB:D0
+            X509v3 Authority Key Identifier: 
+                60:99:53:54:9F:83:AA:D6:58:FB:DA:60:F6:AF:2B:84:8F:4F:43:C4
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        de:33:7e:f8:29:8f:e6:32:4d:d8:7a:23:d2:d6:42:c6:b7:38:
+        f2:39:3b:b1:85:cd:71:ea:aa:b7:74:81:5a:23:ef:e8:53:18:
+        ea:06:5b:f7:3a:01:33:49:79:9f:a5:4f:ca:6c:e0:56:c8:dd:
+        aa:62:06:37:8f:62:e0:74:5a:f8:84:6a:72:29:de:59:cc:96:
+        f2:b0:bd:ba:5f:df:98:35:87:04:be:51:fe:91:91:86:3b:fd:
+        86:e6:66:89:9a:7e:c1:c3:1a:1b:15:97:a4:38:9e:69:d4:81:
+        b4:63:6e:7c:21:98:b3:ff:fd:65:42:3a:f3:e2:7c:e3:9e:a7:
+        33:4c:c5:63:f2:91:f9:7b:d5:49:b2:5d:51:db:44:ea:13:37:
+        58:08:c8:c9:8b:08:c0:ee:64:0b:37:c2:bc:91:b8:38:54:49:
+        74:c9:dd:ec:e3:13:ae:c7:95:e5:e0:12:d2:77:cb:67:62:b4:
+        31:91:b9:28:89:b8:e3:83:07:76:81:4f:a8:6e:a8:11:ca:94:
+        4d:39:99:45:f9:9b:fa:8a:28:d2:a9:57:0e:68:1e:04:a8:04:
+        ce:9e:ec:3e:c5:22:14:3d:c0:f6:ed:52:53:6f:c1:0d:cc:1e:
+        8b:10:a4:c0:ca:54:c1:35:b5:c1:f3:72:81:98:c9:30:4b:95:
+        81:4a:13:9f
+-----BEGIN CERTIFICATE-----
+MIIDADCCAeigAwIBAgIBAzANBgkqhkiG9w0BAQsFADATMREwDwYDVQQDDAhNeVRl
+c3RDQTAeFw0yNDAyMTYwNDQzNDVaFw0zOTAyMTIwNDQzNDVaMCUxEjAQBgNVBAMM
+CWxvY2FsaG9zdDEPMA0GA1UECgwGc2VydmVyMIIBIjANBgkqhkiG9w0BAQEFAAOC
+AQ8AMIIBCgKCAQEAuLLUdbHqOsUiRnkv2S0fiadrqwfdgaZgVImvMyorVYzoJ5W7
+anJSyWPnV/ly/rjL7toiPhBcVgDuCGkf7CjPN4E5tdxI9ylYk/UHEtMG1ll6kDiF
+8hWfHDdktdqnQvuLkUMAA5xgIFfX+UMBuTZk7VowrjnOuljN5eVN89y2fYXXtqC1
+91HilG9VwLewYKQd/Ishb4p2WfxiBIVO+cQpnYB6quvrEYC1XPcRbJuXdrc7KcYn
+dWdoj6M7aT1zOnHJrdLtv7F7dkYgV9vqwN7w3ud7uNaEbsHvWz0i+6qjX/uE755N
+ZoJ8O8Dx5ug/1lxplnXlfmadIibYPBJatRsSiwIDAQABo00wSzAJBgNVHRMEAjAA
+MB0GA1UdDgQWBBRk6tq/K3gQ6tUpz+xuEFOQLfHb0DAfBgNVHSMEGDAWgBRgmVNU
+n4Oq1lj72mD2ryuEj09DxDANBgkqhkiG9w0BAQsFAAOCAQEA3jN++CmP5jJN2Hoj
+0tZCxrc48jk7sYXNceqqt3SBWiPv6FMY6gZb9zoBM0l5n6VPymzgVsjdqmIGN49i
+4HRa+IRqcineWcyW8rC9ul/fmDWHBL5R/pGRhjv9huZmiZp+wcMaGxWXpDieadSB
+tGNufCGYs//9ZUI68+J8456nM0zFY/KR+XvVSbJdUdtE6hM3WAjIyYsIwO5kCzfC
+vJG4OFRJdMnd7OMTrseV5eAS0nfLZ2K0MZG5KIm444MHdoFPqG6oEcqUTTmZRfmb
++ooo0qlXDmgeBKgEzp7sPsUiFD3A9u1SU2/BDcweixCkwMpUwTW1wfNygZjJMEuV
+gUoTnw==
+-----END CERTIFICATE-----

st2tests/st2tests/fixtures/ssl_certs/ca/certs/04.pem

@@ -0,0 +1,76 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4 (0x4)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=MyTestCA
+        Validity
+            Not Before: Feb 16 04:43:45 2024 GMT
+            Not After : Feb 12 04:43:45 2039 GMT
+        Subject: CN=localhost, O=client
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e0:7c:64:67:0e:74:30:68:96:62:69:6b:c0:90:
+                    47:02:3c:2c:0f:b9:5f:7e:df:60:1e:b4:40:78:ff:
+                    22:10:8d:28:2c:82:66:fc:c9:94:50:8c:80:d8:34:
+                    83:18:90:88:b0:ff:a0:ae:49:99:6b:02:e6:bb:b0:
+                    f4:bc:92:15:21:4a:3e:38:13:54:43:fd:e6:00:25:
+                    87:f7:3d:79:01:6e:6c:fc:88:3f:15:91:2b:84:18:
+                    37:44:56:52:fa:15:d5:4f:ad:fd:53:de:2e:2a:77:
+                    be:9a:38:7f:1b:81:23:ec:e6:07:84:1c:b0:9f:e1:
+                    0a:6a:42:09:b9:44:ec:d7:4b:05:d2:45:bf:e2:1d:
+                    46:c7:df:8f:87:7b:5f:61:26:a0:35:d3:03:5d:77:
+                    ed:d0:a9:e7:fd:7f:2f:33:02:c5:e4:48:3c:64:72:
+                    a7:b7:2d:f4:c0:94:6b:e2:bd:9b:a9:37:92:08:f4:
+                    b9:93:76:df:a5:cc:4e:02:76:92:a5:30:ee:22:8c:
+                    48:a7:bc:3d:a6:3c:0b:54:05:56:bd:b8:ea:0e:55:
+                    39:0e:b3:f1:a6:c9:f6:f6:2f:12:4c:da:49:ec:cc:
+                    bb:fb:5d:bf:0b:f4:09:0e:b9:42:24:26:af:d6:66:
+                    b4:e0:6d:90:65:bc:80:ae:2d:da:c7:f3:02:7a:89:
+                    c5:b1
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Subject Key Identifier: 
+                77:1C:53:73:49:A4:C4:BE:A9:4E:93:2F:73:AC:7A:97:EB:DF:35:9E
+            X509v3 Authority Key Identifier: 
+                60:99:53:54:9F:83:AA:D6:58:FB:DA:60:F6:AF:2B:84:8F:4F:43:C4
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        71:c3:bf:b2:68:7c:fa:fc:47:57:54:53:2b:0f:31:9a:0b:5b:
+        6c:73:ae:1b:a0:c5:2c:3d:4e:e5:99:fa:33:7f:d3:f2:39:27:
+        99:dc:58:3a:ec:0a:bf:63:14:07:9e:de:3f:64:aa:d3:9f:d6:
+        a3:d4:c5:45:be:4f:07:42:93:52:df:9c:70:a6:3d:b5:63:14:
+        06:58:45:b7:d7:cb:16:96:cf:03:4c:71:09:bb:b8:8a:20:51:
+        c9:ed:f3:b0:25:ed:de:72:45:9c:e1:23:b4:92:a2:34:e2:e3:
+        8d:39:d5:15:2a:f3:38:b2:22:f2:1a:7d:e0:91:a6:05:8a:19:
+        18:fb:c2:a7:cb:9b:a9:2b:d3:ce:0f:6d:42:57:07:72:de:f8:
+        57:50:4f:23:16:8f:d3:7b:78:76:24:0b:5b:4b:f1:63:15:eb:
+        28:9a:b6:b8:59:7d:fc:58:c2:77:78:ed:7e:e5:50:9e:b0:2d:
+        db:78:6c:d9:81:8b:ec:1f:6f:d2:13:96:9d:4d:e3:bc:75:0b:
+        4b:80:2a:e1:69:ae:9b:7b:44:54:ea:cf:85:2e:1f:89:5d:a7:
+        9a:59:5b:f6:10:87:d8:61:23:4d:26:1b:de:85:ec:75:96:7c:
+        fe:6c:09:90:7d:ab:58:90:39:bf:32:56:0b:5d:6c:be:23:5e:
+        02:79:a2:8e
+-----BEGIN CERTIFICATE-----
+MIIDADCCAeigAwIBAgIBBDANBgkqhkiG9w0BAQsFADATMREwDwYDVQQDDAhNeVRl
+c3RDQTAeFw0yNDAyMTYwNDQzNDVaFw0zOTAyMTIwNDQzNDVaMCUxEjAQBgNVBAMM
+CWxvY2FsaG9zdDEPMA0GA1UECgwGY2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOC
+AQ8AMIIBCgKCAQEA4HxkZw50MGiWYmlrwJBHAjwsD7lfft9gHrRAeP8iEI0oLIJm
+/MmUUIyA2DSDGJCIsP+grkmZawLmu7D0vJIVIUo+OBNUQ/3mACWH9z15AW5s/Ig/
+FZErhBg3RFZS+hXVT639U94uKne+mjh/G4Ej7OYHhBywn+EKakIJuUTs10sF0kW/
+4h1Gx9+Ph3tfYSagNdMDXXft0Knn/X8vMwLF5Eg8ZHKnty30wJRr4r2bqTeSCPS5
+k3bfpcxOAnaSpTDuIoxIp7w9pjwLVAVWvbjqDlU5DrPxpsn29i8STNpJ7My7+12/
+C/QJDrlCJCav1ma04G2QZbyAri3ax/MCeonFsQIDAQABo00wSzAJBgNVHRMEAjAA
+MB0GA1UdDgQWBBR3HFNzSaTEvqlOky9zrHqX6981njAfBgNVHSMEGDAWgBRgmVNU
+n4Oq1lj72mD2ryuEj09DxDANBgkqhkiG9w0BAQsFAAOCAQEAccO/smh8+vxHV1RT
+Kw8xmgtbbHOuG6DFLD1O5Zn6M3/T8jknmdxYOuwKv2MUB57eP2Sq05/Wo9TFRb5P
+B0KTUt+ccKY9tWMUBlhFt9fLFpbPA0xxCbu4iiBRye3zsCXt3nJFnOEjtJKiNOLj
+jTnVFSrzOLIi8hp94JGmBYoZGPvCp8ubqSvTzg9tQlcHct74V1BPIxaP03t4diQL
+W0vxYxXrKJq2uFl9/FjCd3jtfuVQnrAt23hs2YGL7B9v0hOWnU3jvHULS4Aq4Wmu
+m3tEVOrPhS4fiV2nmllb9hCH2GEjTSYb3oXsdZZ8/mwJkH2rWJA5vzJWC11sviNe
+Anmijg==
+-----END CERTIFICATE-----

st2tests/st2tests/fixtures/ssl_certs/ca/index.txt

@@ -1,2 +1,4 @@
-V	240211155807Z		01	unknown	/CN=localhost/O=server
-V	240211155838Z		02	unknown	/CN=localhost/O=client
+E	240211155807Z		01	unknown	/CN=localhost/O=server
+E	240211155838Z		02	unknown	/CN=localhost/O=client
+V	390212044345Z		03	unknown	/CN=localhost/O=server
+V	390212044345Z		04	unknown	/CN=localhost/O=client

st2tests/st2tests/fixtures/ssl_certs/ca/index.txt.old

@@ -1 +1,3 @@
-V	240211155807Z		01	unknown	/CN=localhost/O=server
+E	240211155807Z		01	unknown	/CN=localhost/O=server
+E	240211155838Z		02	unknown	/CN=localhost/O=client
+V	390212044345Z		03	unknown	/CN=localhost/O=server

st2tests/st2tests/fixtures/ssl_certs/ca/openssl.cnf

@@ -10,7 +10,7 @@ private_key = $dir/private/ca_private_key.pem
 serial = $dir/serial
 
 default_crl_days = 7
-default_days = 1825
+default_days = 5475
 default_md = sha256
 
 policy = testca_policy
@@ -33,10 +33,10 @@ default_bits = 2048
 default_keyfile = ./private/ca_private_key.pem
 default_md = sha256
 prompt = yes
-distinguished_name = root_ca_distinguished_name
+distinguished_name = distinguished_name
 x509_extensions = root_ca_extensions
 
-[ root_ca_distinguished_name ]
+[ distinguished_name ]
 commonName = hostname
 
 [ root_ca_extensions ]

st2tests/st2tests/fixtures/ssl_certs/ca/serial

@@ -1 +1 @@
-03
+05

st2tests/st2tests/fixtures/ssl_certs/ca/serial.old

@@ -1 +1 @@
-02
+04

st2tests/st2tests/fixtures/ssl_certs/client/client_certificate.pem

@@ -1,18 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIIC4jCCAcqgAwIBAgIBAjANBgkqhkiG9w0BAQsFADATMREwDwYDVQQDDAhNeVRl
-c3RDQTAeFw0xOTAyMTIxNTU4MzhaFw0yNDAyMTExNTU4MzhaMCUxEjAQBgNVBAMM
+MIIDADCCAeigAwIBAgIBBDANBgkqhkiG9w0BAQsFADATMREwDwYDVQQDDAhNeVRl
+c3RDQTAeFw0yNDAyMTYwNDQzNDVaFw0zOTAyMTIwNDQzNDVaMCUxEjAQBgNVBAMM
 CWxvY2FsaG9zdDEPMA0GA1UECgwGY2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOC
 AQ8AMIIBCgKCAQEA4HxkZw50MGiWYmlrwJBHAjwsD7lfft9gHrRAeP8iEI0oLIJm
 /MmUUIyA2DSDGJCIsP+grkmZawLmu7D0vJIVIUo+OBNUQ/3mACWH9z15AW5s/Ig/
 FZErhBg3RFZS+hXVT639U94uKne+mjh/G4Ej7OYHhBywn+EKakIJuUTs10sF0kW/
 4h1Gx9+Ph3tfYSagNdMDXXft0Knn/X8vMwLF5Eg8ZHKnty30wJRr4r2bqTeSCPS5
 k3bfpcxOAnaSpTDuIoxIp7w9pjwLVAVWvbjqDlU5DrPxpsn29i8STNpJ7My7+12/
-C/QJDrlCJCav1ma04G2QZbyAri3ax/MCeonFsQIDAQABoy8wLTAJBgNVHRMEAjAA
-MAsGA1UdDwQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDAjANBgkqhkiG9w0BAQsF
-AAOCAQEAI+PgF1gsQckqTh71CxqKimM0h5pIGh6H09bSa+9LFLFa60E1zR8rmygw
-AD+u6sI5foFbSdUiIDJBmHizvwMmIptGSRw0Znzi/jjbjBmZSNLnk+Vird5grjF4
-Pf7Vkgi/NKzXTS3Y2TUUhk5OZZ6OmszHZ0eGJlUcz6Qa13hcalVHc3FmikeAu5/h
-XQuthOQDXJBabgexQ+1K6ft6DDImdQCFcZhYXSb30cRHS9lqIVZbI7Rtk6UqwkvE
-hYU0g8BVeVBpL7xYBqfrpdy+vBb28rrLT6Dvgf0giQ3F07S+RAivDWjM53Wyhb7T
-6o3h8l49IkcEW1mns9Mj2bPNFSOhSA==
+C/QJDrlCJCav1ma04G2QZbyAri3ax/MCeonFsQIDAQABo00wSzAJBgNVHRMEAjAA
+MB0GA1UdDgQWBBR3HFNzSaTEvqlOky9zrHqX6981njAfBgNVHSMEGDAWgBRgmVNU
+n4Oq1lj72mD2ryuEj09DxDANBgkqhkiG9w0BAQsFAAOCAQEAccO/smh8+vxHV1RT
+Kw8xmgtbbHOuG6DFLD1O5Zn6M3/T8jknmdxYOuwKv2MUB57eP2Sq05/Wo9TFRb5P
+B0KTUt+ccKY9tWMUBlhFt9fLFpbPA0xxCbu4iiBRye3zsCXt3nJFnOEjtJKiNOLj
+jTnVFSrzOLIi8hp94JGmBYoZGPvCp8ubqSvTzg9tQlcHct74V1BPIxaP03t4diQL
+W0vxYxXrKJq2uFl9/FjCd3jtfuVQnrAt23hs2YGL7B9v0hOWnU3jvHULS4Aq4Wmu
+m3tEVOrPhS4fiV2nmllb9hCH2GEjTSYb3oXsdZZ8/mwJkH2rWJA5vzJWC11sviNe
+Anmijg==
 -----END CERTIFICATE-----

st2tests/st2tests/fixtures/ssl_certs/client/req.pem

@@ -1,15 +1,17 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIICajCCAVICAQAwJTESMBAGA1UEAwwJbG9jYWxob3N0MQ8wDQYDVQQKDAZjbGll
+MIICqDCCAZACAQAwJTESMBAGA1UEAwwJbG9jYWxob3N0MQ8wDQYDVQQKDAZjbGll
 bnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDgfGRnDnQwaJZiaWvA
 kEcCPCwPuV9+32AetEB4/yIQjSgsgmb8yZRQjIDYNIMYkIiw/6CuSZlrAua7sPS8
 khUhSj44E1RD/eYAJYf3PXkBbmz8iD8VkSuEGDdEVlL6FdVPrf1T3i4qd76aOH8b
 gSPs5geEHLCf4QpqQgm5ROzXSwXSRb/iHUbH34+He19hJqA10wNdd+3Qqef9fy8z
 AsXkSDxkcqe3LfTAlGvivZupN5II9LmTdt+lzE4CdpKlMO4ijEinvD2mPAtUBVa9
 uOoOVTkOs/Gmyfb2LxJM2knszLv7Xb8L9AkOuUIkJq/WZrTgbZBlvICuLdrH8wJ6
-icWxAgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEApuP6zTVRGLa69IXIyGIqDzb6
-NjQxyTbB5SzbtgqvdcBs5EuntsFTmS11umKwzoqT0+Kf3JtwO8pu8rQbX3C/EWOP
-/eWqFPnGTCRk0AE+m08XxiAgQrgOxiMj483ka6Qr3OdT7zjW6xUyE0ObD+auD+fx
-9siygGy8P9X0x0PqpWQoZm17x3bUfERiIl+oI/BltuUmAfPgELtEIBjcz+Xrslgl
-5iV8Rn/+srFwMT80QLt9iypt0Me8IkbKTWpDUVQYEaXA3svCvGuthzeukImmmAPZ
-rpcXR6WvYVdb2HekgqZtgvDg4FDeLidK164uTeOlCC/CRLPKyJu9VJpTQamC6g==
+icWxAgMBAAGgPjA8BgkqhkiG9w0BCQ4xLzAtMAkGA1UdEwQCMAAwCwYDVR0PBAQD
+AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQB3ECcS
+bY+JZ9PcWrkn0sxOOelbkXTjj5+qVDuji69sh84e1QPbi0hF+lEHPfo5qodSeSNU
+Dvvt52sVOFIP5ZgQMOl0pyZclyARkk2YYH6O0W3GbUB4JvhvSFHE3zc7pJgotU0B
+WqxnjryJp9/Ge2HyNjkHBveZ2mKzekU5gyAdH2ymc+2guVv8yvQKQvVnwm5lGf9f
+WtlkyiYfiS9y83D7vvdRL38UqiAq+GkOSQtZePzH4dHgJnkyntjDD+M4ELnEM7G7
+1eWIPYUUsfX/6GXlawOUwUP7ELoMlxtaM68hOX/YdRNUrraHD3sGRE31XA49o3AC
+yGY9X+Cp+9M6Yipi
 -----END CERTIFICATE REQUEST-----

st2tests/st2tests/fixtures/ssl_certs/renew_certs.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+set -eo pipefail
+
+FIXTURE_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+
+cd "${FIXTURE_DIR}/ca"
+
+# regenerate the CA (w/ 15 year duration)
+openssl req -new \
+    -x509 \
+    -key private/ca_private_key.pem \
+    -config openssl.cnf \
+    -subj '/CN=MyTestCA/' \
+    -days $((365*15)) \
+    -out ca_certificate_bundle.pem
+
+# convert the PEM format cert to DER format
+openssl x509 \
+    -outform DER \
+    -in ca_certificate_bundle.pem \
+    -out ca_certificate_bundle.cer
+
+# update the CA db so that it records that certs have expired.
+openssl ca -config openssl.cnf -updatedb
+
+for x in server client; do
+    # Regenerate the CSR
+    openssl req -new \
+        -key ../${x}/private_key.pem \
+        -config openssl.cnf \
+        -reqexts ${x}_ca_extensions \
+        -subj "/CN=localhost/O=${x}/" \
+        -out ../${x}/req.pem
+
+    # Create the x509 cert signed by our CA
+    openssl ca -batch \
+        -config openssl.cnf \
+        -in ../${x}/req.pem
+
+    # Copy the cert without the prologue
+    openssl x509 \
+        -in "certs/$(cat serial.old).pem" \
+        -out ../${x}/${x}_certificate.pem
+
+    # Convert the x509 key+cert to a p12/pfx format file.
+    # These certificates are only used for tests, so including
+    # the plaintext password here is not a problem.
+    openssl pkcs12 -export \
+        -out ../${x}/${x}_certificate.p12 \
+        -inkey ../${x}/private_key.pem \
+        -in ../${x}/${x}_certificate.pem \
+        -password pass:MySecretPassword
+done
+
+sed -i -e 's/notAfter=[^`]*'"/$(openssl x509 -in ca_certificate_bundle.pem -noout -dates | grep notAfter)/" "${FIXTURE_DIR}/README.md"

st2tests/st2tests/fixtures/ssl_certs/server/req.pem

@@ -1,15 +1,17 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIICajCCAVICAQAwJTESMBAGA1UEAwwJbG9jYWxob3N0MQ8wDQYDVQQKDAZzZXJ2
+MIICqDCCAZACAQAwJTESMBAGA1UEAwwJbG9jYWxob3N0MQ8wDQYDVQQKDAZzZXJ2
 ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4stR1seo6xSJGeS/Z
 LR+Jp2urB92BpmBUia8zKitVjOgnlbtqclLJY+dX+XL+uMvu2iI+EFxWAO4IaR/s
 KM83gTm13Ej3KViT9QcS0wbWWXqQOIXyFZ8cN2S12qdC+4uRQwADnGAgV9f5QwG5
 NmTtWjCuOc66WM3l5U3z3LZ9hde2oLX3UeKUb1XAt7BgpB38iyFvinZZ/GIEhU75
 xCmdgHqq6+sRgLVc9xFsm5d2tzspxid1Z2iPoztpPXM6ccmt0u2/sXt2RiBX2+rA
 3vDe53u41oRuwe9bPSL7qqNf+4Tvnk1mgnw7wPHm6D/WXGmWdeV+Zp0iJtg8Elq1
-GxKLAgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEAmgj0lyN0I+pik9xQnmt7RhC1
-r+5ivX9ndnMmpeN8jI0RqUOEU3CewSsxKihiVpVHqUGJhHKJmsnEh/aiD2dPorK+
-I0NGWXGexk3TfHq/Ey1lwyZc1O9+vOYo/6k3zDhJZg0BekNkYciTsMFpI4h8cDr2
-yV3gzRdFPug2wwBPuKumiJuI6ZQU3G3FjgbUIOox91ZZctH1X3PRFmHjZKiHauwE
-3FEzyoJUXPhP/HFGooZ6M81nm5VotozqUbj+pslLGjPdX2stduFfhZOriwH/mKll
-7seOwR7GpqOhMDSCfs1gBAZkkyGX+z1hk+hccFJHSO0PLg+32Wtzu1kepBw4kA==
+GxKLAgMBAAGgPjA8BgkqhkiG9w0BCQ4xLzAtMAkGA1UdEwQCMAAwCwYDVR0PBAQD
+AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4IBAQCPDdlV
+U37TqJbI1kJn1KTbyRpJSbKH7KetkQwIaPDAY1A/oJ2eYPxrdQGzUUBiegtKUe20
+UvaV0M/A5SlBm5AV6m5CYcF/I8iNgtJZunfOiaFAm4JyaUpL3moGWDL8dgbWWKGX
+8Ma4dLOXnXpSgOK5RnNNGrvIp8A4134Kk/+rZAywdvjAjiHVr2k2cqEsDTdI39Fc
+6JNKXiMYMHWd+H0bIZDotBTOD+Cf6tE+ETMfR7483LSWdCrFTIL0B1iWm6cpgxPk
+l6pez4qstAPAa/G0R5NaqmgHRX9FEodnfPbxK29+IV+TTOiewRwwgFhmDZ78zFZI
+1lzBQnMqtkj2pdmP
 -----END CERTIFICATE REQUEST-----