@@ -501,7 +501,21 @@ func (s *HTTPSSuite) TestWithClientCertificateAuthentication(c *check.C) {
501501// TestWithClientCertificateAuthentication
502502// Use two CA:s and test that clients with client signed by either of them can connect
503503func (s * HTTPSSuite ) TestWithClientCertificateAuthenticationMultipleCAs (c * check.C ) {
504- file := s .adaptFile (c , "fixtures/https/clientca/https_2ca1config.toml" , struct {}{})
504+ server1 := httptest .NewServer (http .HandlerFunc (func (rw http.ResponseWriter , _ * http.Request ) { rw .Write ([]byte ("server1" )) }))
505+ server2 := httptest .NewServer (http .HandlerFunc (func (rw http.ResponseWriter , _ * http.Request ) { rw .Write ([]byte ("server2" )) }))
506+ defer func () {
507+ server1 .Close ()
508+ server2 .Close ()
509+ }()
510+
511+ file := s .adaptFile (c , "fixtures/https/clientca/https_2ca1config.toml" , struct {
512+ Server1 string
513+ Server2 string
514+ }{
515+ Server1 : server1 .URL ,
516+ Server2 : server2 .URL ,
517+ })
518+
505519 defer os .Remove (file )
506520 cmd , display := s .traefikCmd (withConfigFile (file ))
507521 defer display (c )
@@ -513,58 +527,91 @@ func (s *HTTPSSuite) TestWithClientCertificateAuthenticationMultipleCAs(c *check
513527 err = try .GetRequest ("http://127.0.0.1:8080/api/rawdata" , 1 * time .Second , try .BodyContains ("Host(`snitest.org`)" ))
514528 c .Assert (err , checker .IsNil )
515529
530+ req , err := http .NewRequest (http .MethodGet , "https://127.0.0.1:4443" , nil )
531+ c .Assert (err , checker .IsNil )
532+ req .Host = "snitest.com"
533+
516534 tlsConfig := & tls.Config {
517535 InsecureSkipVerify : true ,
518536 ServerName : "snitest.com" ,
519537 Certificates : []tls.Certificate {},
520538 }
539+
540+ client := http.Client {
541+ Transport : & http.Transport {TLSClientConfig : tlsConfig },
542+ Timeout : 1 * time .Second ,
543+ }
544+
521545 // Connection without client certificate should fail
522- _ , err = tls . Dial ( "tcp" , "127.0.0.1:4443" , tlsConfig )
523- c .Assert (err , checker .NotNil , check . Commentf ( "should not be allowed to connect to server" ) )
546+ _ , err = client . Do ( req )
547+ c .Assert (err , checker .NotNil )
524548
525- // Connect with client signed by ca1
526549 cert , err := tls .LoadX509KeyPair ("fixtures/https/clientca/client1.crt" , "fixtures/https/clientca/client1.key" )
527550 c .Assert (err , checker .IsNil , check .Commentf ("unable to load client certificate and key" ))
528551 tlsConfig .Certificates = append (tlsConfig .Certificates , cert )
529552
530- conn , err := tls .Dial ("tcp" , "127.0.0.1:4443" , tlsConfig )
531- c .Assert (err , checker .IsNil , check .Commentf ("failed to connect to server" ))
532-
533- conn .Close ()
553+ // Connect with client signed by ca1
554+ _ , err = client .Do (req )
555+ c .Assert (err , checker .IsNil )
534556
535557 // Connect with client signed by ca2
536558 tlsConfig = & tls.Config {
537559 InsecureSkipVerify : true ,
538560 ServerName : "snitest.com" ,
539561 Certificates : []tls.Certificate {},
540562 }
563+
541564 cert , err = tls .LoadX509KeyPair ("fixtures/https/clientca/client2.crt" , "fixtures/https/clientca/client2.key" )
542565 c .Assert (err , checker .IsNil , check .Commentf ("unable to load client certificate and key" ))
543566 tlsConfig .Certificates = append (tlsConfig .Certificates , cert )
544567
545- conn , err = tls .Dial ("tcp" , "127.0.0.1:4443" , tlsConfig )
546- c .Assert (err , checker .IsNil , check .Commentf ("failed to connect to server" ))
568+ client = http.Client {
569+ Transport : & http.Transport {TLSClientConfig : tlsConfig },
570+ Timeout : 1 * time .Second ,
571+ }
547572
548- conn .Close ()
573+ // Connect with client signed by ca1
574+ _ , err = client .Do (req )
575+ c .Assert (err , checker .IsNil )
549576
550577 // Connect with client signed by ca3 should fail
551578 tlsConfig = & tls.Config {
552579 InsecureSkipVerify : true ,
553580 ServerName : "snitest.com" ,
554581 Certificates : []tls.Certificate {},
555582 }
583+
556584 cert , err = tls .LoadX509KeyPair ("fixtures/https/clientca/client3.crt" , "fixtures/https/clientca/client3.key" )
557585 c .Assert (err , checker .IsNil , check .Commentf ("unable to load client certificate and key" ))
558586 tlsConfig .Certificates = append (tlsConfig .Certificates , cert )
559587
560- _ , err = tls .Dial ("tcp" , "127.0.0.1:4443" , tlsConfig )
561- c .Assert (err , checker .NotNil , check .Commentf ("should not be allowed to connect to server" ))
588+ client = http.Client {
589+ Transport : & http.Transport {TLSClientConfig : tlsConfig },
590+ Timeout : 1 * time .Second ,
591+ }
592+
593+ // Connect with client signed by ca1
594+ _ , err = client .Do (req )
595+ c .Assert (err , checker .NotNil )
562596}
563597
564598// TestWithClientCertificateAuthentication
565599// Use two CA:s in two different files and test that clients with client signed by either of them can connect
566600func (s * HTTPSSuite ) TestWithClientCertificateAuthenticationMultipleCAsMultipleFiles (c * check.C ) {
567- file := s .adaptFile (c , "fixtures/https/clientca/https_2ca2config.toml" , struct {}{})
601+ server1 := httptest .NewServer (http .HandlerFunc (func (rw http.ResponseWriter , _ * http.Request ) { rw .Write ([]byte ("server1" )) }))
602+ server2 := httptest .NewServer (http .HandlerFunc (func (rw http.ResponseWriter , _ * http.Request ) { rw .Write ([]byte ("server2" )) }))
603+ defer func () {
604+ server1 .Close ()
605+ server2 .Close ()
606+ }()
607+
608+ file := s .adaptFile (c , "fixtures/https/clientca/https_2ca2config.toml" , struct {
609+ Server1 string
610+ Server2 string
611+ }{
612+ Server1 : server1 .URL ,
613+ Server2 : server2 .URL ,
614+ })
568615 defer os .Remove (file )
569616 cmd , display := s .traefikCmd (withConfigFile (file ))
570617 defer display (c )
@@ -576,51 +623,70 @@ func (s *HTTPSSuite) TestWithClientCertificateAuthenticationMultipleCAsMultipleF
576623 err = try .GetRequest ("http://127.0.0.1:8080/api/rawdata" , 1 * time .Second , try .BodyContains ("Host(`snitest.org`)" ))
577624 c .Assert (err , checker .IsNil )
578625
626+ req , err := http .NewRequest (http .MethodGet , "https://127.0.0.1:4443" , nil )
627+ c .Assert (err , checker .IsNil )
628+ req .Host = "snitest.com"
629+
579630 tlsConfig := & tls.Config {
580631 InsecureSkipVerify : true ,
581632 ServerName : "snitest.com" ,
582633 Certificates : []tls.Certificate {},
583634 }
635+
636+ client := http.Client {
637+ Transport : & http.Transport {TLSClientConfig : tlsConfig },
638+ Timeout : 1 * time .Second ,
639+ }
640+
584641 // Connection without client certificate should fail
585- _ , err = tls . Dial ( "tcp" , "127.0.0.1:4443" , tlsConfig )
586- c .Assert (err , checker .NotNil , check . Commentf ( "should not be allowed to connect to server" ) )
642+ _ , err = client . Do ( req )
643+ c .Assert (err , checker .NotNil )
587644
588645 // Connect with client signed by ca1
589646 cert , err := tls .LoadX509KeyPair ("fixtures/https/clientca/client1.crt" , "fixtures/https/clientca/client1.key" )
590647 c .Assert (err , checker .IsNil , check .Commentf ("unable to load client certificate and key" ))
591648 tlsConfig .Certificates = append (tlsConfig .Certificates , cert )
592649
593- conn , err := tls .Dial ("tcp" , "127.0.0.1:4443" , tlsConfig )
594- c .Assert (err , checker .IsNil , check .Commentf ("failed to connect to server" ))
595-
596- conn .Close ()
650+ _ , err = client .Do (req )
651+ c .Assert (err , checker .IsNil )
597652
598653 // Connect with client signed by ca2
599654 tlsConfig = & tls.Config {
600655 InsecureSkipVerify : true ,
601656 ServerName : "snitest.com" ,
602657 Certificates : []tls.Certificate {},
603658 }
659+
604660 cert , err = tls .LoadX509KeyPair ("fixtures/https/clientca/client2.crt" , "fixtures/https/clientca/client2.key" )
605661 c .Assert (err , checker .IsNil , check .Commentf ("unable to load client certificate and key" ))
606662 tlsConfig .Certificates = append (tlsConfig .Certificates , cert )
607663
608- conn , err = tls .Dial ("tcp" , "127.0.0.1:4443" , tlsConfig )
609- c .Assert (err , checker .IsNil , check .Commentf ("failed to connect to server" ))
610- conn .Close ()
664+ client = http.Client {
665+ Transport : & http.Transport {TLSClientConfig : tlsConfig },
666+ Timeout : 1 * time .Second ,
667+ }
668+
669+ _ , err = client .Do (req )
670+ c .Assert (err , checker .IsNil )
611671
612672 // Connect with client signed by ca3 should fail
613673 tlsConfig = & tls.Config {
614674 InsecureSkipVerify : true ,
615675 ServerName : "snitest.com" ,
616676 Certificates : []tls.Certificate {},
617677 }
678+
618679 cert , err = tls .LoadX509KeyPair ("fixtures/https/clientca/client3.crt" , "fixtures/https/clientca/client3.key" )
619680 c .Assert (err , checker .IsNil , check .Commentf ("unable to load client certificate and key" ))
620681 tlsConfig .Certificates = append (tlsConfig .Certificates , cert )
621682
622- _ , err = tls .Dial ("tcp" , "127.0.0.1:4443" , tlsConfig )
623- c .Assert (err , checker .NotNil , check .Commentf ("should not be allowed to connect to server" ))
683+ client = http.Client {
684+ Transport : & http.Transport {TLSClientConfig : tlsConfig },
685+ Timeout : 1 * time .Second ,
686+ }
687+
688+ _ , err = client .Do (req )
689+ c .Assert (err , checker .NotNil )
624690}
625691
626692func (s * HTTPSSuite ) TestWithRootCAsContentForHTTPSOnBackend (c * check.C ) {
0 commit comments