test: update CRL certs to comply with intent validation#5651
test: update CRL certs to comply with intent validation#5651CarolYeh910 merged 2 commits intoaws:mainfrom
Conversation
|
Have you tested the updated certs work with "Enabling certificate intent validation by default" change? |
Ah, I did run the tests locally to ensure the updated certs fixed the test failure. Forgot to mention this in the PR description 🥲 The next PR that enables intent validation is like 700 lines of change excluding these test certs, so I just split it up. I can open it now to verify the cert changes if needed~ |
Goal
Update the CRL test certs to be compatible with the intent validation
Why
Enabling certificate intent validation by default means that all of our existing tests will have this validation enabled. Currently, the CRL certs lack a valid intent for server authentication, which means that the CRL tests will be broken if we add the new validation. This PR will fix the test failure.
How
In
openssl.conf, replace the Extended Key UsageemailProtectionwithserverAuthand regenerate the test certs. The[ server_cert ]section was unused so I deleted it.Testing
Existing CI should pass. I also added this commit to #5657 via
git cherry-pickto verify the updated certs resolved thes2n_crl_testfailure.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.