upstream/upstream-nats-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

snapshot of https://github.com/nats-io/nats-server.git (main, 2026-09-15; blobs > 131072B omitted)
Some checks failed
NATS Server Tests / Lint (push) Failing after 3s
Details
NATS Server Tests / Build (Latest Go) (push) Has been skipped
Details
NATS Server Tests / Build (Minimum Go) (push) Has been skipped
Details
NATS Server Tests / Build (Minimum Go, windows-2022) (push) Has been skipped
Details
NATS Server Tests / Build (Minimum Go, windows-2025) (push) Has been skipped
Details
NATS Server Tests / Test Stores (push) Has been skipped
Details
NATS Server Tests / Test JetStream (push) Has been skipped
Details
NATS Server Tests / Test Raft (push) Has been skipped
Details
NATS Server Tests / Test JetStream Consumers (push) Has been skipped
Details
NATS Server Tests / Test JetStream Cluster 1 (push) Has been skipped
Details
NATS Server Tests / Test JetStream Cluster 2 (push) Has been skipped
Details
NATS Server Tests / Test JetStream Cluster 3 (push) Has been skipped
Details
NATS Server Tests / Test JetStream Cluster 4 (push) Has been skipped
Details
NATS Server Tests / Test JetStream Supercluster (push) Has been skipped
Details
NATS Server Tests / Test No-Race 1 (push) Has been skipped
Details
NATS Server Tests / Test No-Race 2 (push) Has been skipped
Details
NATS Server Tests / Test MQTT (push) Has been skipped
Details
NATS Server Tests / Test Message Tracing (push) Has been skipped
Details
NATS Server Tests / Test JWT (push) Has been skipped
Details
NATS Server Tests / Test Remaining Server Tests (push) Has been skipped
Details
NATS Server Tests / Test Other Packages (push) Has been skipped
Details
Vulnerability Scan / govulncheck (push) Failing after 12m2s
Details

Browse Source
This commit is contained in:
upstream-mirror
2026-09-15 20:16:01 +05:00
commit 709385cbaa
455 changed files with 155508 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

346
test/configs/certs/ocsp/gen.sh Executable file
View File

@@ -0,0 +1,346 @@
#!/usr/bin/env bash
set -euo pipefail
# gen.sh generates certificates used in OCSP tests. It generates a CA, client
# certs, and a few different types of server certs with different OCSP
# settings. This requires OpenSSL, not LibreSSL.
#
# usage: ./gen.sh
################################################################################
# Setup CA
################################################################################
mkdir -p ./demoCA/newcerts
rm -f demoCA/index.txt
touch demoCA/index.txt
echo "01" > demoCA/serial
prefix="ca"
openssl genrsa -out ${prefix}-key.pem
openssl req -new -key ${prefix}-key.pem -out ${prefix}-csr.pem \
-config <(echo "
[ req ]
prompt = no
distinguished_name = req_distinguished_name
string_mask = utf8only
utf8 = yes
x509_extensions = v3_ca
[ req_distinguished_name ]
C = US
ST = CA
L = San Francisco
O = Synadia
OU = nats.io
CN = localhost ca
[ v3_ca ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = critical,CA:true
")
openssl ca -batch -keyfile ${prefix}-key.pem -selfsign -notext \
-config <(echo "
[ ca ]
default_ca = ca_default
[ ca_default ]
dir = ./demoCA
database = ./demoCA/index.txt
new_certs_dir = ./demoCA/newcerts
serial = ./demoCA/serial
default_md = default
policy = policy_anything
x509_extensions = v3_ca
default_md = sha256
default_enddate = 20291014135726Z
copy_extensions = copy
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ v3_ca ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = critical,CA:true
") \
-out ${prefix}-cert.pem -infiles ${prefix}-csr.pem
################################################################################
# Client cert
################################################################################
prefix="client"
openssl genrsa -out ${prefix}-key.pem
openssl req -new -key ${prefix}-key.pem -out ${prefix}-csr.pem \
-config <(echo "
[ req ]
prompt = no
distinguished_name = req_distinguished_name
req_extensions = v3_req
string_mask = utf8only
utf8 = yes
[ req_distinguished_name ]
C = US
ST = CA
L = San Francisco
O = Synadia
OU = nats.io
CN = localhost client
[ v3_req ]
subjectAltName = @alt_names
[ alt_names ]
IP.1 = 127.0.0.1
IP.2 = 0:0:0:0:0:0:0:1
DNS.1 = localhost
DNS.2 = client.localhost
")
openssl ca -batch -keyfile ca-key.pem -cert ca-cert.pem -notext \
-config <(echo "
[ ca ]
default_ca = ca_default
[ ca_default ]
dir = ./demoCA
database = ./demoCA/index.txt
new_certs_dir = ./demoCA/newcerts
serial = ./demoCA/serial
default_md = default
policy = policy_anything
x509_extensions = ext_ca
default_md = sha256
default_enddate = 20291014135726Z
copy_extensions = copy
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ ext_ca ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
") \
-out ${prefix}-cert.pem -infiles ${prefix}-csr.pem
################################################################################
# Server cert
################################################################################
prefix="server"
openssl genrsa -out ${prefix}-key.pem
openssl req -new -key ${prefix}-key.pem -out ${prefix}-csr.pem \
-config <(echo "
[ req ]
prompt = no
distinguished_name = req_distinguished_name
req_extensions = v3_req
string_mask = utf8only
utf8 = yes
[ req_distinguished_name ]
C = US
ST = CA
L = San Francisco
O = Synadia
OU = nats.io
CN = localhost server
[ v3_req ]
subjectAltName = @alt_names
[ alt_names ]
IP.1 = 127.0.0.1
IP.2 = 0:0:0:0:0:0:0:1
DNS.1 = localhost
DNS.2 = server.localhost
")
openssl ca -batch -keyfile ca-key.pem -cert ca-cert.pem -notext \
-config <(echo "
[ ca ]
default_ca = ca_default
[ ca_default ]
dir = ./demoCA
database = ./demoCA/index.txt
new_certs_dir = ./demoCA/newcerts
serial = ./demoCA/serial
default_md = default
policy = policy_anything
x509_extensions = ext_ca
default_md = sha256
default_enddate = 20291014135726Z
copy_extensions = copy
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ ext_ca ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
") \
-out ${prefix}-cert.pem -infiles ${prefix}-csr.pem
################################################################################
# Server cert (tlsfeature)
################################################################################
prefix="server-status-request"
openssl genrsa -out ${prefix}-key.pem
openssl req -new -key ${prefix}-key.pem -out ${prefix}-csr.pem \
-config <(echo "
[ req ]
prompt = no
distinguished_name = req_distinguished_name
req_extensions = v3_req
string_mask = utf8only
utf8 = yes
[ req_distinguished_name ]
C = US
ST = CA
L = San Francisco
O = Synadia
OU = nats.io
CN = localhost server status request
[ v3_req ]
subjectAltName = @alt_names
[ alt_names ]
IP.1 = 127.0.0.1
IP.2 = 0:0:0:0:0:0:0:1
DNS.1 = localhost
DNS.2 = server-status-request.localhost
")
openssl ca -batch -keyfile ca-key.pem -cert ca-cert.pem -notext \
-config <(echo "
[ ca ]
default_ca = ca_default
[ ca_default ]
dir = ./demoCA
database = ./demoCA/index.txt
new_certs_dir = ./demoCA/newcerts
serial = ./demoCA/serial
default_md = default
policy = policy_anything
x509_extensions = ext_ca
default_md = sha256
default_enddate = 20291014135726Z
copy_extensions = copy
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ ext_ca ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
tlsfeature = status_request
extendedKeyUsage = serverAuth, clientAuth
") \
-out ${prefix}-cert.pem -infiles ${prefix}-csr.pem
################################################################################
# Server cert (authorityInfoAccess and tlsfeature)
################################################################################
for n in {01..08}; do
prefix="server-status-request-url-${n}"
openssl genrsa -out ${prefix}-key.pem
openssl req -new -key ${prefix}-key.pem -out ${prefix}-csr.pem \
-config <(echo "
[ req ]
prompt = no
distinguished_name = req_distinguished_name
req_extensions = v3_req
string_mask = utf8only
utf8 = yes
[ req_distinguished_name ]
C = US
ST = CA
L = San Francisco
O = Synadia
OU = nats.io
CN = localhost ${prefix}
[ v3_req ]
subjectAltName = @alt_names
[ alt_names ]
IP.1 = 127.0.0.1
IP.2 = 0:0:0:0:0:0:0:1
DNS.1 = localhost
DNS.2 = ${prefix}.localhost
")
openssl ca -batch -keyfile ca-key.pem -cert ca-cert.pem -notext \
-config <(echo "
[ ca ]
default_ca = ca_default
[ ca_default ]
dir = ./demoCA
database = ./demoCA/index.txt
new_certs_dir = ./demoCA/newcerts
serial = ./demoCA/serial
default_md = default
policy = policy_anything
x509_extensions = ext_ca
default_md = sha256
default_enddate = 20291014135726Z
copy_extensions = copy
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ ext_ca ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
authorityInfoAccess = OCSP;URI:http://127.0.0.1:8888
tlsfeature = status_request
extendedKeyUsage = serverAuth, clientAuth
") \
-out ${prefix}-cert.pem -infiles ${prefix}-csr.pem
done
################################################################################
# Clean up
################################################################################
rm -f *-csr.pem
rm -rf ./demoCA