* key split wip
* fix piv tests
* fix terraform tests
* spelling fixes
* fix kube benchmark
* fix identity files in integrations tests
* self review
* fix typo in comment
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* speed up device login tests
* use EC keys in TestProxyAppWithIdentity
* faster tsh tests
* fix race on error value
* fix lint
* write out EC SSH keys in OpenSSH format
* fix lint
* fix keyring comparisons
* PrecomputeTestKeys in lib/client
* parallelize TestNoRelogin subtests
* use ecdsa for self-signed TLS certs
* remove redundant GetTrustedCerts
* improve latency of precomputeTestKeys
Instead of waiting for all 25 test keys before returning a single one,
tests can now make use of the first precomputed test key as soon as it's
ready.
In local testing with this change, the first key is ready after ~75ms vs
>350ms on master.
* fix test and lint
---------
Co-authored-by: Bernard Kim <bernard@goteleport.com>
As per https://support.apple.com/en-in/HT210176:
> TLS server certificates must contain an ExtendedKeyUsage (EKU)
extension containing the id-kp-serverAuth OID.
We were not specifying this EKU.
Validated by checking with the old self-signed certs:
$ security verify-cert -c webproxy_cert.pem -p ssl -r webproxy_cert.pem
Cert Verify Result: Invalid Extended Key Usage for policy
And then repeating the process after this change:
$ security verify-cert -c webproxy_cert.pem -p ssl -r webproxy_cert.pem
...certificate verification successful.
Closes#32531
* adds public web addresses to self-signed cert
* skips adding ip addresses to self-signed cert
* skip error on public addresses
* lint fix
* optimize logic and log error
* Update lib/service/service.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* skip adding IP addresses to DNS SANS and log warning
* lint fix and update log message
* add public addresses into IP sans if ips
* remove comment
* lint fix
* include empty ipaddress for GeneratedSelfSignedCert calls
* removed
* update function call
* logic updates
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* handle when a IP addressed can't be parsed for self-signed cert
---------
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Many of our tests (db package, I'm looking at you) generate many RSA keys. This has two main side effects; makes our tests slow and flaky as CPU usage spikes in random moments when the tests are run in parallel.
This change pre-generates RSA keys at the beginning of each test module and reuse them in randomized order to reduce the situation that one key has been used multiple times in one test.
I had to move a few files to avoid circular dependencies.
Nic Klaassen