From 9ac64e90db602cc4dad4501e762981ffa909e64f Mon Sep 17 00:00:00 2001 From: yhirose Date: Thu, 18 Jun 2026 19:50:46 -0400 Subject: [PATCH] Generate IP-host test certificates in CMake build The cert_ip_cn.pem and cert_ipv6.pem certificates added in ba390f2 were only generated by gen-certs.sh, which the Makefile-based Linux/macOS CI uses. The Windows CI builds with CMake, whose own certificate-generation block was not updated, so cert_ipv6.pem was missing there and SSLClientServerTest.TlsVerifyHostnameIpv6San failed on is_valid(). Mirror the two openssl commands into test/CMakeLists.txt to keep both certificate-generation paths in sync. --- test/CMakeLists.txt | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt index d4e684c..c1c72f0 100644 --- a/test/CMakeLists.txt +++ b/test/CMakeLists.txt @@ -116,6 +116,23 @@ if(HTTPLIB_IS_USING_OPENSSL) WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR} COMMAND_ERROR_IS_FATAL ANY ) + # Certificates for IP-host hostname verification regression tests. + # cert_ip_cn.pem: CN is an IPv4 literal with NO subjectAltName. An IP host + # must NOT be authenticated via the CN, so verifying it + # against this cert must fail. + execute_process( + COMMAND ${OPENSSL_COMMAND} req -x509 -key key.pem -sha256 -days 3650 -nodes -subj /CN=127.0.0.1 -out cert_ip_cn.pem + WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR} + COMMAND_ERROR_IS_FATAL ANY + ) + # cert_ipv6.pem: CN is an IPv6 literal plus an IPv6 iPAddress SAN for a + # different address. The SAN address must match; the CN + # address must be ignored. + execute_process( + COMMAND ${OPENSSL_COMMAND} req -x509 -key key.pem -sha256 -days 3650 -nodes -subj /CN=::1 -addext subjectAltName=IP:2001:db8::1 -out cert_ipv6.pem + WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR} + COMMAND_ERROR_IS_FATAL ANY + ) endif() add_subdirectory(fuzzing)