mirror of
https://github.com/nodejs/node.git
synced 2026-11-09 15:11:11 -05:00
James M Snell
bd2b98f549
Signed-off-by: James M Snell <jasnell@gmail.com> Assisted-by: Opecode PR-URL: https://github.com/nodejs/node/pull/65511 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
46 lines
1.3 KiB
JavaScript
46 lines
1.3 KiB
JavaScript
// Flags: --experimental-dtls --no-warnings
|
|
|
|
// Test that DTLS uses Node's configurable default CA set when no explicit
|
|
// `ca` option is provided.
|
|
|
|
import { hasCrypto, mustCall, skip } from '../common/index.mjs';
|
|
import * as fixtures from '../common/fixtures.mjs';
|
|
|
|
if (!hasCrypto) {
|
|
skip('missing crypto');
|
|
}
|
|
|
|
if (!process.features.dtls) {
|
|
skip('DTLS is not enabled');
|
|
}
|
|
|
|
const { connect, listen } = await import('node:dtls');
|
|
const { setDefaultCACertificates } = await import('node:tls');
|
|
|
|
const serverCert = fixtures.readKey('agent1-cert.pem');
|
|
const serverKey = fixtures.readKey('agent1-key.pem');
|
|
const ca = fixtures.readKey('ca1-cert.pem');
|
|
|
|
setDefaultCACertificates([ca]);
|
|
|
|
const endpoint = listen(mustCall(), {
|
|
// Also cover the shared certificate-chain loader adopted by DTLS.
|
|
cert: Buffer.concat([serverCert, ca]),
|
|
key: serverKey,
|
|
host: '127.0.0.1',
|
|
port: 0,
|
|
});
|
|
|
|
// `servername` is both the SNI value and the identity checked during
|
|
// certificate verification. agent1-cert.pem has no subjectAltName, so the
|
|
// identity has to be matched against its CN; connecting to the IP literal
|
|
// alone would fail with X509_V_ERR_IP_ADDRESS_MISMATCH before the CA set is
|
|
// ever exercised.
|
|
const client = connect('127.0.0.1', endpoint.address.port, {
|
|
servername: 'agent1',
|
|
});
|
|
await client.opened;
|
|
|
|
await client.close();
|
|
await endpoint.close();
|