test: fix expired cert #552
Conversation
There was a problem hiding this comment.
Pull Request Overview
Refresh example TLS materials and extend the generator script to avoid expired certs
- Regenerate example TLS certificate and EC private key.
- Update gen.sh to set a 10-year validity via --not-after 87600h.
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| examples/tls/certs/key.pem | Replaced example EC private key. |
| examples/tls/certs/cert.pem | Replaced example certificate with a new one. |
| examples/tls/certs/gen.sh | Added --not-after flag to extend certificate validity. |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| --san localhost \ | ||
| --no-password --insecure | ||
| --no-password --insecure \ | ||
| --not-after 87600h # 10 years, since its just for testing |
There was a problem hiding this comment.
Use the correct contraction: change 'its' to 'it's' in the inline comment.
| --not-after 87600h # 10 years, since its just for testing | |
| --not-after 87600h # 10 years, since it's just for testing |
| --no-password --insecure \ | ||
| --not-after 87600h # 10 years, since its just for testing |
There was a problem hiding this comment.
A 10-year certificate validity significantly increases exposure if the private key leaks. For test/dev usage, prefer a much shorter default (e.g., 24h or 168h) and/or make the duration configurable via an environment variable, for example: DURATION=${DURATION:-168h} and then use --not-after "$DURATION".
| -----BEGIN EC PRIVATE KEY----- | ||
| MHcCAQEEIBMqDe+zi5THTtiILMRzbu0mUqEkYxi/Plcb7ScXzKjqoAoGCCqGSM49 | ||
| AwEHoUQDQgAEcGqqm/fQvKtfX9zCRmSCeGpuRnbgXm0RVFR3hLipvq1ilrtpJkpU | ||
| GBVzBMeLVHLhafLOF6fccIK+rtJ5eDvTzA== | ||
| MHcCAQEEILERHUfgJDnnUdOd4JvwAURLG/V4TJjSS7Ng8+xcmk1+oAoGCCqGSM49 | ||
| AwEHoUQDQgAEZMqwS9W/qxdwGYziluuV2HO3ZXnThD//DbwZBZIW79rvqgbP2p1P | ||
| 069Cg22eA9yWgRG9JRxpazKP/lapsrwsCA== | ||
| -----END EC PRIVATE KEY----- |
There was a problem hiding this comment.
Committing a private key to the repository is risky, even for examples. Consider removing cert.pem/key.pem from version control, adding them to .gitignore, and relying on gen.sh to generate them on demand (e.g., as part of a test or setup step).
oops