Use trustme to generate IP_SAN cert

pquentin · sethmlarson · commit 4903840bf36a · 2020-01-14T13:05:08.000-06:00
diff --git a/dummyserver/certs/server.ip_san.crt b/dummyserver/certs/server.ip_san.crt
diff --git a/dummyserver/server.py b/dummyserver/server.py
@@ -39,10 +39,6 @@
 CLIENT_CERT = os.path.join(CERTS_PATH, CLIENT_INTERMEDIATE_PEM)
 PASSWORD_KEYFILE = os.path.join(CERTS_PATH, "server_password.key")
 PASSWORD_CLIENT_KEYFILE = os.path.join(CERTS_PATH, "client_password.key")
-IP_SAN_CERTS = {
-    "certfile": os.path.join(CERTS_PATH, "server.ip_san.crt"),
-    "keyfile": DEFAULT_CERTS["keyfile"],
-}
 IPV6_ADDR_CERTS = {
     "certfile": os.path.join(CERTS_PATH, "server.ipv6addr.crt"),
     "keyfile": os.path.join(CERTS_PATH, "server.ipv6addr.key"),
diff --git a/test/conftest.py b/test/conftest.py
@@ -89,3 +89,26 @@ def no_san_server(tmp_path_factory):
         {"keyfile": server_key_path, "certfile": server_cert_path},
     ) as cfg:
         yield cfg
+
+
+@pytest.fixture
+def ip_san_server(tmp_path_factory):
+    tmpdir = tmp_path_factory.mktemp("certs")
+    ca = trustme.CA()
+    # IP address in Subject Alternative Name
+    server_cert = ca.issue_cert(u"127.0.0.1")
+
+    ca_cert_path = str(tmpdir / "ca.pem")
+    server_cert_path = str(tmpdir / "server.pem")
+    server_key_path = str(tmpdir / "server.key")
+    ca.cert_pem.write_to_path(ca_cert_path)
+    server_cert.private_key_pem.write_to_path(server_key_path)
+    server_cert.cert_chain_pems[0].write_to_path(server_cert_path)
+
+    with run_server_in_thread(
+        "https",
+        "127.0.0.1",
+        ca_cert_path,
+        {"keyfile": server_key_path, "certfile": server_cert_path},
+    ) as cfg:
+        yield cfg
diff --git a/test/with_dummyserver/test_https.py b/test/with_dummyserver/test_https.py
@@ -21,7 +21,6 @@
     IPV6_ADDR_CERTS,
     IPV6_ADDR_CA,
     HAS_IPV6,
-    IP_SAN_CERTS,
     IPV6_SAN_CERTS,
     IPV6_SAN_CA,
     PASSWORD_CLIENT_KEYFILE,
@@ -721,18 +720,19 @@ def test_warning_for_certs_without_a_san(self, no_san_server):
                 assert warn.called
 
 
-class TestHTTPS_IPSAN(HTTPSDummyServerTestCase):
-    certs = IP_SAN_CERTS
-
-    def test_can_validate_ip_san(self):
+class TestHTTPS_IPSAN:
+    def test_can_validate_ip_san(self, ip_san_server):
         """Ensure that urllib3 can validate SANs with IP addresses in them."""
         try:
             import ipaddress  # noqa: F401
         except ImportError:
             pytest.skip("Only runs on systems with an ipaddress module")
 
         with HTTPSConnectionPool(
-            "127.0.0.1", self.port, cert_reqs="CERT_REQUIRED", ca_certs=DEFAULT_CA
+            ip_san_server.host,
+            ip_san_server.port,
+            cert_reqs="CERT_REQUIRED",
+            ca_certs=ip_san_server.ca_certs,
         ) as https_pool:
             r = https_pool.request("GET", "/")
             assert r.status == 200
