Re: Acceptance tests assume a multi level wildcard ssl cert

Felix Friedrich

Hello Christopher,

thanks for your reply. We are stumbling over the very same test again.
Just to confirm, the tests haven't been fixed according to [1], have
they? Can I help you in any way with fixing this test?

Best regards from Berlin,



On Mon, 19 Oct 2015, at 17:46, Christopher Piraino wrote:
Hi Felix,

You are right, we have found this issue in one of our own environments as
well, we have a story here
<> to address it by
skipping verification explicitly for this test only. Previously, I
that test only used an http URL when curling, recent updates to allow
configuration of the protocol exposed this issue. We do not assume
multi-level wildcard certs.

The curl helper was also changed recently to set SSL verification
for all curl commands
so the skip_ssl_validation configuration should still be working

If you want to see the tests pass, you could either set
"skip_ssl_validation" to false or "use_http" to true and the test should
work as intended. In any case, we are sorry for the failures and
we can get a fix out soon.

- Chris

On Mon, Oct 19, 2015 at 7:32 AM, Felix Friedrich <felix(a)>


we've just upgraded our CF deployment from v215 to v220. Unfortunately
the acceptance tests fail:
They reasonably fail. The test expects a valid ssl cert, but our cert is
only valid for * not for
*.* The test seem to expect a multilevel SSL
cert, I am not sure if that's reasonable or not.

However, I wondered why this exact test did not fail in v215. I
suspected that the way curl gets executed in the v220 tests changed and
it apparently seems that I am right [1]. Thus I assume (!) that before
curl's return codes did not get propagated, while they are now. (Return
code 51 is "The peer's SSL certificate or SSH MD5 fingerprint was not
OK." according to the man page.)

Also the new way of executing ("curlCmd := runner.Curl(uri)") does not
look like it gets the skipSslValidation value. As a fact running the
acceptances tests with the skip_ssl_validation option still leads to
this test failing. However the used library looks like it is able to
skip SSL validation:

Even if skip_ssl_validation would work, I am not very keen on activating
that option since that also applies to all other tests, which are not
using multi level wildcard certs.

Besides of the fact that curl seems to validate SSL certs no matter if
skip_ssl_validation is true or false, did you intentionally assume that
CF uses a multilevel wildcard cert?



Join to automatically receive all group messages.