Skip to content

[Backport][main to 0.9] | test(net): build test certificates where the subject name comes back const (#1723) #1724

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lihuiba merged 2 commits into from
Nov 2, 2026
Merged

[Backport][main to 0.9] | test(net): build test certificates where the subject name comes back const (#1723) #1724

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3255c72
test(net): build test certificates where the subject name comes back …
lihuiba Nov 2, 2026
f0dba63
test(net): resolve backport conflict in test_cert_utils.h
Coldwings Nov 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion net/security-context/test/test_cert_utils.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,15 @@
#include <openssl/evp.h>
#include <openssl/rsa.h>

// X509_get_subject_name()'s return qualifier follows the OpenSSL headers in use --
// 1.1.1 hands back X509_NAME*, newer ones const X509_NAME* -- while the setters below
// take a mutable one. One const_cast covers both: on the old signature it removes no
// qualifier and is a no-op, so this needs no version macro to stay compatible with
// either. The certificate is ours and writable, which is what makes the cast sound.
inline X509_NAME* test_subject_name(X509* cert) {
return const_cast<X509_NAME*>(X509_get_subject_name(cert));
}

// Generate a self-signed cert at runtime, different from the hardcoded test cert.
// Used in negative tests where a valid-but-wrong CA is needed.
// Uses legacy RSA keygen API for compatibility across OpenSSL 1.0.2 ~ 3.x.
Expand All @@ -28,7 +37,7 @@ inline std::string generate_different_self_signed_cert() {
X509_gmtime_adj(X509_get_notAfter(x509), 365 * 24 * 3600);
X509_set_pubkey(x509, pkey);

auto name = X509_get_subject_name(x509);
X509_NAME* name = test_subject_name(x509);
X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC,
(unsigned char*)"WrongCA", -1, -1, 0);
X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC,
Expand Down
Loading