@bdd did an excellent writeup of the issue in #264. To fix this, stop relying on stable error messages between platforms and Go versions by performing a successful certigo connect in the test rather than a failed one.
I generated new ECDSA certificates for localhost using https://github.com/square/certstrap.
added dump-pkcs12-chain-to-pem.t to contrast with dump-pkcs12-chain-to-pem-first-only and show that multiple pem blocks are dumped without the --first flag.t
Add support for verifying server certs against SPIFFE IDs
This adds support to "certigo connect" to verify that the
server presented a certificate for a specific hostname or
SPIFFE ID. This name can now be unrelated to the hostname
to connect to and the Server Name Indication (SNI) to send
to the server during the TLS handshake.
Prior to this commit, the name expected in the certificate
could only be a hostname, specified either via --name (SNI)
or the hostname to connect to. SPIFFE IDs -- URLs with
"spiffe" as the scheme -- are not useful as hostnames or
SNIs. As a result, this commit adds a new --expected-name
switch to certigo connect. This override provides full
control over what name to expect in the server certificate
presented during the TLS handshake. For example, this name
can now be different from the hostname connected to and the
name specified in Server Name Indication (SNI). Moreover,
if --expected-name is a URL with "spiffe" scheme, it is
only matched against Subject Alternative Names of type URI,
as per the SPIFFE spec.
The latest released version is 1.12.1 @ f8835d9, however the version
string still reflects version 1.12.0, when run with:
```
$ certigo --version
```
Bump version string to lastest released version.
Signed-off-by: Nick Travers <n.e.travers@gmail.com>
This splits the logic into a cli, which handles parsing command line args and
reading files, and a terminal abstraction for handling user input and ouput.
All uses of os.Exit are removed in favor of returning errors.
Overall this enables better testing and reuse of code. Previously we had to
rely on external unit testing for CLI tests, which are harder to write tests.
