crypto/tls: TestVerifyConnection/TLSv12 failures

[gopherbot]

#!watchflakes
default <- pkg == "crypto/tls" && test == "TestVerifyConnection/TLSv12"

Issue created automatically to collect these failures.

Example (log):

=== RUN   TestVerifyConnection/TLSv12
    handshake_client_test.go:1766: RequireAndVerifyClientCert-FullHandshake: handshake failed: server: remote error: tls: bad certificate
        client: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2025-01-01T02:46:41Z is after 2025-01-01T00:00:00Z
--- FAIL: TestVerifyConnection/TLSv12 (0.08s)

— watchflakes

[gopherbot]

Found new dashboard test flakes for:

#!watchflakes
default <- pkg == "crypto/tls" && test == "TestVerifyConnection/TLSv12"

2024-12-30 20:23 gotip-netbsd-arm go@b702a26c crypto/tls.TestVerifyConnection/TLSv12 (log)

=== RUN   TestVerifyConnection/TLSv12
    handshake_client_test.go:1766: RequireAndVerifyClientCert-FullHandshake: handshake failed: server: remote error: tls: bad certificate
        client: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2025-01-01T02:46:41Z is after 2025-01-01T00:00:00Z
--- FAIL: TestVerifyConnection/TLSv12 (0.08s)

— watchflakes

[4a6f656c]

Most of the test certificates (e.g. testRSACertificate, testRSACertificateIssuer, testRSA2048CertificateIssuer) have a not after of Jan 1 00:00:00 2025 GMT.

[gopherbot]

Change https://go.dev/cl/639595 mentions this issue: crypto/tls: update the expiration time of the certificate in the test case

[ianlancetaylor]

As far as I can tell one of the failing certificates is testRSA2048CertificateIssuer in crypto/tls/handshake_test.go. This certificate was just added in https://go.dev/cl/629736 committed in November, 2024, so this test was only going to work for a few weeks. Unfortunately I don't know how to correctly recreate this certificate with a more useful expiration date.

CC @golang/security @rolandshoemaker @FiloSottile @cpu

[gopherbot]

Change https://go.dev/cl/639655 mentions this issue: crypto/tls: fix Config.Time in tests using expired certificates

[cuishuang]

Change https://go.dev/cl/639595 mentions this issue: crypto/tls: update the expiration time of the certificate in the test case

I tried to generate a certificate with an expiration date of 2026-01-01, which passed the verification of func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *VerifyOptions) error, but the complete test still reported an error

The maintainer is fixing the problem here in CL 639655, and I will abandon this CL.

[abner-chenc]

I also get the same problem when executing all.bash in Go1.22 and Go1.23 branches. I think CL 639655 also needs to be backported to Go1.23 and Go1.22 release branches.

[FiloSottile]

@gopherbot please open backport issues for CL 639655. Tests are broken across releases.

[gopherbot]

Backport issue(s) opened: #71103 (for 1.22), #71104 (for 1.23).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gopherbot]

Change https://go.dev/cl/640237 mentions this issue: [release-branch.go1.22] crypto/tls: fix Config.Time in tests using expired certificates

[gopherbot]

Change https://go.dev/cl/640315 mentions this issue: [release-branch.go1.23] crypto/tls: fix Config.Time in tests using expired certificates

[bwesterb]

Presently crypto/tls doesn't expect config.Time to increment. In case that changes you can do something like

diff --git a/src/crypto/tls/handshake_test.go b/src/crypto/tls/handshake_test.go
index baf54c9f25..fff08e3045 100644
--- a/src/crypto/tls/handshake_test.go
+++ b/src/crypto/tls/handshake_test.go
@@ -20,6 +20,7 @@ import (
        "strconv"
        "strings"
        "sync"
+       "sync/atomic"
        "testing"
        "time"
 )
@@ -438,10 +439,17 @@ func fromHex(s string) []byte {
        return b
 }
 
-// testTime is 2016-10-20T17:32:09.000Z, which is within the validity period of
-// [testRSACertificate], [testRSACertificateIssuer], [testRSA2048Certificate],
-// [testRSA2048CertificateIssuer], and [testECDSACertificate].
-var testTime = func() time.Time { return time.Unix(1476984729, 0) }
+// Returns currentTestTime and then increments by a second.
+var testTime = func() time.Time { return time.Unix(currentTestTime.Add(1), 0) }
+
+// currentTestTime is initially 2016-10-20T17:32:09.000Z, which is well within
+// the validity period of [testRSACertificate], [testRSACertificateIssuer],
+// [testRSA2048Certificate], [testRSA2048CertificateIssuer], and [testECDSACertificate].
+var currentTestTime atomic.Int64
+
+func init() {
+       currentTestTime.Store(1476984729)
+}
 
 var testRSACertificate = fromHex("3082024b308201b4a003020102020900e8f09d3fe25beaa6300d06092a864886f70d01010b0500301f310b3009060355040a1302476f3110300e06035504031307476f20526f6f74301e170d3136303130313030303030305a170d3235303130313030303030305a301a310b3009060355040a1302476f310b300906035504031302476f30819f300d06092a864886f70d010101050003818d0030818902818100db467d932e12270648bc062821ab7ec4b6a25dfe1e5245887a3647a5080d92425bc281c0be97799840fb4f6d14fd2b138bc2a52e67d8d4099ed62238b74a0b74732bc234f1d193e596d9747bf3589f6c613cc0b041d4d92b2b2423775b1c3bbd755dce2054cfa163871d1e24c4f31d1a508baab61443ed97a77562f414c852d70203010001a38193308190300e0603551d0f0101ff0404030205a0301d0603551d250416301406082b0601050507030106082b06010505070302300c0603551d130101ff0402300030190603551d0e041204109f91161f43433e49a6de6db680d79f60301b0603551d230414301280104813494d137e1631bba301d5acab6e7b30190603551d1104123010820e6578616d706c652e676f6c616e67300d06092a864886f70d01010b0500038181009d30cc402b5b50a061cbbae55358e1ed8328a9581aa938a495a1ac315a1a84663d43d32dd90bf297dfd320643892243a00bccf9c7db74020015faad3166109a276fd13c3cce10c5ceeb18782f16c04ed73bbb343778d0c1cf10fa1d8408361c94c722b9daedb4606064df4c1b33ec0d1bd42d4dbfe3d1360845c21d33be9fae7")

[gopherbot]

Found new dashboard test flakes for:

#!watchflakes
default <- pkg == "crypto/tls" && test == "TestVerifyConnection/TLSv12"

2024-12-03 18:00 go1.22-linux-amd64 release-branch.go1.22@8f3f22ee crypto/tls.TestVerifyConnection/TLSv12 (log)

=== RUN   TestVerifyConnection/TLSv12
    handshake_client_test.go:1784: RequireAndVerifyClientCert-FullHandshake: handshake failed: remote error: tls: bad certificate
--- FAIL: TestVerifyConnection/TLSv12 (0.00s)

2024-12-18 17:42 go1.23-linux-amd64 release-branch.go1.23@1576793c crypto/tls.TestVerifyConnection/TLSv12 (log)

=== RUN   TestVerifyConnection/TLSv12
    handshake_client_test.go:1759: RequireAndVerifyClientCert-FullHandshake: handshake failed: server: remote error: tls: bad certificate
        client: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2025-01-03T23:03:32Z is after 2025-01-01T00:00:00Z
--- FAIL: TestVerifyConnection/TLSv12 (0.00s)

— watchflakes