move test cert generation to interceptor_suite.go

testing/interceptor_suite.go

@@ -5,15 +5,19 @@ package grpc_testing
 
 import (
 	"context"
+	"crypto/rand"
+	"crypto/rsa"
 	"crypto/tls"
 	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
 	"flag"
+	"math/big"
 	"net"
 	"path"
 	"runtime"
 	"time"
 
-	"github.com/grpc-ecosystem/go-grpc-middleware/testing/testcert"
 	pb_testproto "github.com/grpc-ecosystem/go-grpc-middleware/testing/testproto"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
@@ -23,8 +27,19 @@ import (
 
 var (
 	flagTls = flag.Bool("use_tls", true, "whether all gRPC middleware tests should use tls")
+
+	certPEM []byte
+	keyPEM  []byte
 )
 
+func init() {
+	var err error
+	certPEM, keyPEM, err = generateCertAndKey([]string{"localhost", "example.com"})
+	if err != nil {
+		panic("unable to generate test certificate/key: " + err.Error())
+	}
+}
+
 func getTestingCertsPath() string {
 	_, callerPath, _, _ := runtime.Caller(0)
 	return path.Join(path.Dir(callerPath), "certs")
@@ -63,7 +78,7 @@ func (s *InterceptorTestSuite) SetupSuite() {
 			s.serverAddr = s.ServerListener.Addr().String()
 			require.NoError(s.T(), err, "must be able to allocate a port for serverListener")
 			if *flagTls {
-				cert, err := tls.X509KeyPair(testcert.KeyPairPEM())
+				cert, err := tls.X509KeyPair(certPEM, keyPEM)
 				if err != nil {
 					s.T().Fatalf("unable to load test TLS certificate: %v", err)
 				}
@@ -110,7 +125,7 @@ func (s *InterceptorTestSuite) NewClient(dialOpts ...grpc.DialOption) pb_testpro
 	newDialOpts := append(dialOpts, grpc.WithBlock())
 	if *flagTls {
 		cp := x509.NewCertPool()
-		if !cp.AppendCertsFromPEM(testcert.CertPEM()) {
+		if !cp.AppendCertsFromPEM(certPEM) {
 			s.T().Fatal("failed to append certificate")
 		}
 		creds := credentials.NewTLS(&tls.Config{ServerName: "localhost", RootCAs: cp})
@@ -150,3 +165,45 @@ func (s *InterceptorTestSuite) TearDownSuite() {
 		s.clientConn.Close()
 	}
 }
+
+// generateCertAndKey copied from https://github.com/johanbrandhorst/certify/blob/master/issuers/vault/vault_suite_test.go#L255
+// with minor modifications.
+func generateCertAndKey(san []string) ([]byte, []byte, error) {
+	priv, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return nil, nil, err
+	}
+	notBefore := time.Now()
+	notAfter := notBefore.Add(time.Hour)
+	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
+	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
+	if err != nil {
+		return nil, nil, err
+	}
+	template := x509.Certificate{
+		SerialNumber: serialNumber,
+		Subject: pkix.Name{
+			CommonName: "Certify Test Cert",
+		},
+		NotBefore:             notBefore,
+		NotAfter:              notAfter,
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+		DNSNames:              san,
+	}
+	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, priv.Public(), priv)
+	if err != nil {
+		return nil, nil, err
+	}
+	certOut := pem.EncodeToMemory(&pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: derBytes,
+	})
+	keyOut := pem.EncodeToMemory(&pem.Block{
+		Type:  "RSA PRIVATE KEY",
+		Bytes: x509.MarshalPKCS1PrivateKey(priv),
+	})
+
+	return certOut, keyOut, nil
+}