1
78%
master: 80%

Ran 18 Dec 2024 09:44AM UTC

Files 37

Run time 1s

Badge

Embed ▾

Committed 17 Dec 2024 02:19PM UTC coverage: 78.273%. Remained the same

Job # 12390299504.1

Build Type

push

github

Committed by

web-flow

Commit Message

CA-403767: verifyPeer can't use root CA for appliance cert check (#6187)

It is expected to use root CA certficate to verify an appliance's server
certificate for a xapi outgoing TLS connection.

Prior to this change, the related stunnel configurations are:
"verifyPeer=yes", and "checkHost=<hostname>".

The 'verifyPeer' option of stunnel doesn't treat the CA bundle as root
CA certificates. The 'checkHost' option of stunnel only checks the
host name against the one in server certificate. In other words, the
issue is that the root CA based checking doesn't work for appliance.

This change adds 'verifyChain' for the appliance to ensure the outgoing
TLS connection from xapi will verify the appliance's server certificates
by real root CA certificate.

Run Details

3462 of 4423 relevant lines covered (78.27%)

0.78 hits per line

xapi-project / xen-api / 12390299504 / 1
78%
master: 80%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job python3.11 - 12390299504.1

xapi-project / xen-api / 12390299504 / 1 78% master: 80%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job python3.11 - 12390299504.1

xapi-project / xen-api / 12390299504 / 1
78%
master: 80%

README BADGES
x