From 93edc9dec336259558ef896fe8d02e4c02655ea6 Mon Sep 17 00:00:00 2001
From: Nick Rosbrook <enr0n@ubuntu.com>
Date: Fri, 30 Oct 2026 20:19:37 -0500
Subject: [PATCH] test: use simple certificate chain in systemd-report test

Ubuntu now ships upki, and contains patches for openssl4, curl, and
others, to perform extra certificate validation. One consequence of this
is that using a self-signed cert for both the server's identity, and the
client's trust anchor fails validation.

To fix this, build a simple CA and sign a certificate for the server,
and use the CA cert as the client trust anchor.

This fixes the test on newer Ubuntu, but should still work everywhere.

(cherry picked from commit 7ad5ff04a915fed31bc73a7d459eb19cd6fecf14)
(cherry picked from commit d10c617164a6d845b718c6e95935bf67bba36f22)
---
 test/units/TEST-74-AUX-UTILS.report.sh | 29 +++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/test/units/TEST-74-AUX-UTILS.report.sh b/test/units/TEST-74-AUX-UTILS.report.sh
index 48bbc4841a8..c63597dcbe6 100755
--- a/test/units/TEST-74-AUX-UTILS.report.sh
+++ b/test/units/TEST-74-AUX-UTILS.report.sh
@@ -122,13 +122,32 @@ systemctl status fake-report-server
 
 "$REPORT" upload --url=http://localhost:8089/
 
-# Test HTTPS upload with generated TLS certificates
-openssl req -x509 -newkey rsa:2048 -keyout "$CERTDIR/server.key" -out "$CERTDIR/server.crt" \
-    -days 1 -nodes -subj "/CN=localhost" 2>/dev/null
+# Test HTTPS upload with generated TLS certificates.
+# Build a basic CA and sign a cert for the server. The client will
+# use the CA cert as a trust anchor.
+openssl req -x509 -newkey rsa:2048 -keyout "$CERTDIR/ca.key" -out "$CERTDIR/ca.crt" \
+    -days 1 -nodes -subj "/CN=systemd-report test CA" \
+    -addext "basicConstraints=critical,CA:TRUE" \
+    -addext "keyUsage=critical,keyCertSign,cRLSign" 2>/dev/null
+
+cat >"$CERTDIR/server.ext" <<EOF
+basicConstraints=critical,CA:FALSE
+keyUsage=critical,digitalSignature,keyEncipherment
+extendedKeyUsage=serverAuth
+subjectAltName=DNS:localhost,IP:127.0.0.1
+EOF
+
+openssl req -newkey rsa:2048 -keyout "$CERTDIR/server.key" -out "$CERTDIR/server.csr" \
+    -nodes -subj "/CN=localhost" 2>/dev/null
+openssl x509 -req -in "$CERTDIR/server.csr" -CA "$CERTDIR/ca.crt" -CAkey "$CERTDIR/ca.key" \
+    -CAcreateserial -days 1 -extfile "$CERTDIR/server.ext" \
+    -out "$CERTDIR/server.crt" 2>/dev/null
+
+cat "$CERTDIR/server.crt" "$CERTDIR/ca.crt" >"$CERTDIR/server-chain.crt"
 
 systemd-run -p Type=notify --unit=fake-report-server-tls \
-    "$FAKE_SERVER" --cert="$CERTDIR/server.crt" --key="$CERTDIR/server.key" --port=8090
+    "$FAKE_SERVER" --cert="$CERTDIR/server-chain.crt" --key="$CERTDIR/server.key" --port=8090
 systemctl status fake-report-server-tls
 
-"$REPORT" upload --url=https://localhost:8090/ --key=- --trust="$CERTDIR/server.crt" \
+"$REPORT" upload --url=https://localhost:8090/ --key=- --trust="$CERTDIR/ca.crt" \
           --extra-header='Authorization: Bearer magic string'