logstash-input-http 3.9.2-java → 4.0.0-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 954d8637cb33d798828ee28d7377c85760e92a10508d769403595f482495e4a1
-  data.tar.gz: c3208d826587cd389e9953e8e43fde6c413832f753c419070428ddce792636bd
+  metadata.gz: c406f5e0d989c833db3c35529b4012053539955f830fde6ca9e44235f4a39d3b
+  data.tar.gz: 22916a6402a2c55edfbee1bf3af0a578b630d2fd756356733bfc0c7de3359fdf
 SHA512:
-  metadata.gz: 2194d9eacb3eef53bbf9d22834e5a9fe134a70036d6e6f9a46aa305615f1a7bc72cb4c7831e0c44b7cd43d1eb706656745421390952f2cd3f06fdea024158a4f
-  data.tar.gz: 80d98e68ea5dcf6c2d5f49681340421fa54951efb18ede9872faba40dec924ca54755838961af890cc8902fc4d36a0598b975b019bbc6998b62a9076fccda69c
+  metadata.gz: 2c2616bcde330f2d0a2d0f4273f45e7bd2ad7e09e3a1322d0c759c146c38e13c92f202b45c4a1df6a19b0b9e1ae46eaaa0e3ec1fc81f5e8421a591479122ab3e
+  data.tar.gz: 1b4d208dc8e180ee5818270f1ceb36625870d4429b9570102f69beb96c253bc5a64fc3837c90d8960b2bca1391b9b93bff76fd648d67ed27cb8b9b366b238ca2

data/CHANGELOG.md

@@ -1,3 +1,16 @@
+## 4.0.0
+  - SSL settings that were marked deprecated in version `3.7.0` are now marked obsolete, and will prevent the plugin from starting.
+  - These settings are:
+    - `tls_min_version`, which should be replaced by `ssl_supported_protocols`
+    - `tls_max_version`, which should be replaced by `ssl_supported_protocols`
+    - `cipher_suites`, which should bre replaced by `ssl_cipher_suites`
+    - `ssl`, which should bre replaced by `ssl_enabled`
+    - `keystore`, which should bre replaced by `ssl_keystore_path`
+    - `keystore_password`, which should bre replaced by `ssl_keystore_password`
+    - `ssl_verify_mode`, which should bre replaced by `ssl_client_authentication`
+    - `verify_mode`, which should bre replaced by `ssl_client_authentication`
+    - [#182](https://github.com/logstash-plugins/logstash-input-http/pull/182)
+
 ## 3.9.2
  - Upgrade netty to 4.1.115 [#183](https://github.com/logstash-plugins/logstash-input-http/pull/183)
 

data/VERSION

@@ -1 +1 @@
-3.9.2
+4.0.0

data/docs/index.asciidoc

@@ -87,21 +87,21 @@ for the request's content-type is found in the `additional_codecs` setting.
 
 This plugin supports the following configuration options plus the <<plugins-{type}s-{plugin}-common-options>> described later.
 
+NOTE: As of version `4.0.0` of this plugin, a number of previously deprecated settings related to SSL have been removed.
+Please check out <<plugins-{type}s-{plugin}-obsolete-options>> for details.
+
+
 [cols="<,<,<",options="header",]
 |=======================================================================
 |Setting |Input type|Required
 | <<plugins-{type}s-{plugin}-additional_codecs>> |<<hash,hash>>|No
-| <<plugins-{type}s-{plugin}-cipher_suites>> |<<array,array>>|__Deprecated__
 | <<plugins-{type}s-{plugin}-ecs_compatibility>> | <<string,string>>|No
 | <<plugins-{type}s-{plugin}-host>> |<<string,string>>|No
-| <<plugins-{type}s-{plugin}-keystore>> |<<path,path>>|__Deprecated__
-| <<plugins-{type}s-{plugin}-keystore_password>> |<<password,password>>|__Deprecated__
 | <<plugins-{type}s-{plugin}-password>> |<<password,password>>|No
 | <<plugins-{type}s-{plugin}-port>> |<<number,number>>|No
 | <<plugins-{type}s-{plugin}-max_pending_requests>> |<<number,number>>|No
 | <<plugins-{type}s-{plugin}-response_headers>> |<<hash,hash>>|No
 | <<plugins-{type}s-{plugin}-response_code>> |<<number,number>>, one of `[200, 201, 202, 204]`|No
-| <<plugins-{type}s-{plugin}-ssl>> |<<boolean,boolean>>|__Deprecated__
 | <<plugins-{type}s-{plugin}-ssl_certificate>> |a valid filesystem path|No
 | <<plugins-{type}s-{plugin}-ssl_certificate_authorities>> |<<array,array>>|No
 | <<plugins-{type}s-{plugin}-ssl_cipher_suites>> |<<array,array>>|No
@@ -117,12 +117,8 @@ This plugin supports the following configuration options plus the <<plugins-{typ
 | <<plugins-{type}s-{plugin}-ssl_truststore_password>> |<<password,password>>|No
 | <<plugins-{type}s-{plugin}-ssl_truststore_path>> |<<path,path>>|No
 | <<plugins-{type}s-{plugin}-ssl_truststore_type>> |<<string,string>>|No
-| <<plugins-{type}s-{plugin}-ssl_verify_mode>> |<<string,string>>, one of `["none", "peer", "force_peer"]`|__Deprecated__
 | <<plugins-{type}s-{plugin}-threads>> |<<number,number>>|No
-| <<plugins-{type}s-{plugin}-tls_max_version>> |<<number,number>>|__Deprecated__
-| <<plugins-{type}s-{plugin}-tls_min_version>> |<<number,number>>|__Deprecated__
 | <<plugins-{type}s-{plugin}-user>> |<<string,string>>|No
-| <<plugins-{type}s-{plugin}-verify_mode>> |<<string,string>>, one of `["none", "peer", "force_peer"]`|__Deprecated__
 |=======================================================================
 
 Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
@@ -140,13 +136,6 @@ Apply specific codecs for specific content types.
 The default codec will be applied only after this list is checked
 and no codec for the request's content-type is found
 
-[id="plugins-{type}s-{plugin}-cipher_suites"]
-===== `cipher_suites` 
-deprecated[3.6.0, Replaced by <<plugins-{type}s-{plugin}-ssl_cipher_suites>>]
-
-  * Value type is <<array,array>>
-
-The list of cipher suites to use, listed by priorities.
 
 [id="plugins-{type}s-{plugin}-ecs_compatibility"]
 ===== `ecs_compatibility`
@@ -220,23 +209,6 @@ See <<plugins-{type}s-{plugin}-ecs_metadata>> for detailed information.
 
 The host or ip to bind
 
-[id="plugins-{type}s-{plugin}-keystore"]
-===== `keystore`
-deprecated[3.7.0, Use <<plugins-{type}s-{plugin}-ssl_keystore_path>> instead]
-
-  * Value type is <<path,path>>
-  * There is no default value for this setting.
-
-The JKS keystore to validate the client's certificates
-
-[id="plugins-{type}s-{plugin}-keystore_password"]
-===== `keystore_password`
-deprecated[3.7.0, Use <<plugins-{type}s-{plugin}-ssl_keystore_password>> instead]
-
-  * Value type is <<password,password>>
-  * There is no default value for this setting.
-
-Set the keystore password
 
 [id="plugins-{type}s-{plugin}-password"]
 ===== `password` 
@@ -314,16 +286,6 @@ specify a target field for the client host of the http request
 
 specify target field for the client host of the http request
 
-[id="plugins-{type}s-{plugin}-ssl"]
-===== `ssl` 
-deprecated[3.7.0, Replaced by <<plugins-{type}s-{plugin}-ssl_enabled>>]
-
-  * Value type is <<boolean,boolean>>
-  * Default value is `false`
-
-Events are, by default, sent in plain text. You can
-enable encryption by setting `ssl` to true and configuring
-the `ssl_certificate` and `ssl_key` options.
 
 [id="plugins-{type}s-{plugin}-ssl_certificate"]
 ===== `ssl_certificate` 
@@ -473,22 +435,6 @@ NOTE: You cannot use this setting and <<plugins-{type}s-{plugin}-ssl_certificate
 
 The format of the truststore file. It must be either `jks` or `pkcs12`.
 
-[id="plugins-{type}s-{plugin}-ssl_verify_mode"]
-===== `ssl_verify_mode` 
-deprecated[3.7.0, Replaced by <<plugins-{type}s-{plugin}-ssl_client_authentication>>]
-
-  * Value can be any of: `none`, `peer`, `force_peer`
-  * Default value is `"none"`
-
-By default the server doesn't do any client verification.
-
-`peer` will make the server ask the client to provide a certificate. 
-If the client provides a certificate, it will be validated.
-
-`force_peer` will make the server ask the client to provide a certificate.
-If the client doesn't provide a certificate, the connection will be closed.
-
-This option needs to be used with <<plugins-{type}s-{plugin}-ssl_certificate_authorities>> and a defined list of CAs.
 
 [id="plugins-{type}s-{plugin}-threads"]
 ===== `threads` 
@@ -498,23 +444,6 @@ This option needs to be used with <<plugins-{type}s-{plugin}-ssl_certificate_aut
 
 Number of threads to use for both accepting connections and handling requests
 
-[id="plugins-{type}s-{plugin}-tls_max_version"]
-===== `tls_max_version` 
-deprecated[3.6.0]
-
-  * Value type is <<number,number>>
-
-The maximum TLS version allowed for the encrypted connections.
-The value must be the one of the following: 1.1 for TLS 1.1, 1.2 for TLS 1.2, 1.3 for TLSv1.3
-
-[id="plugins-{type}s-{plugin}-tls_min_version"]
-===== `tls_min_version` 
-deprecated[3.6.0]
-
-  * Value type is <<number,number>>
-
-The minimum TLS version allowed for the encrypted connections.
-The value must be one of the following: 1.1 for TLS 1.1, 1.2 for TLS 1.2, 1.3 for TLSv1.3
 
 [id="plugins-{type}s-{plugin}-user"]
 ===== `user` 
@@ -524,15 +453,24 @@ The value must be one of the following: 1.1 for TLS 1.1, 1.2 for TLS 1.2, 1.3 fo
 
 Username for basic authorization
 
-[id="plugins-{type}s-{plugin}-verify_mode"]
-===== `verify_mode`
-deprecated[3.6.0, Replaced by <<plugins-{type}s-{plugin}-ssl_verify_mode>>]
-
-  * Value can be any of: `none`, `peer`, `force_peer`
-  * Default value is `"none"`
+[id="plugins-{type}s-{plugin}-obsolete-options"]
+==== HTTP Input Obsolete Configuration Options
 
-Set the client certificate verification method. Valid methods: none, peer, force_peer
+WARNING: As of version `4.0.0` of this plugin, some configuration options have been replaced.
+The plugin will fail to start if it contains any of these obsolete options.
 
+[cols="<,<",options="header",]
+|=======================================================================
+|Setting|Replaced by
+| cipher_suites |<<plugins-{type}s-{plugin}-ssl_cipher_suites>>
+| keystore |<<plugins-{type}s-{plugin}-ssl_keystore_path>>
+| keystore_password |<<plugins-{type}s-{plugin}-ssl_keystore_password>>
+| ssl |<<plugins-{type}s-{plugin}-ssl_enabled>>
+| ssl_verify_mode |<<plugins-{type}s-{plugin}-ssl_client_authentication>>
+| tls_max_version |<<plugins-{type}s-{plugin}-ssl_supported_protocols>>
+| tls_min_version |<<plugins-{type}s-{plugin}-ssl_supported_protocols>>
+| verify_mode |<<plugins-{type}s-{plugin}-ssl_client_authentication>>
+|=======================================================================
 
 [id="plugins-{type}s-{plugin}-common-options"]
 include::{include_path}/{type}.asciidoc[]

data/lib/logstash/inputs/http.rb

@@ -55,11 +55,6 @@ class LogStash::Inputs::Http < LogStash::Inputs::Base
   # Password for basic authorization
   config :password, :validate => :password, :required => false
 
-  # Events are by default sent in plain text. You can
-  # enable encryption by setting `ssl` to true and configuring
-  # the `ssl_certificate` and `ssl_key` options.
-  config :ssl, :validate => :boolean, :default => false, :deprecated => "Set 'ssl_enabled' instead."
-
   # Events are by default sent in plain text. You can
   # enable encryption by setting `ssl` to true and configuring
   # the `ssl_certificate` and `ssl_key` options.
@@ -108,17 +103,6 @@ class LogStash::Inputs::Http < LogStash::Inputs::Base
   # This option needs to be used with `ssl_certificate_authorities` and a defined list of CAs.
   config :ssl_client_authentication, :validate => %w[none optional required], :default => 'none'
 
-  # By default the server doesn't do any client verification.
-  #
-  # `peer` will make the server ask the client to provide a certificate.
-  # If the client provides a certificate, it will be validated.
-  #
-  # `force_peer` will make the server ask the client to provide a certificate.
-  # If the client doesn't provide a certificate, the connection will be closed.
-  #
-  # This option needs to be used with `ssl_certificate_authorities` and a defined list of CAs.
-  config :ssl_verify_mode, :validate => ["none", "peer", "force_peer"], :default => "none", :deprecated => "Set 'ssl_client_authentication' instead."
-
   # Time in milliseconds for an incomplete ssl handshake to timeout
   config :ssl_handshake_timeout, :validate => :number, :default => 10000
 
@@ -150,25 +134,15 @@ class LogStash::Inputs::Http < LogStash::Inputs::Base
 
   config :response_code, :validate => [200, 201, 202, 204], :default => 200
 
-  # Deprecated options
-
-  # The JKS keystore to validate the client's certificates
-  config :keystore, :validate => :path, :deprecated => "Set 'ssl_keystore_path' instead."
-
-  # The JKS keystore password
-  config :keystore_password, :validate => :password, :deprecated => "Set 'ssl_keystore_password' instead."
-
-  config :verify_mode, :validate => ['none', 'peer', 'force_peer'], :default => 'none', :deprecated => "Set 'ssl_client_authentication' instead."
-
-  config :cipher_suites, :validate => :array, :default => [], :deprecated => "Set 'ssl_cipher_suites' instead."
-
-  # The minimum TLS version allowed for the encrypted connections. The value must be one of the following:
-  # 1.0 for TLS 1.0, 1.1 for TLS 1.1, 1.2 for TLS 1.2, 1.3 for TLS 1.3
-  config :tls_min_version, :validate => :number, :default => TLS.min.version, :deprecated => "Set 'ssl_supported_protocols' instead."
-
-  # The maximum TLS version allowed for the encrypted connections. The value must be the one of the following:
-  # 1.0 for TLS 1.0, 1.1 for TLS 1.1, 1.2 for TLS 1.2, 1.3 for TLS 1.3
-  config :tls_max_version, :validate => :number, :default => TLS.max.version, :deprecated => "Set 'ssl_supported_protocols' instead."
+  # Obsolete Settings
+  config :ssl, :obsolete => "Set 'ssl_enabled' instead."
+  config :keystore, :obsolete => "Set 'ssl_keystore_path' instead."
+  config :keystore_password, :validate => :password, :obsolete => "Set 'ssl_keystore_password' instead."
+  config :verify_mode, :obsolete => "Set 'ssl_client_authentication' instead."
+  config :cipher_suites, :obsolete => "Set 'ssl_cipher_suites' instead."
+  config :tls_min_version, :obsolete => "Set 'ssl_supported_protocols' instead."
+  config :tls_max_version, :obsolete => "Set 'ssl_supported_protocols' instead."
+  config :ssl_verify_mode, :obsolete => "Set 'ssl_client_authentication' instead."
 
   attr_reader :codecs
 
@@ -200,8 +174,6 @@ class LogStash::Inputs::Http < LogStash::Inputs::Base
   public
   def register
 
-    setup_ssl_params!
-
     validate_ssl_settings!
 
     if @user && @password
@@ -342,34 +314,6 @@ class LogStash::Inputs::Http < LogStash::Inputs::Base
   end
 
   def setup_ssl_params!
-    @ssl_enabled = normalize_config(:ssl_enabled) do |normalizer|
-      normalizer.with_deprecated_alias(:ssl)
-    end
-
-    @ssl_cipher_suites = normalize_config(:ssl_cipher_suites) do |normalizer|
-      normalizer.with_deprecated_alias(:cipher_suites)
-    end
-
-    @ssl_supported_protocols = normalize_config(:ssl_supported_protocols) do |normalizer|
-      normalizer.with_deprecated_mapping(:tls_min_version, :tls_max_version) do |tls_min_version, tls_max_version|
-        TLS.get_supported(tls_min_version..tls_max_version).map(&:name)
-      end
-    end
-
-    @ssl_client_authentication = normalize_config(:ssl_client_authentication) do |normalizer|
-      normalizer.with_deprecated_mapping(:verify_mode, :ssl_verify_mode) do |verify_mode, ssl_verify_mode|
-        normalize_ssl_client_authentication_value!(verify_mode, ssl_verify_mode)
-      end
-    end
-
-    @ssl_keystore_path = normalize_config(:ssl_keystore_path) do |normalizer|
-      normalizer.with_deprecated_alias(:keystore)
-    end
-
-    @ssl_keystore_password = normalize_config(:ssl_keystore_password) do |normalizer|
-      normalizer.with_deprecated_alias(:keystore_password)
-    end
-
     params['ssl_enabled'] = @ssl_enabled unless @ssl_enabled.nil?
     params['ssl_cipher_suites'] = @ssl_cipher_suites unless @ssl_cipher_suites.nil?
     params['ssl_supported_protocols'] = @ssl_supported_protocols unless @ssl_supported_protocols.nil?
@@ -378,17 +322,6 @@ class LogStash::Inputs::Http < LogStash::Inputs::Base
     params['ssl_keystore_password'] = @ssl_keystore_password unless @ssl_keystore_password.nil?
   end
 
-  def normalize_ssl_client_authentication_value!(verify_mode, ssl_verify_mode)
-    verify_mode_explicitly_set = original_params.key?("verify_mode")
-
-    if verify_mode_explicitly_set && original_params.key?("ssl_verify_mode")
-      raise LogStash::ConfigurationError, "Both (deprecated) `ssl_verify_mode` and `verify_mode` were set. Use only `ssl_verify_mode`"
-    end
-
-    deprecated_value = (verify_mode_explicitly_set ? verify_mode : ssl_verify_mode).downcase
-    SSL_VERIFY_MODE_TO_CLIENT_AUTHENTICATION_MAP[deprecated_value]
-  end
-
   def create_http_server(message_handler)
     org.logstash.plugins.inputs.http.NettyHttpServer.new(
       @host, @port, message_handler, build_ssl_params, @threads, @max_pending_requests, @max_content_length, @response_code)
@@ -467,13 +400,7 @@ class LogStash::Inputs::Http < LogStash::Inputs::Base
   end
 
   def provided_ssl_client_authentication_config(values = [@ssl_client_authentication])
-    if original_params.include?('ssl_verify_mode')
-      ['ssl_verify_mode', *values.map { |v| SSL_VERIFY_MODE_TO_CLIENT_AUTHENTICATION_MAP.key(v) }]
-    elsif original_params.include?('verify_mode')
-      ['verify_mode', *values.map { |v| SSL_VERIFY_MODE_TO_CLIENT_AUTHENTICATION_MAP.key(v) }]
-    else
       ['ssl_client_authentication', *values]
-    end
   end
 
   private

data/lib/logstash-input-http_jars.rb

@@ -8,4 +8,4 @@ require_jar('io.netty', 'netty-common', '4.1.115.Final')
 require_jar('io.netty', 'netty-transport', '4.1.115.Final')
 require_jar('io.netty', 'netty-handler', '4.1.115.Final')
 require_jar('io.netty', 'netty-transport-native-unix-common', '4.1.115.Final')
-require_jar('org.logstash.plugins.input.http', 'logstash-input-http', '3.9.2')
+require_jar('org.logstash.plugins.input.http', 'logstash-input-http', '4.0.0')

data/logstash-input-http.gemspec

@@ -22,7 +22,6 @@ Gem::Specification.new do |s|
   # Gem dependencies
   s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
   s.add_runtime_dependency 'logstash-codec-plain'
-  s.add_runtime_dependency 'jar-dependencies', '~> 0.3', '>= 0.3.4'
   s.add_runtime_dependency 'logstash-mixin-ecs_compatibility_support', '~>1.2'
   s.add_runtime_dependency 'logstash-mixin-normalize_config_support', '~>1.0'
 

data/spec/fixtures/certs/generate.sh

@@ -41,5 +41,8 @@ openssl pkcs12 -export -in client_from_root.crt -inkey client_from_root.key -out
 # use java keytool to convert all pkcs12 keystores to jks-format keystores (pass:12345678)
 keytool -importkeystore -srckeystore client_from_root.p12 -srcstoretype pkcs12 -srcstorepass 12345678 -destkeystore client_from_root.jks -deststorepass 12345678 -alias client_from_root
 
+# create pkcs8 version of root key
+openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in root.key -out root.key.pkcs8
+
 # cleanup csr, we don't need them
 rm -rf *.csr

data/spec/fixtures/certs/generated/client_from_root.crt

@@ -1,35 +1,35 @@
 -----BEGIN CERTIFICATE-----
 MIIGATCCA+mgAwIBAgIBBDANBgkqhkiG9w0BAQsFADBRMQswCQYDVQQGEwJMUzEL
 MAkGA1UECAwCTkExEzARBgNVBAcMCkh0dHAgSW5wdXQxETAPBgNVBAoMCExvZ3N0
-YXNoMQ0wCwYDVQQDDARyb290MB4XDTIxMTEyNDEwMjEzMloXDTI0MTEyNDEwMjEz
-MlowUzELMAkGA1UEBhMCTFMxCzAJBgNVBAgMAk5BMRMwEQYDVQQHDApIdHRwIElu
+YXNoMQ0wCwYDVQQDDARyb290MB4XDTI0MTIwMzIzNTQzNVoXDTI3MTIwNDIzNTQz
+NVowUzELMAkGA1UEBhMCTFMxCzAJBgNVBAgMAk5BMRMwEQYDVQQHDApIdHRwIElu
 cHV0MREwDwYDVQQKDAhMb2dzdGFzaDEPMA0GA1UEAwwGY2xpZW50MIICIjANBgkq
-hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAzz7tc52SXN84bP8/009HnfkDMGhqvNgi
-oO+kza7PT1O7jcA3i0hh1r2N4xUIllc3cSvcfFK/sw8mAFPGE6lMIPAWHnsFipd1
-6rrk7jIVEgBE7ZUYuqWRRQ7ULV1a3LTxCn7XUrtk1bbrLgPRcoUev81L19AQZQ6R
-DGv9MyFE2X71lvchj09eLh4RcR7/5Myj6ODtz5mYOIn8hqAaYCa6Zu0A54WbQd4p
-xc/iuEQqpUJNcXdVJyNAzhDQq/oMImWgWs/nuMIrCV0WXttGsOnztxsftytsNtnP
-SOBuULhRdDrkV16u7zMftANBWdoWIcdbc6ipr17ZrqySmioSWHk5YcsRwP6Em9Hq
-SHgNXSDkb3+TPQX/XG2cmaPI+a8yTvgV1igMbzDYEznfqOhNG/28jTGo36iMt+R1
-ZrDWoIxRqSKq7WAiGmnKZKiy4xV4Ze3zekx7xse/S/OxmWvOCYN0+aLFgxNuizX5
-PpY6PhwJ/+I5JpbH2pXwuPsFMAyt5vwmcrS6k7O3vvUml7mwHQVQTqrNEvPHDwxe
-H6n2LiW7Bbana12rkdMU5mXwBMMTVz1sjOZnzM1M+JEoce3UXfGuflhG7amOhPJf
-Aj7vMR6kilzATFjmx1hdqqHzNARkeuxLhUzpdgKnk3nEmYPKx1MB7Y4FvpSEoTPV
-K3rPkMHQm6UCAwEAAaOB4TCB3jAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF
+hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvNGWMOYl/etQBVwxlaH5DSEXA5HuD0iG
+lTnOmy/gX1AUCnf/s3oUIu9AnmdvZMuVGwDBrFItKU+fTWTmkusoBa9Ih1UZgYqd
+8ZQi5+cPRaK7M/+vpPgZ6OSp6gONc65tMPqB0KGMjBm5se8eXJV6eOAxu7rT3Ylu
+DlXTDRVP4gO4/JwidHO8l+JKz4SZng/cqw2WftdCZJygadQwUOCLba1CIQqs0IwP
+tIcjVYxYoQQD3qtahAmsVaZU+H78gRm2wNJHoeb+OGTnlSaG5WLnIPBdycfynMoc
+EZ3u4uYC4x/OGLpzrXCg6kULf/siM2nInHR0CZAalmLtvfXXvSZ44+Ux9uhDxAhh
+UPzE0ntAVqoP7MoUnFbOaoVHBGzKy/Iqw3P4YaxymxPZW3Ya3jqN9cLo/4P+/kOF
+AEMRwvj6LHIq0Q1wOWYXuZXGXCeBik+EpCtDWxzNimyit17DfZCx4IZA9hqhvxld
+n92pkW8f57G/akTB5C5Q9OFpiluEA26CQiGav7wMZVwHLujtOLrzymPfhAyjmIB/
+N7WKMuYSXKgC95T5IkNv660rE1+4rZ7PazvgPTx0hgzg+S5wxc0KtDUJgWs/gtkG
+5fwloNnnDTHTtpr569fCdJoas3fEcyDxvrFumIiOymE7P2ffNO/nRiBSNSa9A2Oq
+gxURnCZjXgUCAwEAAaOB4TCB3jAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF
 oDAzBglghkgBhvhCAQ0EJhYkT3BlblNTTCBHZW5lcmF0ZWQgQ2xpZW50IENlcnRp
-ZmljYXRlMB0GA1UdDgQWBBTXHNdFAtzeVD56PI6/Mu/wVzDCyzAfBgNVHSMEGDAW
-gBSn18dv3u0R/O/LDPC7h+wHlcpFqDAOBgNVHQ8BAf8EBAMCBeAwHQYDVR0lBBYw
+ZmljYXRlMB0GA1UdDgQWBBQ7nE3b49NUrz6Pt0Stbks/331++TAfBgNVHSMEGDAW
+gBTimcFV2onYOhvPHoNcBGb4oovAvDAOBgNVHQ8BAf8EBAMCBeAwHQYDVR0lBBYw
 FAYIKwYBBQUHAwIGCCsGAQUFBwMEMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAA
-ATANBgkqhkiG9w0BAQsFAAOCAgEAE23qZ7HfFubCXYCzGxTq+zzMAId5rUn8Cnav
-9eEGdofjkRRHJnW1yM8AmblbwxM8fs6SrQtujhGNFWEsGuXDoFFG6ID06eFsC1yC
-RpKme0PRsKruBn8Na5Z2jeZ0SWKvW+1ZlvosMhQQh6QaNf7VTNVizJD+J34QxFeH
-N66/Fh8/sh0ZooFy791japEtec8HJIBHNPrJprqYnzosKTRnYSLJpiCP9ksordMS
-rTHWGDRnUXu1ggWanopt5wZfICG92gi8rROEk4fwFUy93E+WEzv8XCXpRxZqhdJf
-V+jPoUHo4ZOnM8uFna5Y/o+DiVOdPXgn9xspe5qhEvU8upsvKRVNlfAXVGWjiG13
-ZdR3PvGITplFhNkBAuPIf1Z/xTF0e8JzQSSC2CtThGuCJz9uSB6zpnxjODKxAqFX
-IbbH8Tnf8q6nEJm0RbMOyAc/HvX2eei1TV1XD9StL/M/2n0bCn/+s4peT4/qOy2T
-zqQYTe45RknishUiMiv00//W5LNImjb0THHxQ1kQxi7Tlk0dZ5CPUjMfBVCt+Gdo
-EQMjeGjvjfRvKtGzhtMDmkA3Oc8iOiaaR7mSU+ZjslDlRYnPKicbls673ttL3rx8
-R//PwWeZcBWkbowOYNJnjaiySpoO3WVEGMA8mUw4SEtlga6760cN4+e4pKnzo1sR
-P1W1gRQ=
+ATANBgkqhkiG9w0BAQsFAAOCAgEAeQaNjo5b8qjtkUSj3ragLlIbZHZviOWWtJsA
+bpqw2Tyf6Mn9uSESoViAdy8bnGxpuk5FgIydJ9LRnOebjDxB/adYyf0+NJxsMiwq
+z4ROVZLa3xPkL18GVPAg+3nlPiI8uUKNOJIglzO1ueOU30Vc9KG9bQIRbsKMX06H
+JHkPFPRRxtHcUCUggibQcKHoSmgNkBVPVbCTbupYQ6WMt+oKpGjc/mSa7vZNXiYL
+qa0qVmczo2KWXuvTZ0DQQbEZL0lDTVOA0WI+wxAotd4h3w0x5J4mAgic+5GyVuRD
+XInsDyG7RBnUr+hH+eeZ8z+SzTEy8isVOsAdgjyh/bKUHmiRQPgcVxUpnJz/DzrQ
+mLOZ9YSwVJ9pc7MYnvjJqbAkM2+m8BEb6UgspQmcd3NY6sXS1JYfNmxwyqvYjLEQ
+ylOo2oEDRKrPtmAQ6w7wuItVUvnczXtuRjpN5uR5+9GvWKm+Wxru3v9EFkz79oUj
+uA9/CXoFNWBFTunDsHP482ty9rLjP3iMLbh9JpZJ01uSsehGNFQVhfEsuSxa9oEJ
+6lk40tR2C/vQXMvKt9AAJ1H1t9JAc2idj29p6mUia3YwE91WiYJElgHM7b3o7zGu
+YDA+VNda80FvUm42iqpNz+21nYULtasJ0WUrg2RrFnPXEykr4kX0kQV2wbTnW0YE
+udpNeRQ=
 -----END CERTIFICATE-----

data/spec/fixtures/certs/generated/client_from_root.key

@@ -1,51 +1,52 @@
------BEGIN RSA PRIVATE KEY-----
-MIIJKAIBAAKCAgEAzz7tc52SXN84bP8/009HnfkDMGhqvNgioO+kza7PT1O7jcA3
-i0hh1r2N4xUIllc3cSvcfFK/sw8mAFPGE6lMIPAWHnsFipd16rrk7jIVEgBE7ZUY
-uqWRRQ7ULV1a3LTxCn7XUrtk1bbrLgPRcoUev81L19AQZQ6RDGv9MyFE2X71lvch
-j09eLh4RcR7/5Myj6ODtz5mYOIn8hqAaYCa6Zu0A54WbQd4pxc/iuEQqpUJNcXdV
-JyNAzhDQq/oMImWgWs/nuMIrCV0WXttGsOnztxsftytsNtnPSOBuULhRdDrkV16u
-7zMftANBWdoWIcdbc6ipr17ZrqySmioSWHk5YcsRwP6Em9HqSHgNXSDkb3+TPQX/
-XG2cmaPI+a8yTvgV1igMbzDYEznfqOhNG/28jTGo36iMt+R1ZrDWoIxRqSKq7WAi
-GmnKZKiy4xV4Ze3zekx7xse/S/OxmWvOCYN0+aLFgxNuizX5PpY6PhwJ/+I5JpbH
-2pXwuPsFMAyt5vwmcrS6k7O3vvUml7mwHQVQTqrNEvPHDwxeH6n2LiW7Bbana12r
-kdMU5mXwBMMTVz1sjOZnzM1M+JEoce3UXfGuflhG7amOhPJfAj7vMR6kilzATFjm
-x1hdqqHzNARkeuxLhUzpdgKnk3nEmYPKx1MB7Y4FvpSEoTPVK3rPkMHQm6UCAwEA
-AQKCAgBbiP2zvPryTh1L9wknubJ2EY/ZB6VtN0FEN9RgjD9AWElUeHuP5y5ffGV4
-0Md0L51rPOYrexj0a1JrfpTUBkh7m88JM2jlJ7SLMnT+x9wKkVfgX6QGfC5HhB8u
-0jbZmImGCzPrdJ06z4ncTw9pN2a3bGN9NIapO9/QzrmMpbsVHUA3p3uJIpMEZ39o
-qTp4wfH7X61prftPrZJ9m6VKppBZ+YAWwioq04c7uW/31xPG3hv6a6yOlsF+wmqI
-Ku7FGoHS2lUMg6Yigpzo1IzKguqEC1TcwC8Rou4s0AOpX1+KqKBF/qnhOIFeLrnk
-h7CSxsybrvkTXh9jSRGPSdnEffZbcZtw9XagD+fg6mYrqQH95Tfp83pDEAMtoe5e
-cSGoLbt9c1Et9rtWcosFTxzLTWSOjme5qomsDZxlZpFt5YML14aCgMafMnWLGhwB
-hX9NfdYGJ1Sqit5CM1MCoLAvWfW+5OeR28Wn9n5P3gBsvw+2aPLrdD6EeCJHMq9k
-jDJXJsuWQhbZqapnIGn6kiOqHpQxPf2Q4VkkA6zDbtcy9e9QsKNFFcP4z1p2crBg
-QhVvdLw3tOqoleJZV5Nn7wv0tzHSV4ccyoFl2j3CNFl6qG39J3Xtkm+ecWQyaZYt
-vAF4hK7LsoLbJi2EYLRXsQj9H/LocD7D1AHLgwT0mK0ZwEfRAQKCAQEA7MWkosMJ
-MITK0nsQStNq2UV+BI2Hfou1q65KAQQOgrOgSFmb/rijSSkZknlU20iEBWaJebep
-i9fCzDdJLkjZ6ISzMyxIfhS0//mlYE4Xcz0APcT54tnhQ8n38qId1CkC7K3sViY7
-3ufwr6ALExrRZ/0paNtuLA0bvIIyPXA28DbGThdpjPGS5rCwMWAnT81RWN7uvEyO
-0dt4oCunLgjrP+22NpQbnQvVN6kgW8tPVl8p2w3fRY3JINjRlJDZeACzV1zQ/tVy
-ZlbLsfoMUOsR93Dt+lCZua4Tdt3DCiB3C0yJt05FYqS8ZFJwq0Yoynrdo1bxi9Rt
-dp8S5N+0nu3RIQKCAQEA4BNzZMNYhTO+nNv8/9TIO+lSBFNwVtKB95vlA7OpX0I8
-0W+0eOqy1nf7Df60B58kZ3Dop+VAzIooGmeVkW1+9BVn1b929XwUcvEjhBdWDran
-XMg5ai/JKbrTw2bAPdFcIRDTQZgDz4DlOEQIsbFHIPxumloVXVv824qfLolhgFpS
-y7uYGJ9/tsncdWtbPJNIKCTOxmp7KZyAsaVLpjjK9MVv8poHwTrFv5ziJyoo460/
-hD8L3E4uzXe6ydTzgtYpTfyFwVyvLathx4aVjGWGtdWcvApB6rivFaP6ZRdZGU2n
-9g34mQAumkJzg0XlVJzZulSgVEpkw2prvaG6TezGBQKCAQBi/Z7/jZth9aL2rQz6
-u7mIbU1qieGEPtUNmijGk/OdIYx5sz1NGdTq2YwfeSrJI2BPAbeoc+km1mZTCypF
-d5/jXtetJW6JiA7ElpNV2FBllbNsH9Z5ya4ssVxAzRa7hQn7+hs9SW7umvo98yOu
-MSAr4eRWOqetMy3NeoGWvju54qy2KYOvsbBBUs3XVuQYsTa5eTtG7psnkiK0lIuo
-64GvkKsF1pZU6oWSZ9tnhXD+I3tUYlBevBDC8uNswcKqMWDJvbyDTqotr0wqdOiB
-TEaOtWBJrzkWMHli0QSiT0B2MOHDCa5ot4csSmtgsEyNmyDfEZKba4z4czlrBzx0
-1ekBAoIBABxGmBMpC2yToQQORpjJ8xKMWMsu9EggfEIQrA+Rhlf89cu/+tgfVb32
-mfmkIHetv1xGRTWamli1PmZGl/soBBMs+FNiu9IyfCoc/8xVXYixx+DPa19Y9FuN
-tdc8ihnC54tMojvuwNxYeZRmEWrK4hzpfdOAdp23U+soTPoEYAdgXn5TB9hjmCwq
-wOUYTQUR2NMoAefL3AreMuc34pnxJLtKhtvoT/40Omv5khg7G7nPTOqVQhvkyccn
-yqxZcPkbqU6sBPzngzuSGt6gvxJeZWdgs0yPRs4lzAJBFQHYtmeZAw7rqGk2OqtA
-o273TP8mY9s9fpXkZV67eSkO1YGr1TkCggEBAIQ3aI6TqDd5Wp52IM/beSxhg5+A
-Vt+hI4Gdc0mNLJTm8/l3nd+uQpPVmuVBosfaXQK+IWDLDP4II6qBFUfOD95eK76O
-Y4LJNvO3urQOh56bujnZ1ZgeKeUU36itgtp+YbYUHMSUA9BFlUr0n00POovili/M
-BfHy8pcAB0EvY/B2k00v/Uj8kwbBvu1NNhUDzhUCVQM06b6SqLIA7/UeDHUYnYMJ
-s3w6Eqo8yaHQJkY5DlJfO4JoXe1pZQNm3d2bAQG4vzIbyHFk2yShXTQuV5YNIATh
-cKLW7xpRoDIciZVu6m4aiYw1kABty9UTSk0jKu86RjM0Epb/LnUG1qtSpPI=
------END RSA PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQC80ZYw5iX961AF
+XDGVofkNIRcDke4PSIaVOc6bL+BfUBQKd/+zehQi70CeZ29ky5UbAMGsUi0pT59N
+ZOaS6ygFr0iHVRmBip3xlCLn5w9Forsz/6+k+Bno5KnqA41zrm0w+oHQoYyMGbmx
+7x5clXp44DG7utPdiW4OVdMNFU/iA7j8nCJ0c7yX4krPhJmeD9yrDZZ+10JknKBp
+1DBQ4IttrUIhCqzQjA+0hyNVjFihBAPeq1qECaxVplT4fvyBGbbA0keh5v44ZOeV
+JoblYucg8F3Jx/KcyhwRne7i5gLjH84YunOtcKDqRQt/+yIzacicdHQJkBqWYu29
+9de9Jnjj5TH26EPECGFQ/MTSe0BWqg/syhScVs5qhUcEbMrL8irDc/hhrHKbE9lb
+dhreOo31wuj/g/7+Q4UAQxHC+PoscirRDXA5Zhe5lcZcJ4GKT4SkK0NbHM2KbKK3
+XsN9kLHghkD2GqG/GV2f3amRbx/nsb9qRMHkLlD04WmKW4QDboJCIZq/vAxlXAcu
+6O04uvPKY9+EDKOYgH83tYoy5hJcqAL3lPkiQ2/rrSsTX7itns9rO+A9PHSGDOD5
+LnDFzQq0NQmBaz+C2Qbl/CWg2ecNMdO2mvnr18J0mhqzd8RzIPG+sW6YiI7KYTs/
+Z9807+dGIFI1Jr0DY6qDFRGcJmNeBQIDAQABAoICAAYJYFcfYIsR7RzCwg4R39vA
+2VLCpV0FOVJHhxi0iuSZM47TH9Bt4HtucT8vOOM80/9JQqfe97Uop8PqbCm5zW2D
+GVtER/y5gQuya/xEiZs1FO2YaNXqHa/xsZH6+5h9dN26QJC6PXtULjjnV23n1ILN
+TiG9mxzr0iIwsb7rFcL40f73ge19rsOfVztztpKUWL56QHu9J5D+Ze2EPGg1iZef
+0KusQvKm67Cemm1Xf5TkQzho+4uZoJIbb3+DVdDN0OcwwdwF/c4xQasl0G3Af/mw
+XZtAInxLROL2TOchqel3gJgPS/f5UBe1TeURUxpYMTL5USVmH0d8EbQ/Sh6wvnAi
+ttORnIoMEfU4dy6XcV/xjK9nNAfGSwQgOnGdjbTAtamQieoQgjVzSL/+TTRN7onZ
+97mdfyym50sY5PqxfgtzO11OQ7b6PnRmxw7uci1WPcP+JBaKkiL12ObraUG2+320
+Yfw9nZqxblFag7ByttAroghRmKzGUS6+tamlMhh1DMk5/9uXS3lUaD6vJIJ87gCf
+D8hZPpfqYFzZ22oQu9sJEfwigRiAa57a86Adymo1o5T9fiwVyEMIzx1X7oR3Gy9h
+UsmyU4sAI3aAwQyh2w6GRgaAzS6iNCEMqNjgpQ+/z4IJMW8XB527jSqdGN0hj3ab
+xKtUPmdqOjLvkr2vuFopAoIBAQDmJUn/MvlbkDj8Ov7+K6HOYVcl+lAADuLhxF5h
+S40FgN5I4CrGoHTNaGmNDUKNER74qE5ie3g/P2IuN1mmmLjAq9kywo8LmmZGI7JT
+sC6UIVrzgKURLiY7ZqybuM/HgB0lHwaGCbtcBJzhWExywZ+jBAWxpFxzmlbBN9jx
+wgLTe+hXB7wDirx4FzNzyzsWq/flFHf8EAdZsoc0V1yiP3x/0GBX59XQAd3/EfgC
+VO4VEZWjJKAF11Ft20U7c7yHckOZ+VOCPxNEJm/sH1dPV0xjqSVzurUb/UNecqK3
+84xQECkSk1R3kLQ0mTcuz8LnMr2BQbvJu7UPX6RLduzhIBJNAoIBAQDSB8i+p9GY
+cUSrLR09fV5VJRNRZOxLp762aMu89NaXkyqiYGFddsNXALfeN0oa64fzsXxKgC0H
+XRtTICqGL9p5lxgnxazNWRyLqWs9VqdnEgHIqFQJZtFVJF4NF6z+OfUAGPiUNzWd
+o+9dkYLCmxSoC2WY80Vycsywn5zXyHWTgvET5zeBwut2i7DhNXZ0qWCs/UZH3tdw
+n8KXV4/XB/YBhln3TfX5qVa0fAETWBRyhaVTb7MW3Z4OCUISGbsXZIO53OQwwPvi
+Z7qcOJQk+bLlvbsc9gkFadS8uRMaLSlMUFRxYNYbmNuo33gT+yqBl4aL6LkHwVr1
+fx0Ba15sBSaZAoIBAHtltPY7G44nlxZOf5hCRsCEWpjHTIurb6TDiCM8wgEYZpbG
+cskLEXVtLWLuoCdI7cU/YL/XGdM3penHza7QpgbQXWWlAdOj1oB29U9/4ImWFNEI
+wfijOOaSl6vq/KUoIPhdWT8XCrk80+zTTjIddP2P04m66cMmFqwEyLJfZuqDvkCj
+qgBwK7tsHS9R4X23ePP/9JFW+snyOiIrUUTBK3zQekfHy1F7Hs97j/GYHgt34TaX
+FaHsIAH6FnXZCVXKQ0rUbx0furHItivxZfvpf9DTyXvyuNaoBa4nYu2kjTAEajFG
+g3yUPrsRB5B23zbdctRSLWDt3xe+HTZFLp9KdeUCggEAEJZ8zFIEw71uZvaRMKIO
+KTtcYzlNUExXS6DLNok/yYjd/SUPi4ots1ljLDHBsI6Zli2WW2v0InjAB7iqox50
+atX8GmgKVc2L65vd1GJbplBNw8NHn9Z3Afp1UyNjjlCVgQR33XzexyyDYyhy41vM
+Ldl4lLPh8EAQ2oJAqOo0Hwpgb+n7AEycvCgcOC04xc36zK7UNijrawGzJLDNs3X1
+f/lUcau+mZE+P9LrYtO6CbF0dTqFMnEeYo1oonVVyWsu3CcN/qu/OQpoOp5dVO5D
+qtFpTchAviS1oJIdaBvY/yX5BVtYjaVs89FycmGL4eBNyA8BThN/U5ROfiY0tuNR
+QQKCAQBRG/+oSf2w7GK1BgdvQPOLdtzph8ppiBpOkQwZyb1Q/lJN1HVjS3SGnOMW
+en3R9wEVNb37IQYy2dpsDWn9Ioa73lktT5mG/+7resEZVO21gVLfav9cIFwIpCyJ
+t3r+J2/7Cq2EZbBsyfqzVb7hcloxMO8WajQfLvD6e0IBUF/BASF/H4KWpCxHbYd4
+qwhOEGL1TZPXamj/Hh+OIQ2bjVRNcoyXDv286YKcDhW3Pcg7jwdBjIWH61n+1y3P
+CENjhxlTvlQ04QKyKdApAaaKkPFkde7+y4z9Lx6xXO0Z6lQcaT19kUUnrvMDRTSo
+NPBWUAWkeuCzFYeJ1YIV3tMD+QiU
+-----END PRIVATE KEY-----