Trust the DDEV mkcert CA so tests can browse the project over HTTPS - #95
Open
vever001 wants to merge 2 commits into
Open
Trust the DDEV mkcert CA so tests can browse the project over HTTPS#95vever001 wants to merge 2 commits into
vever001 wants to merge 2 commits into
Conversation
The test runners default to http://web, so the browser never needs to trust a certificate. Projects that have to browse the real project URL, for example a multisite where the hostname selects the site, land on a certificate warning page instead of the site. Mount ddev-global-cache, where DDEV keeps mkcert/rootCA.pem, and import it into the browser's NSS database on start. Projects staying on http://web are unaffected, they just get one more trusted CA in the test browser. Fixes ddev#94
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Issue
The test runners default to http://web, so the browser never needs to trust a certificate. Projects that have to browse the real project URL, for example a multisite where the hostname selects the site, land on a certificate warning page instead of the site.
How This PR Solves The Issue
Mount ddev-global-cache, where DDEV keeps mkcert/rootCA.pem, and import it into the browser's NSS database on start. Projects staying on http://web are unaffected, they just get one more trusted CA in the test browser.
Manual Testing Instructions
Check that the CA was imported:
ddev exec -s selenium-chrome certutil -d sql:/home/seluser/.pki/nssdb -Lddev-mkcertshould be listed next to the image's ownSeleniumHQ_tls.crt.To see the actual effect, point a browser test at the project URL rather than http://web: before this change it lands on the
Privacy errorpage instead of the site.Automated Testing Overview
Added an assertion to
health_checks()intests/test.batsthat lists the browser's NSS database and expectsddev-mkcert. The existing tests all browse http://web, so none of them would notice this breaking.Release/Deployment Notes
No breaking changes. The hook is a no-op when
mkcert/rootCA.pemis absent, for example in CI or when DDEV is configured without TLS.