444308 - Interoperability tests fails when time is not synchronized.

Status: RESOLVED FIXED

(NSS :: Test, defect, P2)

Description

[Slavomir Katuscak]

Case:
-IOPR test machine with Apache installed has time synchronized with other lab machines
-workstation to run NSS tests has time synchronized with other NTP server (time.euro.apple.com)

We run interoperability tests there when workstation is trying to connect to Apache in IOPR test machine and vice versa.

There is few second difference between time settings on those 2 machines, and I got to the situation, when first few tests from ssl_iopr_cov_ext_client function in ssl_iopr.sh failed and the rest passed. The number of failing tests was not always the same, it changed in time.

After deep log analysis I came to line:
verify error:num=9:certificate is not yet valid

Then I realized that the problem is in time synchronization. For machine where cert is verified it looks like cert is generated (and valid) in future, and validation process fails.

The best solution would be to have all machine synchronized, but this case can happen also to customer trying to run the tests, so there should be at least note about this problem. 

Suggested solution - for interoperability testing generate certs valid at least one day in past. Certutil has -w option, but (minimal) unit there is one month, so using -w -1 will generate certs valid from one month in past.

Comment 1

[Slavomir Katuscak]

Attachment: Patch.

Comment 2

[Alexei Volkov]

Comment on attachment 328650 [details] [diff] [review]
Patch.

It will work. r=alexei

Comment 3

[Slavomir Katuscak]

Checking in cert_iopr.sh;
/cvsroot/mozilla/security/nss/tests/iopr/cert_iopr.sh,v  <--  cert_iopr.sh
new revision: 1.8; previous revision: 1.7
done