fix(tests): eliminate UtcNow race in GetChainCertificateTargetStore_NonSelfSigned test

The non-self-signed chain-routing test called DateTimeOffset.UtcNow.AddDays(1)
twice -- once for the root cert and once for the intermediate cert -- so when
the wall clock ticked a second between the two calls the intermediate's
notAfter ended up later than the root's notAfter, and CertificateRequest.Create
rejected it:

  System.ArgumentException : The requested notAfter value (...:11) is later
  than issuerCertificate.NotAfter (...:10). (Parameter 'notAfter')

Capture notBefore/notAfter once at the top of the test and reuse the same
DateTimeOffset for both certificates so the intermediate's validity window
is guaranteed equal to (not later than) the issuer's.

TESTS
- 216/216 passing locally; this was reliably reproducible under CI load
  (latest failure on commit ceea76255b).
This commit is contained in:
GraceSolutions
2026-06-04 22:40:20 -04:00
parent f4afbb6af4
commit b438abf18f
@@ -409,6 +409,9 @@ namespace PSInfisicalAPI.Tests
using (System.Security.Cryptography.RSA rootRsa = System.Security.Cryptography.RSA.Create(2048))
using (System.Security.Cryptography.RSA intermediateRsa = System.Security.Cryptography.RSA.Create(2048))
{
DateTimeOffset notBefore = DateTimeOffset.UtcNow.AddMinutes(-5);
DateTimeOffset notAfter = DateTimeOffset.UtcNow.AddDays(1);
System.Security.Cryptography.X509Certificates.CertificateRequest rootRequest = new System.Security.Cryptography.X509Certificates.CertificateRequest(
"CN=ChainRouting.Root",
rootRsa,
@@ -416,7 +419,7 @@ namespace PSInfisicalAPI.Tests
System.Security.Cryptography.RSASignaturePadding.Pkcs1);
rootRequest.CertificateExtensions.Add(new System.Security.Cryptography.X509Certificates.X509BasicConstraintsExtension(true, false, 0, true));
using (System.Security.Cryptography.X509Certificates.X509Certificate2 rootCert = rootRequest.CreateSelfSigned(DateTimeOffset.UtcNow.AddMinutes(-5), DateTimeOffset.UtcNow.AddDays(1)))
using (System.Security.Cryptography.X509Certificates.X509Certificate2 rootCert = rootRequest.CreateSelfSigned(notBefore, notAfter))
{
System.Security.Cryptography.X509Certificates.CertificateRequest intermediateRequest = new System.Security.Cryptography.X509Certificates.CertificateRequest(
"CN=ChainRouting.Intermediate",
@@ -426,7 +429,7 @@ namespace PSInfisicalAPI.Tests
intermediateRequest.CertificateExtensions.Add(new System.Security.Cryptography.X509Certificates.X509BasicConstraintsExtension(true, false, 0, true));
byte[] serial = new byte[] { 1, 2, 3, 4, 5, 6, 7, 8 };
using (System.Security.Cryptography.X509Certificates.X509Certificate2 intermediate = intermediateRequest.Create(rootCert, DateTimeOffset.UtcNow.AddMinutes(-5), DateTimeOffset.UtcNow.AddDays(1), serial))
using (System.Security.Cryptography.X509Certificates.X509Certificate2 intermediate = intermediateRequest.Create(rootCert, notBefore, notAfter, serial))
{
Assert.NotEqual(intermediate.Subject, intermediate.Issuer);