fix test cert to be compatible with Chrome

Author: fkywong

tests/fixtures/10-tls.yaml

@@ -1,5 +1,5 @@
 ---
-# Single-node deployment with TLS mixed mode
+# Single-node deployment with TLS and load-balancer service
 # Tests: Basic deployment with TLS using inline cert + secret refs, no keeper, minimal config
 # Expected pods: 1 ClickHouse
 clickhouse:
@@ -18,6 +18,9 @@ clickhouse:
   service:
     type: ClusterIP
 
+  lbService:
+    enabled: true
+  
   extraPorts:
     - name: https
       containerPort: &httpsPort 8444
@@ -47,24 +50,24 @@ clickhouse:
       #   openssl rsa -noout -modulus -in test-server.key | openssl md5
       inlineFileContent: |
         -----BEGIN CERTIFICATE-----
-        MIIDQjCCAiqgAwIBAgIUcO0XSvYJxJ0H7x7Tw8fAQPom/1gwDQYJKoZIhvcNAQEL
-        BQAwHjEcMBoGA1UEAwwTKi5zdmMuY2x1c3Rlci5sb2NhbDAgFw0yNjAyMTMyMjU0
-        MjlaGA8yMDU2MDIwNjIyNTQyOVowHjEcMBoGA1UEAwwTKi5zdmMuY2x1c3Rlci5s
+        MIIDQjCCAiqgAwIBAgIUXWU1ixzpK9OTqFfA+ZhK/EOtLIYwDQYJKoZIhvcNAQEL
+        BQAwHjEcMBoGA1UEAwwTKi5zdmMuY2x1c3Rlci5sb2NhbDAgFw0yNjAyMTQwMTIz
+        NTNaGA8yMDU2MDIwNzAxMjM1M1owHjEcMBoGA1UEAwwTKi5zdmMuY2x1c3Rlci5s
         b2NhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIvGupZ9FR3DLC1R
         /+7hbUySKYSIYOnfZQBnfkMVyLBDdp1WX9aspJLEaazO0rU4l0YjqnLsnckuBxmr
         OOzzeNA+8ExBkPEANR/mROMIcwXhrdFO3sWH2amVncHFUxspwgDhbZJ0zfVNtQo0
         Q/JthTWGqYW+4HbDnzOWWkUo23oZcClyELTbhQitxgrsOUyDIcR2ZNae3yueVAoK
         F12fH4Sms75FLvwwlUuWU3F1lJKr/U7nPxBdl6CY/sPXITov2LcmwlQLebCchjVB
         3kEvPKJRBPmW0Dyrr9IRyyExU3qfYdzsJdZOHY/qOB0Dw42qXolkf2L5m6GtW3EF
-        hnqM5SsCAwEAAaN2MHQwCwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMB
+        hnqM5SsCAwEAAaN2MHQwCwYDVR0PBAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMB
         MDEGA1UdEQQqMCiCFSouKi5zdmMuY2x1c3Rlci5sb2NhbIIJbG9jYWxob3N0hwR/
         AAABMB0GA1UdDgQWBBQzPiDb07CH5dKWb5xYa1PoGtz45jANBgkqhkiG9w0BAQsF
-        AAOCAQEAAUKfIa7zYH6Agbud2/LMii7/61wiG98MEeONQ7HFbggO0QkQ1DvaR83z
-        qvSngQcpzuNMIPKglWd5cyVwjWNrE7LNQICLTRuYNQNNXcFcaGpX3/C7g9djDeXB
-        lDX1lklxqfunRaXsJlqtEDDFtzlOZtPOrzXO8d9ZmAHfURfEr75y4mzNP4yLPPpR
-        Djfjin1Rgwga4fnzPupWcssDtUbjca7wRWIcMbjx9stuxGgsGTNApZl9Dq/4ExOh
-        w+PDhQhpQSvtcOFZUCstkrdZ0ufnN2sa8fJ0xuybLUEs3MnP0IB9kkmAuN8n59Zt
-        WAmV2mQ5TRTro0OxxyOQSGhlJByc/Q==
+        AAOCAQEActxS3ySYtlVmykOlaqTaTj8wyZjQ+gFBQ9APEuKwT4+F2HcuIRWWxJIT
+        Pt+CigSMG0XGFQi/+ZRfksXSmfcmErMgDUEr7jsxwvqn6esbAvHX02Vk82oAGkKu
+        t3JVxRAz9Dsl1Hm0W+IAGO336QFwd7iTo367TKSz+jcyHRfnftEZnxtbIvqAkR7V
+        8z1NRYhRR5ZeLpwjiqwdAU4AgXKQifQWeWjPeJJr+4pEvy2ivpzhhalX7/tB1TuP
+        4hpQdRi/c+0h5pDtrBpW61gUb0xVWySIkMifLLXfLNjynLKBJmWG91M34fTK1O8+
+        LYd+XhJEhXtFt8+3kktghDcehcuK7g==
         -----END CERTIFICATE-----
     
     privateKeyFile:

tests/fixtures/tls/public-cert.cnf

@@ -7,7 +7,7 @@ prompt = no
 CN = *.svc.cluster.local
 
 [v3_req]
-keyUsage = keyEncipherment, dataEncipherment
+keyUsage = digitalSignature, keyEncipherment, dataEncipherment
 extendedKeyUsage = serverAuth
 subjectAltName = @alt_names
 

tests/fixtures/tls/server.crt

@@ -1,20 +1,20 @@
 -----BEGIN CERTIFICATE-----
-MIIDQjCCAiqgAwIBAgIUcO0XSvYJxJ0H7x7Tw8fAQPom/1gwDQYJKoZIhvcNAQEL
-BQAwHjEcMBoGA1UEAwwTKi5zdmMuY2x1c3Rlci5sb2NhbDAgFw0yNjAyMTMyMjU0
-MjlaGA8yMDU2MDIwNjIyNTQyOVowHjEcMBoGA1UEAwwTKi5zdmMuY2x1c3Rlci5s
+MIIDQjCCAiqgAwIBAgIUXWU1ixzpK9OTqFfA+ZhK/EOtLIYwDQYJKoZIhvcNAQEL
+BQAwHjEcMBoGA1UEAwwTKi5zdmMuY2x1c3Rlci5sb2NhbDAgFw0yNjAyMTQwMTIz
+NTNaGA8yMDU2MDIwNzAxMjM1M1owHjEcMBoGA1UEAwwTKi5zdmMuY2x1c3Rlci5s
 b2NhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIvGupZ9FR3DLC1R
 /+7hbUySKYSIYOnfZQBnfkMVyLBDdp1WX9aspJLEaazO0rU4l0YjqnLsnckuBxmr
 OOzzeNA+8ExBkPEANR/mROMIcwXhrdFO3sWH2amVncHFUxspwgDhbZJ0zfVNtQo0
 Q/JthTWGqYW+4HbDnzOWWkUo23oZcClyELTbhQitxgrsOUyDIcR2ZNae3yueVAoK
 F12fH4Sms75FLvwwlUuWU3F1lJKr/U7nPxBdl6CY/sPXITov2LcmwlQLebCchjVB
 3kEvPKJRBPmW0Dyrr9IRyyExU3qfYdzsJdZOHY/qOB0Dw42qXolkf2L5m6GtW3EF
-hnqM5SsCAwEAAaN2MHQwCwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMB
+hnqM5SsCAwEAAaN2MHQwCwYDVR0PBAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMB
 MDEGA1UdEQQqMCiCFSouKi5zdmMuY2x1c3Rlci5sb2NhbIIJbG9jYWxob3N0hwR/
 AAABMB0GA1UdDgQWBBQzPiDb07CH5dKWb5xYa1PoGtz45jANBgkqhkiG9w0BAQsF
-AAOCAQEAAUKfIa7zYH6Agbud2/LMii7/61wiG98MEeONQ7HFbggO0QkQ1DvaR83z
-qvSngQcpzuNMIPKglWd5cyVwjWNrE7LNQICLTRuYNQNNXcFcaGpX3/C7g9djDeXB
-lDX1lklxqfunRaXsJlqtEDDFtzlOZtPOrzXO8d9ZmAHfURfEr75y4mzNP4yLPPpR
-Djfjin1Rgwga4fnzPupWcssDtUbjca7wRWIcMbjx9stuxGgsGTNApZl9Dq/4ExOh
-w+PDhQhpQSvtcOFZUCstkrdZ0ufnN2sa8fJ0xuybLUEs3MnP0IB9kkmAuN8n59Zt
-WAmV2mQ5TRTro0OxxyOQSGhlJByc/Q==
+AAOCAQEActxS3ySYtlVmykOlaqTaTj8wyZjQ+gFBQ9APEuKwT4+F2HcuIRWWxJIT
+Pt+CigSMG0XGFQi/+ZRfksXSmfcmErMgDUEr7jsxwvqn6esbAvHX02Vk82oAGkKu
+t3JVxRAz9Dsl1Hm0W+IAGO336QFwd7iTo367TKSz+jcyHRfnftEZnxtbIvqAkR7V
+8z1NRYhRR5ZeLpwjiqwdAU4AgXKQifQWeWjPeJJr+4pEvy2ivpzhhalX7/tB1TuP
+4hpQdRi/c+0h5pDtrBpW61gUb0xVWySIkMifLLXfLNjynLKBJmWG91M34fTK1O8+
+LYd+XhJEhXtFt8+3kktghDcehcuK7g==
 -----END CERTIFICATE-----