test: generate and test ECDSA certificates in ssl_integration_test. (e…

…nvoyproxy#5096)

Also, some bonus cleanups to improve DRY and maintainability of SSL related test code encountered
while doing this.

Part of envoyproxy#1319.

Risk Level: Low
Testing: bazel test //test/integration/..., new tests for client cipher suites and ECDSA server
  certs added to ssl_integration_test.

Signed-off-by: Harvey Tuch <[email protected]>

test/config/integration/certs/cacert.pem

@@ -1,18 +1,18 @@
 -----BEGIN CERTIFICATE-----
-MIICzTCCAjagAwIBAgIJAJ6rk+HiTbNmMA0GCSqGSIb3DQEBCwUAMHYxCzAJBgNV
+MIICzTCCAjagAwIBAgIJANI6/WtezQ2/MA0GCSqGSIb3DQEBCwUAMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNp
 c2NvMQ0wCwYDVQQKDARMeWZ0MRkwFwYDVQQLDBBMeWZ0IEVuZ2luZWVyaW5nMRAw
-DgYDVQQDDAdUZXN0IENBMB4XDTE4MTEyMDA0NDc1N1oXDTIwMTExOTA0NDc1N1ow
+DgYDVQQDDAdUZXN0IENBMB4XDTE4MTEyNzE1MjMxMFoXDTIwMTEyNjE1MjMxMFow
 djELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNh
 biBGcmFuY2lzY28xDTALBgNVBAoMBEx5ZnQxGTAXBgNVBAsMEEx5ZnQgRW5naW5l
 ZXJpbmcxEDAOBgNVBAMMB1Rlc3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJ6EFc5+AI2OgXNhHxaI7vhxmNaJ/wRipEYACJasdCGtJrH+yKOztwJsussk
-ZtZxTDQGVkp17fY7oGkKFNXGLWl/ZzCmiKbVrBTWTm+OgpGKEka4KSmyCdFzNtpa
-8a089BX2C31+xe4GSQfAF9gutbin8S5XS5QC7KcOla4qoSSFAgMBAAGjYzBhMA8G
-A1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSMzBlKJavq
-qJaCaPdQnZa2YUUQ7DAfBgNVHSMEGDAWgBSMzBlKJavqqJaCaPdQnZa2YUUQ7DAN
-BgkqhkiG9w0BAQsFAAOBgQCa96KsF0/LCtNceRuTPON4Nqg53OJI2VkCDmKmIQgx
-nm+8TVg1RszCM1+QVIwih3xzwVYFEKUqpf1t4RxsPK+m7kv7RJnNkcFbGT8i5o4i
-U1taxOmFJm1LOMY86GA0hOMWQKiqQdyxtT846M2a/fs5NNMWuJ3aXmzCsiXAhKAj
-EQ==
+AoGBAMny8RRgQj5XRwI6FghrH1ZMWQxTnTR7qjvOaORM0/JbdK6ogz2J7GW7Kwt5
+D1EkVfuBD38aTK+2U/029tV1ZMYaM/WdvdUXM9gqAhwfdeePbbG5iU4JTz/Hh+zF
+IVdhE66XGiobM+z1LASvXjn+ZXQN2xpFtwrWAkWibbq+ASBtAgMBAAGjYzBhMA8G
+A1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBQNmhpLfi64
+Pw/YagZdVaA8zyZMfzAfBgNVHSMEGDAWgBQNmhpLfi64Pw/YagZdVaA8zyZMfzAN
+BgkqhkiG9w0BAQsFAAOBgQALipnMELDx4Im9xX8stxlt+vM9J44CIzUN6nMTmY7F
+CUId2s0VtHhaBhoRr/31zaEu10e+7KP3Cf1U8u1iZ/L8w3w9qspJC47AMUkbgVf2
+tsQg/jDYiz+bsmoTGPeBYIoH1OMcOEapXqgA0esuqPsTKFJh8WivWrpbeeFYMYBR
+7A==
 -----END CERTIFICATE-----

test/config/integration/certs/cakey.pem

@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCehBXOfgCNjoFzYR8WiO74cZjWif8EYqRGAAiWrHQhrSax/sij
-s7cCbLrLJGbWcUw0BlZKde32O6BpChTVxi1pf2cwpoim1awU1k5vjoKRihJGuCkp
-sgnRczbaWvGtPPQV9gt9fsXuBkkHwBfYLrW4p/EuV0uUAuynDpWuKqEkhQIDAQAB
-AoGAEDU3OZbenZq9l7uNfzNfI94Rn5Yakis32sR0HFvjv/HBbB++Cib9Bm1xqAW/
-0hthjEw9lH18aFnua+8Q9E7AI8kdr53NzRxiMFgiyRV/XOjxb55R1rSu5U6XEUdW
-ytk5eAK5jRpKQ5S/H1wvz7hhaBfo+pL5YOuBivyNXpr4lh0CQQDRqz9jcmwfdlZH
-K4e/LtrIV4JXOCvO+9FlhtQV6P+VV9npmm/Z/c1v5ybUF+Ij5b1ZcFHihARuUj3f
-RIyvTCO7AkEAwYsqxwZg1OAt8olIJc1WZX5ib1OX5wsFTpSjRP40F2GB1qsNa6dk
-XA6q95GiN4so1TSM/sWAfp5dfbJGkGm0vwJBAM509v0gzbEJYJnCFnA+XfbKnLDv
-wcuWETIM2sgcX5eaIxyxExSvo1xeW9CbF/XLInFwdWE8J/TODNjN8k4nBkMCQFYw
-ZGdnNr3162BDtGZpL91Yz/slrdLM/JsG5EJ4NbhnystPN1XGoJHCUm6XYzb6+L8h
-fNyEFXnNinLMblInUL8CQFW383NhElJn3HQL9gwRJQWj1qaGXZ0Othh7nfPWqzhx
-Zvzkq5rH8uiQT5qBtma1QlXQnQIJoeGd8W5joZ4AwlE=
+MIICXgIBAAKBgQDJ8vEUYEI+V0cCOhYIax9WTFkMU500e6o7zmjkTNPyW3SuqIM9
+iexluysLeQ9RJFX7gQ9/GkyvtlP9NvbVdWTGGjP1nb3VFzPYKgIcH3Xnj22xuYlO
+CU8/x4fsxSFXYROulxoqGzPs9SwEr145/mV0DdsaRbcK1gJFom26vgEgbQIDAQAB
+AoGBAKkV1/QPhGdd+/5JVBlIV7yRwB0qBP3kbOwWLoy4Jt1M5a03OmtUB7JFvAyn
+F8QAgF1L+gWZp4uXRUtFsfWXjP8z/vlMaiwkUcehf1WUBCWW19b7fSXE+V5Kid4K
+zG1+pj2u9T3NO+fk2CEYdTRmY37vnxFEoJk+T64cJtdNxVGhAkEA6+NWe/gX5Xmy
+IROXbWG3q3F+RVfkHky0C19P6VbiqPNvz9U7ZSYydmoy22drv5O2zWoWZStO2ojG
+bzrh4spkowJBANsq02fsg+j+boBVYq20OLjjil04UAsJjCCYPmi2ObJl6FBE6QbG
+mpSNw2shji6VjKRwkChr8eHUSJ2Vg3oAp68CQQDEPO+A2IdAv7oh7EOImseK2DMd
+Cx5a2qLZ5yP60e5kcYjuVM1Bu8I1YuoGPwaTbRah0wToi1vhT/INLOYonwmTAkAK
+M/0xil49u5KTYOY+JfS6DsXDPzriuKgQYGYPY+RdvMbK7dpXWWma3tqpIx/GZWnt
+wdvENfpFxCc5RtufE2a7AkEAjMRXZyWMv1t9mzILWIezbTrQHT32znGVwIV/Y1Ej
+AtfGtC6UBwr1/pfBBlMKFSPxCNSCuxej+3K7BVWpO6Ve6A==
 -----END RSA PRIVATE KEY-----

test/config/integration/certs/certs.sh

@@ -10,26 +10,43 @@ generate_ca() {
     -extensions v3_ca -extfile $1cert.cfg
 }
 
-# $1=<certificate name> $2=<CA name>
-generate_cert_key_pair() {
+# $1=<certificate name>
+generate_rsa_key() {
   openssl genrsa -out $1key.pem 1024
+}
+
+# $1=<certificate name>
+generate_ecdsa_key() {
+  openssl ecparam -name secp256r1 -genkey -out $1key.pem
+}
+
+# $1=<certificate name> $2=<CA name>
+generate_x509_cert() {
   openssl req -new -key $1key.pem -out $1cert.csr -config $1cert.cfg -batch -sha256
   openssl x509 -req -days 730 -in $1cert.csr -sha256 -CA $2cert.pem -CAkey \
     $2key.pem -CAcreateserial -out $1cert.pem -extensions v3_ca -extfile $1cert.cfg
-  echo -e "// NOLINT(namespace-envoy)\n#define TEST_$(echo $1 | tr a-z A-Z)_CERT_HASH \"$(openssl x509 -in $1cert.pem -noout -fingerprint -sha256 | cut -d"=" -f2)\"" > $1cert_hash.h
+  echo -e "// NOLINT(namespace-envoy)\nconstexpr char TEST_$(echo $1 | tr a-z A-Z)_CERT_HASH[] = \"$(openssl x509 -in $1cert.pem -noout -fingerprint -sha256 | cut -d"=" -f2)\";" > $1cert_hash.h
 }
 
 # Generate cert for the CA.
 generate_ca ca
-# Generate cert for the server.
-generate_cert_key_pair client ca
+# Generate RSA cert for the server.
+generate_rsa_key server ca
+generate_x509_cert server ca
+# Generate ECDSA cert for the server.
+cp -f servercert.cfg server_ecdsacert.cfg
+generate_ecdsa_key server_ecdsa ca
+generate_x509_cert server_ecdsa ca
+rm -f server_ecdsacert.cfg
 # Generate cert for the client.
-generate_cert_key_pair server ca
+generate_rsa_key client ca
+generate_x509_cert client ca
 
 # Generate cert for the upstream CA.
 generate_ca upstreamca
 # Generate cert for the upstream node.
-generate_cert_key_pair upstream upstreamca
+generate_rsa_key upstream upstreamca
+generate_x509_cert upstream upstreamca
 
 rm *.csr
 rm *.srl

test/config/integration/certs/clientcert.pem

@@ -1,21 +1,21 @@
 -----BEGIN CERTIFICATE-----
-MIIDXzCCAsigAwIBAgIJAMlBGofCH4diMA0GCSqGSIb3DQEBCwUAMHYxCzAJBgNV
+MIIDXzCCAsigAwIBAgIJAIY1BdhkAa7HMA0GCSqGSIb3DQEBCwUAMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNp
 c2NvMQ0wCwYDVQQKDARMeWZ0MRkwFwYDVQQLDBBMeWZ0IEVuZ2luZWVyaW5nMRAw
-DgYDVQQDDAdUZXN0IENBMB4XDTE4MTEyMDA0NDc1N1oXDTIwMTExOTA0NDc1N1ow
+DgYDVQQDDAdUZXN0IENBMB4XDTE4MTEyNzE1MjMxMVoXDTIwMTEyNjE1MjMxMVow
 gagxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1T
 YW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARMeWZ0MRkwFwYDVQQLDBBMeWZ0IEVuZ2lu
 ZWVyaW5nMRswGQYDVQQDDBJUZXN0IEZyb250ZW5kIFRlYW0xJTAjBgkqhkiG9w0B
 CQEWFmZyb250ZW5kLXRlYW1AbHlmdC5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A
-MIGJAoGBALJ5QYTfxsnpzPQ8qMZ+523A32dzpTVSc7idoVizYjWZCUr42hiOSjzf
-Lk1rXHv5NIbF1Bc5wL1MWT7wOSS5w3qxfBq54bhlDpD07EHMcLSAhDykiAiTun3B
-TW//TU69vSG70cbEZMCRwhnGlzpa9qH9UQTTbDRq0X7LobBn+0rHAgMBAAGjgcEw
+MIGJAoGBAOR0eaacgJD767Y8iSJyfAFJ6fDGOtz1p9ry8ood27hskuFa/2GsnGAv
+J4KAjgB06Ss4dnyP4bcz1QNJt90LeX9sx5/pJt52ILsMhJ/OPHtrH1cr5saAY0DR
+qV+kXsR+VzRsSXBN1ZbR015U9vgu1hMOag3kYFwxYeyy4raZ7nr1AgMBAAGjgcEw
 gb4wDAYDVR0TAQH/BAIwADALBgNVHQ8EBAMCBeAwHQYDVR0lBBYwFAYIKwYBBQUH
 AwIGCCsGAQUFBwMBMEIGA1UdEQQ7MDmGH3NwaWZmZTovL2x5ZnQuY29tL2Zyb250
-ZW5kLXRlYW2CCGx5ZnQuY29tggx3d3cubHlmdC5jb20wHQYDVR0OBBYEFO5+Oco9
-Yi+NE7lmW7RCo3S2mK9CMB8GA1UdIwQYMBaAFIzMGUolq+qoloJo91CdlrZhRRDs
-MA0GCSqGSIb3DQEBCwUAA4GBACHQTOB7Wn3fvF0npu3htxa68F0U12EW1WYmc/Mf
-4h2dhv+MXVef0kjo6Yy2uX6X3iRkDgfVzvQTajHBkQV5pixeExfWfzklBP7Q7cgg
-Zs6AyOMjoua7ulnppYaVO5LQfkoVr0TF3vGdDxaiLIq6hO9dPwPgtyuGnIVUx1Q4
-wjle
+ZW5kLXRlYW2CCGx5ZnQuY29tggx3d3cubHlmdC5jb20wHQYDVR0OBBYEFGQaAcTi
+saUtlbrps9DdCyK7uBfDMB8GA1UdIwQYMBaAFA2aGkt+Lrg/D9hqBl1VoDzPJkx/
+MA0GCSqGSIb3DQEBCwUAA4GBAJclDWcpZt6LaUZFIcjt4Vvnpp2Rucx+EuhU5V9J
+wBnURiYtbZa6FcSSzN29pJRqpD+VWVy70zq9hcfT0InXOgnX1Smy+zBQ5EwabRp1
+muDN/jVhapReWyPpJwVIV+gMUXHAde4AHfFTbsEPCsAM/p86u/LULMfPi+HS6tjJ
+XuDa
 -----END CERTIFICATE-----

test/config/integration/certs/clientcert_hash.h

@@ -1,4 +1,3 @@
 // NOLINT(namespace-envoy)
-#define TEST_CLIENT_CERT_HASH                                                                      \
-  "72:68:C8:8B:7D:45:21:0F:F1:6D:FF:8C:CA:32:5B:53:23:B6:8A:97:6B:13:AA:29:57:11:D8:A1:1D:99:AF:"  \
-  "BE"
+constexpr char TEST_CLIENT_CERT_HASH[] = "F5:F1:B1:21:A0:F0:63:B4:19:80:81:E7:92:32:40:85:1D:BC:23:"
+                                         "42:47:7E:DD:A5:CF:3B:D7:45:6C:17:27:E4";

test/config/integration/certs/clientkey.pem

@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQCyeUGE38bJ6cz0PKjGfudtwN9nc6U1UnO4naFYs2I1mQlK+NoY
-jko83y5Na1x7+TSGxdQXOcC9TFk+8DkkucN6sXwaueG4ZQ6Q9OxBzHC0gIQ8pIgI
-k7p9wU1v/01Ovb0hu9HGxGTAkcIZxpc6Wvah/VEE02w0atF+y6GwZ/tKxwIDAQAB
-AoGAE+P/sVdfSFGOTgoUpUqvcEP2ogj5eJ/f1ct7l+8mGuMbbgeeBu6Ux4P4HRjC
-De8QM5UIti3xlSdVKvaK59TsPCiGPcmqlH20CyxHr8znQImtj6iD01jOk75xxS1Z
-/Hph19mOOQYJ0Eya4o5py+/zu1ylo/sW25XNA84YxoL6TUECQQDppOgE2iJbXMPZ
-NKxIowzxklMBrWkj4LIGpEyQkwaEiCXqVHNorHpfnHvhhKwNKz5HfhocxSAO7XJd
-VVCZq10lAkEAw4zz5u1LKaQH+s+OEFBob+NJCaL4KNf0NddGywG38ps/1cNVc7v6
-Q7M+y682wnM6wmgQiogAkWzTHxEMrXpCewJAbEkXl5gZsEpQIsz8xDV9fECa4/4g
-6pXrLJTdP2xE6wvGttIpIuw9Uy7NY3n/26KdHLlfFNJvxztZc9RkpLP9WQJBAIKD
-JJXPcgbMr3a55/sDb3CdpTWFS1MXLqpwj5MWBospCqXExNeFcjaU/yg6PLXy6hiu
-E7whoR9uHknxuyBdJNkCQQCg5+w/BCssL01gyA3bbLMd5TSw5mGbOHD+XsaM1IxS
-BT1Y+xw2ODKRX2L590oWn3Go8i3kQhB9IwAjJir4ius7
+MIICXQIBAAKBgQDkdHmmnICQ++u2PIkicnwBSenwxjrc9afa8vKKHdu4bJLhWv9h
+rJxgLyeCgI4AdOkrOHZ8j+G3M9UDSbfdC3l/bMef6SbediC7DISfzjx7ax9XK+bG
+gGNA0alfpF7Eflc0bElwTdWW0dNeVPb4LtYTDmoN5GBcMWHssuK2me569QIDAQAB
+AoGBAIHpilQooyPPXlcfTYx9Ne81rQbycv6741wq06mfGRdjBpOIP7m3gqVfq0QW
+/qlb0kx1q0tiNqULoJJiFWBp6ghtK9jtnQU+D+0f6v06skGAVUe+k/F/NG8yVVJl
+wzFwKFb91B0Wn9boDeBRlfzLrdVzdZKu2o4wRiP1A6xu5cgBAkEA9XHepVyUeH+J
+euTQr0YNiO7974Bb3owAstG5W48GU5Fl35h6NsjsTROpSg7HmiDV5zeCFn3UVzmP
+1+DKj250gQJBAO5HkARAMv/DytWu4shcF2yY3oay90qBugPwbbBVJcIvL4b7dTuy
+bBeiOOEZYlRk/9D7fuMkr/LbXx1IoxKlPHUCQBropgE5GinvyZHInjxpELjPgtWM
+HAZVEQqJxamND6N/0ExoOhXhh06X9jphTm7OZMUZp9BxcSMy81s2kN6SvIECQQCZ
+VDt8QMOQibEwJ8WPIJOCMiyfiPJQY4ILnt82pNQTTMHMnmsl6v5bhuwLDYaUwBlN
+pUhVafo+0KM3+NHW4bUxAkAtM3WW2KM40VplRYVg/1QBL0f6BkPAqxv22WDQLaJv
+Hx1hzO+gWW57ZzPHixhaI+kUildg5THSnBnXG75FkHr1
 -----END RSA PRIVATE KEY-----

test/config/integration/certs/server_ecdsacert.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDFTCCAn6gAwIBAgIJAIY1BdhkAa7GMA0GCSqGSIb3DQEBCwUAMHYxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNp
+c2NvMQ0wCwYDVQQKDARMeWZ0MRkwFwYDVQQLDBBMeWZ0IEVuZ2luZWVyaW5nMRAw
+DgYDVQQDDAdUZXN0IENBMB4XDTE4MTEyNzE1MjMxMVoXDTIwMTEyNjE1MjMxMVow
+gaYxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1T
+YW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARMeWZ0MRkwFwYDVQQLDBBMeWZ0IEVuZ2lu
+ZWVyaW5nMRowGAYDVQQDDBFUZXN0IEJhY2tlbmQgVGVhbTEkMCIGCSqGSIb3DQEJ
+ARYVYmFja2VuZC10ZWFtQGx5ZnQuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
+QgAEzV91erF0JjQo3mI80nK49qop6RMTLwc9vMyPkcGXVLPOKDnme4TmMVtM4XZ+
+Ge70I05fdlvudJadw2o7eW5LGaOBwDCBvTAMBgNVHRMBAf8EAjAAMAsGA1UdDwQE
+AwIF4DAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwQQYDVR0RBDowOIYe
+c3BpZmZlOi8vbHlmdC5jb20vYmFja2VuZC10ZWFtgghseWZ0LmNvbYIMd3d3Lmx5
+ZnQuY29tMB0GA1UdDgQWBBTWli6H602ajAwxXJo+bcf3bRsh8jAfBgNVHSMEGDAW
+gBQNmhpLfi64Pw/YagZdVaA8zyZMfzANBgkqhkiG9w0BAQsFAAOBgQBS288KIkjE
+e/kZWS3cbSJhETeaI3lz1/Q1Dm0bfy+Nz3eIgssvpW2Wq+agrNLXG+Ltvdq/qUGN
+p1efyzbtHZ/MCKtDjnHkmYyrXxxKISbxCvt/DUq3HFd8looVty8d4MyolJmGBRGB
++C1jpZHQuKflv2IaoRVyuMMnjL2J90MiGQ==
+-----END CERTIFICATE-----

test/config/integration/certs/server_ecdsacert_hash.h

@@ -0,0 +1,3 @@
+// NOLINT(namespace-envoy)
+constexpr char TEST_SERVER_ECDSA_CERT_HASH[] = "F8:6B:64:4A:39:77:8D:E7:A5:27:6F:23:A9:2A:C7:2C:CA:"
+                                               "05:2C:1B:8B:8E:6D:F3:D1:8C:A3:48:94:05:86:1C";

test/config/integration/certs/server_ecdsakey.pem

@@ -0,0 +1,8 @@
+-----BEGIN EC PARAMETERS-----
+BggqhkjOPQMBBw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIAoLEdwD1ny4Gcep247sdYGYj7upXYtUt1Q7D3O9cPgHoAoGCCqGSM49
+AwEHoUQDQgAEzV91erF0JjQo3mI80nK49qop6RMTLwc9vMyPkcGXVLPOKDnme4Tm
+MVtM4XZ+Ge70I05fdlvudJadw2o7eW5LGQ==
+-----END EC PRIVATE KEY-----

test/config/integration/certs/servercert.pem

@@ -1,20 +1,20 @@
 -----BEGIN CERTIFICATE-----
-MIIDXDCCAsWgAwIBAgIJAMlBGofCH4djMA0GCSqGSIb3DQEBCwUAMHYxCzAJBgNV
+MIIDXDCCAsWgAwIBAgIJAIY1BdhkAa7FMA0GCSqGSIb3DQEBCwUAMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNp
 c2NvMQ0wCwYDVQQKDARMeWZ0MRkwFwYDVQQLDBBMeWZ0IEVuZ2luZWVyaW5nMRAw
-DgYDVQQDDAdUZXN0IENBMB4XDTE4MTEyMDA0NDc1N1oXDTIwMTExOTA0NDc1N1ow
+DgYDVQQDDAdUZXN0IENBMB4XDTE4MTEyNzE1MjMxMFoXDTIwMTEyNjE1MjMxMFow
 gaYxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1T
 YW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARMeWZ0MRkwFwYDVQQLDBBMeWZ0IEVuZ2lu
 ZWVyaW5nMRowGAYDVQQDDBFUZXN0IEJhY2tlbmQgVGVhbTEkMCIGCSqGSIb3DQEJ
 ARYVYmFja2VuZC10ZWFtQGx5ZnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
-iQKBgQDSk5iQ/qC6bc2oA9/EgJ4xfoj4dJ2O1je8Sht+fqcfB+i0JpUDVkXj22qo
-5Sy40+SKI/WDfMZtEg5+XZ5V01wo58ar0MlQgmCdcA1Ijr/cMssB2gcGCbjMPOg4
-Bi7VtIWH5PWritg+PNi1gnVjJ/ekjBwOEMkPRKIP3GHn193EXQIDAQABo4HAMIG9
+iQKBgQCwQjZt6darJFUATVgqewEPSb4ajxx0HOqnXpB7L0ju7LjJM7Bgs1UrxpNg
+YteInNJSw4gzAhldJyPh8AMBHGpXTJIUxbNd5jnZIICjgAu6mswCRqpDmZNt3lB8
+1e0hjopPTNE06ClzSW5IjF9zQ6PDmNqv3JZVn35y6Vrm6mz4lQIDAQABo4HAMIG9
 MAwGA1UdEwEB/wQCMAAwCwYDVR0PBAQDAgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMC
 BggrBgEFBQcDATBBBgNVHREEOjA4hh5zcGlmZmU6Ly9seWZ0LmNvbS9iYWNrZW5k
-LXRlYW2CCGx5ZnQuY29tggx3d3cubHlmdC5jb20wHQYDVR0OBBYEFKuBHhCwW/9V
-2tvT1tfEafkSMWrqMB8GA1UdIwQYMBaAFIzMGUolq+qoloJo91CdlrZhRRDsMA0G
-CSqGSIb3DQEBCwUAA4GBAIbKHNw7OXg4U+Frl6AO+7bOA2KO4qJaGkVU5HiWqECm
-VCvTS10KHOaCZNP+5MNB7NnCHRaRN50AEYp5ETng/JOLE8V69VW38usMVctJhLo6
-HCl25mocrEKAB+9Ur4OUcQx4OLlnazD9/cAhJBow66sW6iuatZE0Km6bUajbUoDQ
+LXRlYW2CCGx5ZnQuY29tggx3d3cubHlmdC5jb20wHQYDVR0OBBYEFMZJtoHncG8T
+55ebJvFVcFujcsaaMB8GA1UdIwQYMBaAFA2aGkt+Lrg/D9hqBl1VoDzPJkx/MA0G
+CSqGSIb3DQEBCwUAA4GBAACUw26JKaxFQlGfUsT2G8PxuNNc00Q6wdZpGrZCjxDt
+W4QpRFtrNwQIVhoe6wCJapEhKlngv3qQs5mJcLsLmYMWsyV3s+4JTnB3U0hwAiGo
+WemIQlJHte+zwmwQ0bztVjXUrsnKwy/YGUHIP0weRmSjLryEVrkBy0Jh0QoIxOym
 -----END CERTIFICATE-----

test/config/integration/certs/servercert_hash.h

@@ -1,4 +1,3 @@
 // NOLINT(namespace-envoy)
-#define TEST_SERVER_CERT_HASH                                                                      \
-  "B3:F5:A1:8F:FF:CD:99:4C:46:1D:3F:98:F6:75:B0:8B:0F:9B:9C:6D:5F:7E:77:26:E9:13:E4:3C:43:14:E8:"  \
-  "51"
+constexpr char TEST_SERVER_CERT_HASH[] = "97:94:84:8B:67:25:25:0B:D3:29:2C:0D:AA:F3:80:4D:FB:3C:84:"
+                                         "D2:47:75:D2:45:7C:FD:DB:AB:A2:61:42:2D";

test/config/integration/certs/serverkey.pem

@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXgIBAAKBgQDSk5iQ/qC6bc2oA9/EgJ4xfoj4dJ2O1je8Sht+fqcfB+i0JpUD
-VkXj22qo5Sy40+SKI/WDfMZtEg5+XZ5V01wo58ar0MlQgmCdcA1Ijr/cMssB2gcG
-CbjMPOg4Bi7VtIWH5PWritg+PNi1gnVjJ/ekjBwOEMkPRKIP3GHn193EXQIDAQAB
-AoGAEhSAJfrm2/rvjHyAqwOMEZ3WrtZ8bLYx5OXMBIllWgG41jb11mqC57SALO44
-b8optj6uJtMAyn6hZfIt1Rqnr+d5rarbk/BjNobn2+GB9UpQU7562iCeH9lKDEJd
-fqLJZgn2+OjUC9/GIMkTv08LfPgm8nghR3x4Q/sNTrf0jFUCQQD3+Su/UwksodUQ
-d03B1qhEP4e2oa6Lx+DWc4e/u29pQ46ILSMA7X5IyL52PuMU+mk5kOG9axv4mXjB
-jYg1XNP/AkEA2WSJdhXt/AW2lFepTWVeI4SyGxay6lgUsNhAhVYCgsKM+hqz8zG8
-RsWld0iinUHtrc9uyk1cuF5IP2T3h8k3owJBAOALjGBAGQDvcv9+m42wcbXAJNF5
-AaifvmBkX9l283GLLWOSTJcQ/VGrtpJFvYx9t8bgRWWMOeiCWZ2fT9rO9WcCQQCM
-1zjDe2OqopzuMHjsPp8lzcOCD0uszZHiHMh4WgfYZWjmZERva6p6A3S2+iT4Uw1E
-TR6PDF3kyJhwEd7YZwGXAkEA97sYBBHJC2JD8O1MAI+X90p7XJSTBdwVQ1qsjqVA
-mGT+pZVVAyMR6AnvVM1q2qyjBcrr4oMIeblq1e6ApiDsEQ==
+MIICXAIBAAKBgQCwQjZt6darJFUATVgqewEPSb4ajxx0HOqnXpB7L0ju7LjJM7Bg
+s1UrxpNgYteInNJSw4gzAhldJyPh8AMBHGpXTJIUxbNd5jnZIICjgAu6mswCRqpD
+mZNt3lB81e0hjopPTNE06ClzSW5IjF9zQ6PDmNqv3JZVn35y6Vrm6mz4lQIDAQAB
+AoGBAInbH6sT65xrjDfyRnTjQ87rRE6NhBmkzDsfkS1nrEmCyHxFezwGxyS36WjH
+pf/pd+7Xk90hVSkwhbYe/JqP2PMmWCWM503MN784s7OasmOWAsTBEwKFpJaay8WQ
+JCgN60hSoSPCv1ahFKmY6dEmJsy4UzwHUSSel+180bcTovO5AkEA1vNc12HaiJYl
+xIg58S6vT+I6bsJgtBasoR6fxXX+byl5z87SDhtHto+BRQxvqbKiQrc7pIcCWMQp
+fmbNK8vOowJBANHrQJdDRAo3Wy1J43U+FTB9ygWOJmWOg3O9uSpY805to2KxGzQZ
+DQ5iRB6LHDavQq7eQrZZ11kViwJ+7w5mJ2cCQDMVXRAWwk/Jlyow0cxesu1CL27Z
+JRBHfzk/ROsxkokqizd2yHbvxsg9LJSTUwo6WNOQJk2AhG9CFzZiCgqJgg8CQA6Z
+e/6JMRw8yVyW/PjUfojG1twYDNeXV9Ee6tflI9bajTh59NhkvaG4d+Bf8HBlNBAR
+aTZhfTa25tofleS8ehUCQEDzduuzlLq5eafeFWl31VlZIQc0/oDeitYLcu5yDE+4
+khdQIukEDRXznhOw90XPFsHeuS0c6On36GhuS1tbGQg=
 -----END RSA PRIVATE KEY-----

test/config/integration/certs/upstreamcacert.pem

@@ -1,18 +1,18 @@
 -----BEGIN CERTIFICATE-----
-MIIC3zCCAkigAwIBAgIJAKqvsW2eOS9ZMA0GCSqGSIb3DQEBCwUAMH8xCzAJBgNV
+MIIC3zCCAkigAwIBAgIJAIPIoVebhXYJMA0GCSqGSIb3DQEBCwUAMH8xCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNp
 c2NvMQ0wCwYDVQQKDARMeWZ0MRkwFwYDVQQLDBBMeWZ0IEVuZ2luZWVyaW5nMRkw
-FwYDVQQDDBBUZXN0IFVwc3RyZWFtIENBMB4XDTE4MTEyMDA0NDc1N1oXDTIwMTEx
-OTA0NDc1N1owfzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAU
+FwYDVQQDDBBUZXN0IFVwc3RyZWFtIENBMB4XDTE4MTEyNzE1MjMxMVoXDTIwMTEy
+NjE1MjMxMVowfzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAU
 BgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBEx5ZnQxGTAXBgNVBAsMEEx5
 ZnQgRW5naW5lZXJpbmcxGTAXBgNVBAMMEFRlc3QgVXBzdHJlYW0gQ0EwgZ8wDQYJ
-KoZIhvcNAQEBBQADgY0AMIGJAoGBAM/ZDWPcmCQnHnQrPzEoMqCD2rH8OAMew2Ei
-blmj3gr3jF9Lmzg7GsbtmWE8tsL+CtRPl6J4phiuaHVpOd9jq9GV82yibo/MtHjW
-tuKN2iXA4rrodADGY/XTK3ByMZrKBxMgYj6ng3yu2/8kQo6SVTghWxFElH0VRNL8
-WlHAbe5nAgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEG
-MB0GA1UdDgQWBBSkkbQjKTl5cIKOS1Vt+ST4nkKVLzAfBgNVHSMEGDAWgBSkkbQj
-KTl5cIKOS1Vt+ST4nkKVLzANBgkqhkiG9w0BAQsFAAOBgQAACXkbMKlIjmqFMhh/
-Zr2lOrU5pHnQq1OwODFl4o2jkI9jYXISaavfwra+RqHnfkbvgg/qdmCrH0R6ekZf
-5hRYhW/xoZgLEkbdGtAiKKzsQwmbAdAzmzKSZV2PaKYO+PztCpEgxGn8ekb38z+V
-6eFOfm5tQDsdcJjyjI81Vu42uA==
+KoZIhvcNAQEBBQADgY0AMIGJAoGBAMvlJTs6ZwnDtPCr2JwvUzqsNYiITYNOgoSe
+oupneHsfVeYbh5SA/+PoFhPfg1SwCH4esqLBYEvXo3/S4k2coGcccU80+zXMxtOJ
+VXQ5tBlNaQ3O0bhTUMoVPr1zEKtUAYoHNppUWTFMcZgObc8ps0SM2otNkYin0EiS
+dCylgS2TAgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEG
+MB0GA1UdDgQWBBTIYX3va+3j7u0ImpjpQntcnZ7PzjAfBgNVHSMEGDAWgBTIYX3v
+a+3j7u0ImpjpQntcnZ7PzjANBgkqhkiG9w0BAQsFAAOBgQBUm8HmWc+uYrAy0ceS
+dbEFoXSUg4VICyMpY7mzI21UquFe4kCVP6ISsynPxneb+kWlmBIlrCIUYfiOQe5o
+IPmDZFbdmvo1MTuRNZvdbDx0sUmCw96Oo3FUCT6Cv2AGeMsRMSWGIhWtc3gk7qIw
+FpukvWKTn7awb+T8x1EUfNcGyA==
 -----END CERTIFICATE-----

test/config/integration/certs/upstreamcakey.pem

@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXgIBAAKBgQDP2Q1j3JgkJx50Kz8xKDKgg9qx/DgDHsNhIm5Zo94K94xfS5s4
-OxrG7ZlhPLbC/grUT5eieKYYrmh1aTnfY6vRlfNsom6PzLR41rbijdolwOK66HQA
-xmP10ytwcjGaygcTIGI+p4N8rtv/JEKOklU4IVsRRJR9FUTS/FpRwG3uZwIDAQAB
-AoGAadggp4AIwjBho8r6LTBJR9CdqBHG/F/II0kDZQa75l3V0BmSe/otUqxgdVIT
-yAzSuvelQomqG9uFOnVRkV8SeYbY3vtMIHOih30UjPlzV04NbsMDQWmtVo7Y2pjO
-JYabhUgML2rGSMFYtwPv1eunYBhdtdltvW0Ph7b66+GfuCECQQD7FrDsh2o/O52m
-oXJaOjGOMQMHxjmjo8zW7CTJnQ69tbv87X+HJQas5MEi9c4Voah4IkG+FF3DkOyK
-3j7W3MsvAkEA0+nWBQJo+rmmL8q9vIsZa65xv81km1uoVPhsTrCiaPC8t2lWNyND
-NyxloGm/fmzPIUDsrjEIDj1h/4JnOVBiSQJBAIvbH8EfzDZcZnuiAafwMhoZgq6Z
-4xEa88Xi0rraGJPi3ksLnrUQEp/K6ykl8RxrZwNDUYsmnPOJjbfsAuR7J1ECQQCS
-RtkawB0i5L9YQgRSf1newJ14HhkSPGSnsotgjgCtm29I04dVrBubnCPSZOxwIj+f
-3qcBXosG+UwKCUOjhl8xAkEArMsu+3oOJnq48ZXvGRvCbWPDhcjY01j/kDXMqwTU
-AFTkAyQIynR/4UKy0FyDZ3GvVIDtctmHQT/gmF6c6FvOeQ==
+MIICXQIBAAKBgQDL5SU7OmcJw7Twq9icL1M6rDWIiE2DToKEnqLqZ3h7H1XmG4eU
+gP/j6BYT34NUsAh+HrKiwWBL16N/0uJNnKBnHHFPNPs1zMbTiVV0ObQZTWkNztG4
+U1DKFT69cxCrVAGKBzaaVFkxTHGYDm3PKbNEjNqLTZGIp9BIknQspYEtkwIDAQAB
+AoGBAJcKND5f0RxmoY73fgqU9C6uiymM7v6qFf1wFndWFuX+HH/NPO5BcU2/CzvF
+g2Ak1uW2j9YJMfB82V1DNukPcbId202uVYRRnmge3u6TZlpFezVBQdHiQih0LifP
+hoppMa9EusBRFSDGKz777cOBzU4lS2ko4TckZclYY6N6QtrhAkEA5nJtU1cU7zKE
+XE5fkVCcsK6vTJiR0128eFtfn7tLQ5gtKFXrt4xrPZkubXG7ttW8bdE59OSOnoD1
++dplvKTz1QJBAOKBASyQ5itq39fBbPBUkMcNiy4h2QFk4A/OvPGm83BhzyiFqY0Z
+dNAzULkRgkrObgQdN1Z4M/142DoUc6shl8cCQQDQlEVrp2glUH4I5k8Nwf7w1EuK
+cpWa0D7kWR/l/aoT1ksZNRuTGJ+AM4OYP9b9l9tjMnrYs3567JK2wPxQkKS5AkA4
+et6mFEOw0+eZT1ww2YV4fUIVcM9B77uHdY/b2jud7GXRvvK2goCEYidg3qLUsIDy
+ea6Q20xrijSw1uS46ZmFAkA8V6u1agMX4iKrUJrnpdKriHGCb6r5EBe/6+fWprlV
+oKpCKVlKeadlwuedeJDbpUcyiHGHWRCt6XsQHbzbvhxP
 -----END RSA PRIVATE KEY-----