Merge lp:~josvaz/charms/trusty/bip/client_side_ssl-with_helper-lp1604894 into lp:charms/trusty/bip

[Jose L. VG]

This should replace https://code.launchpad.net/~josvaz/charms/trusty/bip/lp1604894/+merge/300643/+index?ss=1

It goes after this MP:
https://code.launchpad.net/~josvaz/charms/trusty/bip/charmhelpers-cleanup/+merge/301499

And fixes:
https://bugs.launchpad.net/charms/+source/bip/+bug/1604894

X-CPC-Summary-Skip: 1

[Jose L. VG (josvaz)]

This has been tested on a juju setup on GCE

[Pen Gale (pengale)]

Code looks sensible, and does not break existing tests, but I would like to see unit or integration tests that cover the self signing code.

review: Needs Fixing

[Jose L. VG (josvaz)]

Would a test that calls gen_certs() and verifies the generated pem files are for a self signed cert & key suffice?

[Jose L. VG (josvaz)]

Also this MP depends on this other to be done first:
https://code.launchpad.net/~josvaz/charms/trusty/bip/charmhelpers-cleanup/+merge/301499

Do I need to fix anything in that one?

[lp:~josvaz/charms/trusty/bip/client_side_ssl-with_helper-lp1604894]

32. By Jose L. VG on 2016-08-19

Adding a bip ssl deploy test (validates cert & handshake)

[Jose L. VG (josvaz)]

Added a 11-deploy-ssl test that deploys a ssl enabled bip on port 6697, it retrieves the server certificate and then validates against it a SSL connection.

I guess this covers all the new feature code.

Please review!

[Pen Gale (pengale)]

Hello Jose,

Thank you for all your work on this. The new test looks great, and passes when I run bundletester. :-)

I am +1 on this.

There is an outstanding issue with merging and promulgating this, which I noted in the related PR: the bip charm is currently own by ~charmers, rather than a specific maintainer. I can't fix that myself, but I am poking people about it; I'll ping this ticket when the issue is fixed.

review: Approve

[Pen Gale (pengale)]

Dropping in an update here. The next steps for this change need to be:

@bradm needs to update his branch of this charm with the latest from ~charmers, then merge this PR into it. Then he needs to promulgate a charm from his namespace, and request that a charmer merge it.

That should update the charm store so that bip gets pointed at bradm's namespace (since he's the maintainer), and should allow bradm to more easily maintain the charm going forward.

@josvaz: you most likely don't need to do anything else with this PR; the maintainer (bradm) just needs to do some housekeeping to get things merged.

[Jose L. VG (josvaz)]

Thanks fo rthe update Pete!

Jose

On Thu, Aug 25, 2016 at 3:43 PM, petevg <email address hidden>
wrote:

> Dropping in an update here. The next steps for this change need to be:
>
> @bradm needs to update his branch of this charm with the latest from
> ~charmers, then merge this PR into it. Then he needs to promulgate a charm
> from his namespace, and request that a charmer merge it.
>
> That should update the charm store so that bip gets pointed at bradm's
> namespace (since he's the maintainer), and should allow bradm to more
> easily maintain the charm going forward.
>
> @josvaz: you most likely don't need to do anything else with this PR; the
> maintainer (bradm) just needs to do some housekeeping to get things merged.
> --
> https://code.launchpad.net/~josvaz/charms/trusty/bip/
> client_side_ssl-with_helper-lp1604894/+merge/301802
> You are the owner of lp:~josvaz/charms/trusty/bip/
> client_side_ssl-with_helper-lp1604894.
>

[Pen Gale (pengale)]

Poked bradm about confirming that bip is moved and closing this review out.

[Brad Marshall (brad-marshall)]

Looks good to me, merged into my own branch and am working on getting it updated in the charmstore.

review: Approve

[Jose L. VG (josvaz)]

Thanks Brad, let me know if/when this MP needs to be marked Merged manually.

[Review Queue (review-queue)]

The results (PASS) are in and available here: http://juju-ci.vapour.ws/job/charm-bundle-test-aws/5067/

review: Approve (automated testing)

[Review Queue (review-queue)]

The results (PASS) are in and available here: http://juju-ci.vapour.ws/job/charm-bundle-test-lxc/4866/

review: Approve (automated testing)

Unmerged revisions

32. By Jose L. VG on 2016-08-19

Adding a bip ssl deploy test (validates cert & handshake)

31. By Jose L. VG on 2016-08-02

Added support to client_side_ssl with charmhelper contrib.ssl

30. By Jose L. VG on 2016-07-29

Got charmhelpers for fetch as apt_install is now there

29. By Jose L. VG on 2016-07-29

Moved from charm-helpers/charmhelpers to just charmhelpers (plus clean-up)

28. By Jose L. VG on 2016-07-29

Result of removing charmhelpers and re-syncing it

27. By Jose L. VG on 2016-07-29

Added charm-helpers.yaml to manage helpers with charm_helpers_sync tool

26. By Jose L. VG on 2016-07-29

Flake8 suggested fixes, including unused imports

=== modified file 'charm-helpers.yaml'
--- charm-helpers.yaml	2016-08-19 17:00:35 +0000
+++ charm-helpers.yaml	2016-08-19 17:00:35 +0000
@@ -3,3 +3,4 @@
 include:
     - core
     - fetch
+    - contrib.ssl

=== modified file 'config.yaml'
--- config.yaml	2016-07-20 10:26:23 +0000
+++ config.yaml	2016-08-19 17:00:35 +0000
@@ -35,6 +35,10 @@
     type: string
     default: '{"oftc": {host: "irc.oftc.net", port: 6667}, "freenode": {host: "irc.freenode.net", port: 6667}}'
     description: IRC Networks defined
+  client_side_ssl:
+    type: string
+    default: "false"
+    description: Use SSL to connect to bip from your client
   user:
     type: string
     description: User definitions

=== modified file 'hooks/hooks.py'
--- hooks/hooks.py	2016-08-19 17:00:35 +0000
+++ hooks/hooks.py	2016-08-19 17:00:35 +0000
@@ -3,10 +3,13 @@
 # Copyright 2013 Canonical Ltd. All rights reserved.
 # Author: Brad Marshall <[e-mail]>
 
+import glob
+import pwd
 import os
 import sys
 import json
 import yaml
+import subprocess
 
 local_copy = os.path.join(
     os.path.dirname(os.path.abspath(os.path.dirname(__file__))),
@@ -29,6 +32,8 @@
     open_port,
 )
 
+from charmhelpers.contrib import ssl
+
 hook_dir = os.path.abspath(os.path.dirname(__file__))
 charm_dir = os.path.dirname(hook_dir)
 
@@ -41,6 +46,7 @@
 user_config = config().get('user')
 backlog_lines = config().get('backlog_lines')
 backlog_msg_only = config().get('backlog_msg_only')
+client_side_ssl = config().get('client_side_ssl')
 backlog_always = config().get('backlog_always')
 bip_conf = '/etc/bip.conf'
 bip_defaults = '/etc/default/bip'
@@ -48,27 +54,44 @@
 required_pkgs = [
     'bip',
     'python-jinja2',
+    'openssl',
 ]
 
 hooks = Hooks()
 
 
+def gen_certs():
+    """gen_certs generates bip SSL certificates with openssl CLI"""
+    bip_dir = "/var/lib/bip"
+    pem = "%s/bip.pem" % bip_dir
+    ssl.generate_selfsigned(keyfile=pem, certfile=pem, keysize=4096,
+        cn="BipServerSert")
+    os.chmod('%s/bip.pem' % bip_dir, 0600)
+    bip_uid = pwd.getpwnam("bip").pw_uid
+    os.chown('%s/bip.pem' % bip_dir, bip_uid, -1)
+
+def setup():
+    """setup executes post configuration actions, like certificate generation"""
+    if client_side_ssl.lower() == 'true':
+        gen_certs()
+
+
 def update_config():
     from jinja2 import Environment, FileSystemLoader
     if network_config:
-        # Try originally supported JSON formatted config
+        ## Try originally supported JSON formatted config
         try:
             network = json.loads(network_config)
-        # else use YAML (current):
+        ## else use YAML (current):
         except ValueError:
             network = yaml.load(network_config)
     else:
         network = {}
     if user_config:
-        # Try originally supported JSON formatted config
+        ## Try originally supported JSON formatted config
         try:
             user = json.loads(user_config)
-        # else use YAML (current):
+        ## else use YAML (current):
         except ValueError:
             user = yaml.load(user_config)
     else:
@@ -87,12 +110,13 @@
         'user': user,
         'backlog_lines': backlog_lines,
         'backlog_msg_only': backlog_msg_only,
+        'client_side_ssl': client_side_ssl,
         'backlog_always': backlog_always,
     }
-    template = template_env.get_template('bip_conf.template').render(
-        templ_vars)
+    template = template_env.get_template('bip_conf.template').render(templ_vars)
     with open(bip_conf, 'w') as bip_conf_config:
         bip_conf_config.write(str(template))
+    setup()
 
 
 @hooks.hook()

=== added directory 'lib/charmhelpers/contrib'
=== added file 'lib/charmhelpers/contrib/__init__.py'
--- lib/charmhelpers/contrib/__init__.py	1970-01-01 00:00:00 +0000
+++ lib/charmhelpers/contrib/__init__.py	2016-08-19 17:00:35 +0000
@@ -0,0 +1,13 @@
+# Copyright 2014-2015 Canonical Limited.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

=== added directory 'lib/charmhelpers/contrib/ssl'
=== added file 'lib/charmhelpers/contrib/ssl/__init__.py'
--- lib/charmhelpers/contrib/ssl/__init__.py	1970-01-01 00:00:00 +0000
+++ lib/charmhelpers/contrib/ssl/__init__.py	2016-08-19 17:00:35 +0000
@@ -0,0 +1,92 @@
+# Copyright 2014-2015 Canonical Limited.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import subprocess
+from charmhelpers.core import hookenv
+
+
+def generate_selfsigned(keyfile, certfile, keysize="1024", config=None, subject=None, cn=None):
+    """Generate selfsigned SSL keypair
+
+    You must provide one of the 3 optional arguments:
+    config, subject or cn
+    If more than one is provided the leftmost will be used
+
+    Arguments:
+    keyfile -- (required) full path to the keyfile to be created
+    certfile -- (required) full path to the certfile to be created
+    keysize -- (optional) SSL key length
+    config -- (optional) openssl configuration file
+    subject -- (optional) dictionary with SSL subject variables
+    cn -- (optional) cerfificate common name
+
+    Required keys in subject dict:
+    cn -- Common name (eq. FQDN)
+
+    Optional keys in subject dict
+    country -- Country Name (2 letter code)
+    state -- State or Province Name (full name)
+    locality -- Locality Name (eg, city)
+    organization -- Organization Name (eg, company)
+    organizational_unit -- Organizational Unit Name (eg, section)
+    email -- Email Address
+    """
+
+    cmd = []
+    if config:
+        cmd = ["/usr/bin/openssl", "req", "-new", "-newkey",
+               "rsa:{}".format(keysize), "-days", "365", "-nodes", "-x509",
+               "-keyout", keyfile,
+               "-out", certfile, "-config", config]
+    elif subject:
+        ssl_subject = ""
+        if "country" in subject:
+            ssl_subject = ssl_subject + "/C={}".format(subject["country"])
+        if "state" in subject:
+            ssl_subject = ssl_subject + "/ST={}".format(subject["state"])
+        if "locality" in subject:
+            ssl_subject = ssl_subject + "/L={}".format(subject["locality"])
+        if "organization" in subject:
+            ssl_subject = ssl_subject + "/O={}".format(subject["organization"])
+        if "organizational_unit" in subject:
+            ssl_subject = ssl_subject + "/OU={}".format(subject["organizational_unit"])
+        if "cn" in subject:
+            ssl_subject = ssl_subject + "/CN={}".format(subject["cn"])
+        else:
+            hookenv.log("When using \"subject\" argument you must "
+                        "provide \"cn\" field at very least")
+            return False
+        if "email" in subject:
+            ssl_subject = ssl_subject + "/emailAddress={}".format(subject["email"])
+
+        cmd = ["/usr/bin/openssl", "req", "-new", "-newkey",
+               "rsa:{}".format(keysize), "-days", "365", "-nodes", "-x509",
+               "-keyout", keyfile,
+               "-out", certfile, "-subj", ssl_subject]
+    elif cn:
+        cmd = ["/usr/bin/openssl", "req", "-new", "-newkey",
+               "rsa:{}".format(keysize), "-days", "365", "-nodes", "-x509",
+               "-keyout", keyfile,
+               "-out", certfile, "-subj", "/CN={}".format(cn)]
+
+    if not cmd:
+        hookenv.log("No config, subject or cn provided,"
+                    "unable to generate self signed SSL certificates")
+        return False
+    try:
+        subprocess.check_call(cmd)
+        return True
+    except Exception as e:
+        print("Execution of openssl command failed:\n{}".format(e))
+        return False

=== added file 'lib/charmhelpers/contrib/ssl/service.py'
--- lib/charmhelpers/contrib/ssl/service.py	1970-01-01 00:00:00 +0000
+++ lib/charmhelpers/contrib/ssl/service.py	2016-08-19 17:00:35 +0000
@@ -0,0 +1,277 @@
+# Copyright 2014-2015 Canonical Limited.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+from os.path import join as path_join
+from os.path import exists
+import subprocess
+
+from charmhelpers.core.hookenv import log, DEBUG
+
+STD_CERT = "standard"
+
+# Mysql server is fairly picky about cert creation
+# and types, spec its creation separately for now.
+MYSQL_CERT = "mysql"
+
+
+class ServiceCA(object):
+
+    default_expiry = str(365 * 2)
+    default_ca_expiry = str(365 * 6)
+
+    def __init__(self, name, ca_dir, cert_type=STD_CERT):
+        self.name = name
+        self.ca_dir = ca_dir
+        self.cert_type = cert_type
+
+    ###############
+    # Hook Helper API
+    @staticmethod
+    def get_ca(type=STD_CERT):
+        service_name = os.environ['JUJU_UNIT_NAME'].split('/')[0]
+        ca_path = os.path.join(os.environ['CHARM_DIR'], 'ca')
+        ca = ServiceCA(service_name, ca_path, type)
+        ca.init()
+        return ca
+
+    @classmethod
+    def get_service_cert(cls, type=STD_CERT):
+        service_name = os.environ['JUJU_UNIT_NAME'].split('/')[0]
+        ca = cls.get_ca()
+        crt, key = ca.get_or_create_cert(service_name)
+        return crt, key, ca.get_ca_bundle()
+
+    ###############
+
+    def init(self):
+        log("initializing service ca", level=DEBUG)
+        if not exists(self.ca_dir):
+            self._init_ca_dir(self.ca_dir)
+            self._init_ca()
+
+    @property
+    def ca_key(self):
+        return path_join(self.ca_dir, 'private', 'cacert.key')
+
+    @property
+    def ca_cert(self):
+        return path_join(self.ca_dir, 'cacert.pem')
+
+    @property
+    def ca_conf(self):
+        return path_join(self.ca_dir, 'ca.cnf')
+
+    @property
+    def signing_conf(self):
+        return path_join(self.ca_dir, 'signing.cnf')
+
+    def _init_ca_dir(self, ca_dir):
+        os.mkdir(ca_dir)
+        for i in ['certs', 'crl', 'newcerts', 'private']:
+            sd = path_join(ca_dir, i)
+            if not exists(sd):
+                os.mkdir(sd)
+
+        if not exists(path_join(ca_dir, 'serial')):
+            with open(path_join(ca_dir, 'serial'), 'w') as fh:
+                fh.write('02\n')
+
+        if not exists(path_join(ca_dir, 'index.txt')):
+            with open(path_join(ca_dir, 'index.txt'), 'w') as fh:
+                fh.write('')
+
+    def _init_ca(self):
+        """Generate the root ca's cert and key.
+        """
+        if not exists(path_join(self.ca_dir, 'ca.cnf')):
+            with open(path_join(self.ca_dir, 'ca.cnf'), 'w') as fh:
+                fh.write(
+                    CA_CONF_TEMPLATE % (self.get_conf_variables()))
+
+        if not exists(path_join(self.ca_dir, 'signing.cnf')):
+            with open(path_join(self.ca_dir, 'signing.cnf'), 'w') as fh:
+                fh.write(
+                    SIGNING_CONF_TEMPLATE % (self.get_conf_variables()))
+
+        if exists(self.ca_cert) or exists(self.ca_key):
+            raise RuntimeError("Initialized called when CA already exists")
+        cmd = ['openssl', 'req', '-config', self.ca_conf,
+               '-x509', '-nodes', '-newkey', 'rsa',
+               '-days', self.default_ca_expiry,
+               '-keyout', self.ca_key, '-out', self.ca_cert,
+               '-outform', 'PEM']
+        output = subprocess.check_output(cmd, stderr=subprocess.STDOUT)
+        log("CA Init:\n %s" % output, level=DEBUG)
+
+    def get_conf_variables(self):
+        return dict(
+            org_name="juju",
+            org_unit_name="%s service" % self.name,
+            common_name=self.name,
+            ca_dir=self.ca_dir)
+
+    def get_or_create_cert(self, common_name):
+        if common_name in self:
+            return self.get_certificate(common_name)
+        return self.create_certificate(common_name)
+
+    def create_certificate(self, common_name):
+        if common_name in self:
+            return self.get_certificate(common_name)
+        key_p = path_join(self.ca_dir, "certs", "%s.key" % common_name)
+        crt_p = path_join(self.ca_dir, "certs", "%s.crt" % common_name)
+        csr_p = path_join(self.ca_dir, "certs", "%s.csr" % common_name)
+        self._create_certificate(common_name, key_p, csr_p, crt_p)
+        return self.get_certificate(common_name)
+
+    def get_certificate(self, common_name):
+        if common_name not in self:
+            raise ValueError("No certificate for %s" % common_name)
+        key_p = path_join(self.ca_dir, "certs", "%s.key" % common_name)
+        crt_p = path_join(self.ca_dir, "certs", "%s.crt" % common_name)
+        with open(crt_p) as fh:
+            crt = fh.read()
+        with open(key_p) as fh:
+            key = fh.read()
+        return crt, key
+
+    def __contains__(self, common_name):
+        crt_p = path_join(self.ca_dir, "certs", "%s.crt" % common_name)
+        return exists(crt_p)
+
+    def _create_certificate(self, common_name, key_p, csr_p, crt_p):
+        template_vars = self.get_conf_variables()
+        template_vars['common_name'] = common_name
+        subj = '/O=%(org_name)s/OU=%(org_unit_name)s/CN=%(common_name)s' % (
+            template_vars)
+
+        log("CA Create Cert %s" % common_name, level=DEBUG)
+        cmd = ['openssl', 'req', '-sha1', '-newkey', 'rsa:2048',
+               '-nodes', '-days', self.default_expiry,
+               '-keyout', key_p, '-out', csr_p, '-subj', subj]
+        subprocess.check_call(cmd, stderr=subprocess.PIPE)
+        cmd = ['openssl', 'rsa', '-in', key_p, '-out', key_p]
+        subprocess.check_call(cmd, stderr=subprocess.PIPE)
+
+        log("CA Sign Cert %s" % common_name, level=DEBUG)
+        if self.cert_type == MYSQL_CERT:
+            cmd = ['openssl', 'x509', '-req',
+                   '-in', csr_p, '-days', self.default_expiry,
+                   '-CA', self.ca_cert, '-CAkey', self.ca_key,
+                   '-set_serial', '01', '-out', crt_p]
+        else:
+            cmd = ['openssl', 'ca', '-config', self.signing_conf,
+                   '-extensions', 'req_extensions',
+                   '-days', self.default_expiry, '-notext',
+                   '-in', csr_p, '-out', crt_p, '-subj', subj, '-batch']
+        log("running %s" % " ".join(cmd), level=DEBUG)
+        subprocess.check_call(cmd, stderr=subprocess.PIPE)
+
+    def get_ca_bundle(self):
+        with open(self.ca_cert) as fh:
+            return fh.read()
+
+
+CA_CONF_TEMPLATE = """
+[ ca ]
+default_ca = CA_default
+
+[ CA_default ]
+dir                     = %(ca_dir)s
+policy                  = policy_match
+database                = $dir/index.txt
+serial                  = $dir/serial
+certs                   = $dir/certs
+crl_dir                 = $dir/crl
+new_certs_dir           = $dir/newcerts
+certificate             = $dir/cacert.pem
+private_key             = $dir/private/cacert.key
+RANDFILE                = $dir/private/.rand
+default_md              = default
+
+[ req ]
+default_bits            = 1024
+default_md              = sha1
+
+prompt                  = no
+distinguished_name      = ca_distinguished_name
+
+x509_extensions         = ca_extensions
+
+[ ca_distinguished_name ]
+organizationName        = %(org_name)s
+organizationalUnitName  = %(org_unit_name)s Certificate Authority
+
+
+[ policy_match ]
+countryName             = optional
+stateOrProvinceName     = optional
+organizationName        = match
+organizationalUnitName  = optional
+commonName              = supplied
+
+[ ca_extensions ]
+basicConstraints        = critical,CA:true
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid:always, issuer
+keyUsage                = cRLSign, keyCertSign
+"""
+
+
+SIGNING_CONF_TEMPLATE = """
+[ ca ]
+default_ca = CA_default
+
+[ CA_default ]
+dir                     = %(ca_dir)s
+policy                  = policy_match
+database                = $dir/index.txt
+serial                  = $dir/serial
+certs                   = $dir/certs
+crl_dir                 = $dir/crl
+new_certs_dir           = $dir/newcerts
+certificate             = $dir/cacert.pem
+private_key             = $dir/private/cacert.key
+RANDFILE                = $dir/private/.rand
+default_md              = default
+
+[ req ]
+default_bits            = 1024
+default_md              = sha1
+
+prompt                  = no
+distinguished_name      = req_distinguished_name
+
+x509_extensions         = req_extensions
+
+[ req_distinguished_name ]
+organizationName        = %(org_name)s
+organizationalUnitName  = %(org_unit_name)s machine resources
+commonName              = %(common_name)s
+
+[ policy_match ]
+countryName             = optional
+stateOrProvinceName     = optional
+organizationName        = match
+organizationalUnitName  = optional
+commonName              = supplied
+
+[ req_extensions ]
+basicConstraints        = CA:false
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid:always, issuer
+keyUsage                = digitalSignature, keyEncipherment, keyAgreement
+extendedKeyUsage        = serverAuth, clientAuth
+"""

=== modified file 'templates/bip_conf.template'
--- templates/bip_conf.template	2016-07-20 10:26:23 +0000
+++ templates/bip_conf.template	2016-08-19 17:00:35 +0000
@@ -2,7 +2,7 @@
 
 port = {{ listen_port }};
 
-client_side_ssl = false;
+client_side_ssl = {{ client_side_ssl }};
 
 log_level = 3;
 

=== added file 'tests/11-deploy-ssl'
--- tests/11-deploy-ssl	1970-01-01 00:00:00 +0000
+++ tests/11-deploy-ssl	2016-08-19 17:00:35 +0000
@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+
+import amulet
+import os
+import pprint
+import ssl
+import socket
+import unittest
+
+class TestSSLDeployment(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.deployment = amulet.Deployment()
+
+        cls.deployment.add('bip-ssl', charm='bip')
+
+        # configure ssl and new port
+        cls.deployment.configure('bip-ssl', {
+            'client_side_ssl': 'true',
+            'listen_port': '6697'
+        })
+
+        cls.deployment.expose('bip-ssl')
+
+        try:
+            cls.deployment.setup(timeout=900, cleanup=False)
+            cls.deployment.sentry.wait()
+        except amulet.helpers.TimeoutError:
+            amulet.raise_status(amulet.SKIP, 
+                msg="Environment wasn't stood up in time")
+        except:
+            raise
+
+        cls.unit = cls.deployment.sentry['bip-ssl'][0]
+        cls.ipaddr = cls.unit.info['public-address']
+        cls.ports = cls.unit.info['open-ports']
+
+    def test_1_check_running(self):
+        output = self.unit.run('service bip status')
+        service_active = 'bip is running' in str(output)
+        if service_active:
+            print("Found running bip on %s" % self.ipaddr)
+            #amulet.raise_status(amulet.PASS, msg=message)
+        else:
+            message = "Failed to find running bip"
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_2_check_ssl(self):
+        #print("bip.conf: {}".format(self.unit.run('cat /etc/bip.conf')))
+        s = socket.socket()
+        for p in self.ports:
+            (port, proto) = p.split("/")
+            crt_pem = ssl.get_server_certificate((self.ipaddr, int(port)))
+            #print(crt_pem)
+            cert_file = "_test-self-signed-cert.pem"
+            with open(cert_file, 'wt', encoding='utf-8') as f:
+                f.write(crt_pem)
+            sslsock = ssl.wrap_socket(s, 
+                ca_certs=cert_file, 
+                cert_reqs=ssl.CERT_REQUIRED)
+            try:
+                sslsock.connect((self.ipaddr, int(port)))
+                #print(repr(sslsock.getpeername()))
+                #print(sslsock.cipher())
+                #print(pprint.pformat(sslsock.getpeercert()))
+                message = "Connect to %s on port %s succeeded" % (
+                        self.ipaddr, port)
+                #amulet.raise_status(amulet.PASS, msg=message)
+                print(message)
+                sslsock.close()
+            except socket.error as e:
+                message = "Connection to %s on port %s failed: %s" % (
+                        self.ipaddr, port, e)
+                amulet.raise_status(amulet.FAIL, msg=message)
+            os.remove(cert_file)
+
+if __name__ == '__main__':
+    unittest.main()