BUG21947091: Add ssl_disabled option

Connections are now made in SSL by default. It quietly switches to unsecured
if SSL is not available. The only time it complains is when `ssl_verify_cert`
is set to `True` and SSL is not available.

Tests have been added/updated for regression.

Author: amitab

lib/mysql/connector/abstracts.py

@@ -60,6 +60,7 @@ def __init__(self, **kwargs):
         self._client_host = ''
         self._client_port = 0
         self._ssl = {}
+        self._ssl_disabled = DEFAULT_CONFIGURATION["ssl_disabled"]
         self._force_ipv6 = False
 
         self._use_unicode = True
@@ -304,6 +305,9 @@ def config(self, **kwargs):
             raise errors.InterfaceError(
                 "TCP/IP port number should be an integer")
 
+        if "ssl_disabled" in config:
+            self._ssl_disabled = config.pop("ssl_disabled")
+
         # Other configuration
         set_ssl_flag = False
         for key, value in config.items():
@@ -344,7 +348,6 @@ def config(self, **kwargs):
                     "ssl_key and ssl_cert need to be both "
                     "set, or neither."
                 )
-            self.set_client_flags([ClientFlag.SSL])
 
     def _check_server_version(self, server_version):
         """Check the MySQL version

lib/mysql/connector/connection.py

@@ -114,6 +114,14 @@ def _do_handshake(self):
         self._server_version = self._check_server_version(
             handshake['server_version_original'])
 
+        if not handshake['capabilities'] & ClientFlag.SSL:
+            self._client_flags &= ~ClientFlag.SSL
+            if self._ssl.get('verify_cert'):
+                raise errors.InterfaceError("SSL is required but the server "
+                                            "doesn't support it", errno=2026)
+        elif not self._ssl_disabled:
+            self._client_flags |= ClientFlag.SSL
+
         if handshake['capabilities'] & ClientFlag.PLUGIN_AUTH:
             self.set_client_flags([ClientFlag.PLUGIN_AUTH])
 
@@ -131,11 +139,15 @@ def _do_auth(self, username=None, password=None, database=None,
         reply back. Raises any error coming from MySQL.
         """
         self._ssl_active = False
-        if client_flags & ClientFlag.SSL and ssl_options:
+        if client_flags & ClientFlag.SSL:
             packet = self._protocol.make_auth_ssl(charset=charset,
                                                   client_flags=client_flags)
             self._socket.send(packet)
-            self._socket.switch_to_ssl(**ssl_options)
+            self._socket.switch_to_ssl(ssl_options.get('ca'),
+                                       ssl_options.get('cert'),
+                                       ssl_options.get('key'),
+                                       ssl_options.get('verify_cert') or False,
+                                       ssl_options.get('cipher'))
             self._ssl_active = True
 
         packet = self._protocol.make_auth(

lib/mysql/connector/connection_cext.py

@@ -158,12 +158,13 @@ def _open_connection(self):
             'compress': self.isset_client_flag(ClientFlag.COMPRESS)
         }
 
-        if self.isset_client_flag(ClientFlag.SSL):
+        if not self._ssl_disabled:
             cnx_kwargs.update({
-                'ssl_ca': self._ssl['ca'],
-                'ssl_cert': self._ssl['cert'],
-                'ssl_key': self._ssl['key'],
-                'ssl_verify_cert': self._ssl['verify_cert']
+                'ssl_ca': self._ssl.get('ca'),
+                'ssl_cert': self._ssl.get('cert'),
+                'ssl_key': self._ssl.get('key'),
+                'ssl_verify_cert': self._ssl.get('verify_cert') or False,
+                'ssl_disabled': self._ssl_disabled
             })
 
         try:

lib/mysql/connector/constants.py

@@ -57,6 +57,7 @@
     'ssl_key': None,
     'ssl_verify_cert': False,
     'ssl_cipher': None,
+    'ssl_disabled': False,
     'passwd': None,
     'db': None,
     'connect_timeout': None,

src/mysql_capi.c

@@ -1034,7 +1034,7 @@ MySQL_connect(MySQL *self, PyObject *args, PyObject *kwds)
 {
 	char *host= NULL, *user= NULL, *database= NULL, *unix_socket= NULL;
 	char *ssl_ca= NULL, *ssl_cert= NULL, *ssl_key= NULL;
-	PyObject *charset_name, *compress, *ssl_verify_cert, *password;
+	PyObject *charset_name, *compress, *ssl_verify_cert, *password, *ssl_disabled;
 	const char* auth_plugin;
 	unsigned long client_flags= 0;
 	unsigned int port= 3306, tmp_uint;
@@ -1055,21 +1055,22 @@ MySQL_connect(MySQL *self, PyObject *args, PyObject *kwds)
 	{
 	    "host", "user", "password", "database",
 		"port", "unix_socket", "client_flags",
-		"ssl_ca", "ssl_cert", "ssl_key", "ssl_verify_cert",
+		"ssl_ca", "ssl_cert", "ssl_key", "ssl_verify_cert", "ssl_disabled",
 		"compress",
 		NULL
     };
 
 #ifdef PY3
-    if (!PyArg_ParseTupleAndKeywords(args, kwds, "|zzzzkzkzzzO!O!", kwlist,
+    if (!PyArg_ParseTupleAndKeywords(args, kwds, "|zzzzkzkzzzO!O!O!", kwlist,
 #else
-    if (!PyArg_ParseTupleAndKeywords(args, kwds, "|zzOzkzkzzzO!O!", kwlist,
+    if (!PyArg_ParseTupleAndKeywords(args, kwds, "|zzOzkzkzzzO!O!O!", kwlist,
 #endif
                                      &host, &user, &password, &database,
                                      &port, &unix_socket,
                                      &client_flags,
                                      &ssl_ca, &ssl_cert, &ssl_key,
                                      &PyBool_Type, &ssl_verify_cert,
+                                     &PyBool_Type, &ssl_disabled,
                                      &PyBool_Type, &compress))
     {
         return NULL;
@@ -1124,39 +1125,26 @@ MySQL_connect(MySQL *self, PyObject *args, PyObject *kwds)
     mysql_options(&self->session, MYSQL_OPT_READ_TIMEOUT, (char*)&tmp_uint);
     mysql_options(&self->session, MYSQL_OPT_WRITE_TIMEOUT, (char*)&tmp_uint);
 
-    if (ssl_ca || ssl_cert || ssl_key) {
+    if (ssl_disabled && ssl_disabled == Py_False) {
         ssl_enabled= 1;
-#if MYSQL_VERSION_ID > 50703 && MYSQL_VERSION_ID < 50711
-        {
-            abool= 1;
-            mysql_options(&self->session, MYSQL_OPT_SSL_ENFORCE, (char*)&abool);
-        }
-#endif
-#if MYSQL_VERSION_ID >= 50711
-        {
-            ssl_mode= SSL_MODE_REQUIRED;
-            mysql_options(&self->session, MYSQL_OPT_SSL_MODE, &ssl_mode);
-        }
-#endif
-
+        client_flags |= CLIENT_SSL;
         if (ssl_verify_cert && ssl_verify_cert == Py_True)
         {
 #if MYSQL_VERSION_ID >= 50711
-            {
-                ssl_mode= SSL_MODE_VERIFY_IDENTITY;
-                mysql_options(&self->session, MYSQL_OPT_SSL_MODE, &ssl_mode);
-            }
+            ssl_mode= SSL_MODE_VERIFY_IDENTITY;
+            mysql_options(&self->session, MYSQL_OPT_SSL_MODE, &ssl_mode);
 #else
-            {
-                abool= 1;
-                mysql_options(&self->session,
-                              MYSQL_OPT_SSL_VERIFY_SERVER_CERT, (char*)&abool);
-            }
+            abool= 1;
+#if MYSQL_VERSION_ID > 50703
+            mysql_options(&self->session, MYSQL_OPT_SSL_ENFORCE, (char*)&abool);
+#endif
+            mysql_options(&self->session,
+                          MYSQL_OPT_SSL_VERIFY_SERVER_CERT, (char*)&abool);
 #endif
-          mysql_ssl_set(&self->session, ssl_key, ssl_cert, ssl_ca, NULL, NULL);
         } else {
-          mysql_ssl_set(&self->session, ssl_key, ssl_cert, NULL, NULL, NULL); 
+          ssl_ca= NULL;
         }
+        mysql_ssl_set(&self->session, ssl_key, ssl_cert, ssl_ca, NULL, NULL);
     } else {
         // Make sure to not enforce SSL
 #if MYSQL_VERSION_ID > 50703 && MYSQL_VERSION_ID < 50711

tests/data/ssl/generate.sh

@@ -125,25 +125,24 @@ if [ $? -ne 0 ]; then
     exit 3
 fi
 
-# MySQL Expired Server Certificate: generate, remove passphrase, sign
+# MySQL Root Certificate: generate, remove passphrase, sign
 echo
-echo "Generating Expired Server Certificate"
+echo "Generating Another Root Certificate"
 echo
-SUBJ="/OU=$OU Expired Server Cert/CN=localhost"
-$OPENSSL genrsa -out $DESTDIR/tests_expired_server_key.pem 2048
+$OPENSSL genrsa -out $DESTDIR/tests_CA_key_1.pem 2048
 if [ $? -ne 0 ]; then
     exit 3
 fi
-$OPENSSL req -new -key $DESTDIR/tests_expired_server_key.pem \
-    -out $DESTDIR/tests_expired_server_req.csr -subj "$SUBJ"
+SUBJ="/OU=$OU Root CA/CN=MyConnPy Root CA"
+$OPENSSL req -new -key $DESTDIR/tests_CA_key_1.pem \
+    -out $DESTDIR/tests_CA_req_1.csr -subj "$SUBJ"
 if [ $? -ne 0 ]; then
     exit 3
 fi
-$OPENSSL ca -config $DESTDIR/ca.conf -in $DESTDIR/tests_expired_server_req.csr \
-    -cert $DESTDIR/tests_CA_cert.pem \
-    -keyfile $DESTDIR/tests_CA_key.pem \
-    -out $DESTDIR/tests_expired_server_cert.pem -batch \
-    -startdate 120815080000Z -enddate 120815090000Z
+$OPENSSL x509 -req -days $DAYS \
+    -in $DESTDIR/tests_CA_req_1.csr \
+    -out $DESTDIR/tests_CA_cert_1.pem \
+    -signkey $DESTDIR/tests_CA_key_1.pem
 if [ $? -ne 0 ]; then
     exit 3
 fi
@@ -176,5 +175,5 @@ echo "Cleaning up"
 echo
 (cd $DESTDIR; rm -rf tests_server_req.pem tests_client_req.pem \
     ca.db.certs ca.db.index* ca.db.serial* ca.conf tests_CA_req.csr \
-    tests_server_req.csr tests_expired_server_req.csr tests_client_req.csr)
+    tests_server_req.csr tests_CA_req_1.csr tests_client_req.csr)
 

tests/data/ssl/tests_CA_cert.pem

@@ -1,19 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIIDADCCAegCCQDmOCndJJOWFjANBgkqhkiG9w0BAQsFADBCMSUwIwYDVQQLDBxN
+MIIDADCCAegCCQCZfblCD1izGzANBgkqhkiG9w0BAQsFADBCMSUwIwYDVQQLDBxN
 eVNRTENvbm5lY3RvclB5dGhvbiBSb290IENBMRkwFwYDVQQDDBBNeUNvbm5QeSBS
-b290IENBMB4XDTE3MDMxNzE1NTAzNloXDTI2MDQwNTE1NTAzNlowQjElMCMGA1UE
+b290IENBMB4XDTE3MDcxMjA5NDIyOFoXDTI2MDczMTA5NDIyOFowQjElMCMGA1UE
 CwwcTXlTUUxDb25uZWN0b3JQeXRob24gUm9vdCBDQTEZMBcGA1UEAwwQTXlDb25u
-UHkgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANex2fME
-DGfFk6KIIjsCpXQ6Rsv7nClZ+H7iT/xBMDHtQbqVYX1HIDYGRApWIi0Mmg3hosri
-6TO5wJIMMEwcSurVStyLXPpCT4Dg3iDuKToYfNNGtuH9DFWh1fnkeni0gbEh+/yT
-PIe3FLZCHD+F12ST1z88i4LXOG4NuozKI2cmQcHxdVkYYzknMX4IKdP4AniPgMq0
-9YmQJjXH6y7lPzDXeUuG8YrOSuvfl4W2bjht4mGP6YUUQkwZ5qbRQfrkduQB3+pa
-+7P6ckd3q91j1+H1kRCn4a1S28xzPOaey6cLQ/DRVKP9EwPVV9H3/Wm8BdTr0ZMs
-1s2VQtocmzcp35kCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAGvUp9Du79gpN/pBD
-8eG7ZX/YMpK1cbzUwD+TqmP7QnXItRrZalbmadzZ6P161ff0QOEQPxL181+EEXFe
-yC8f33EGu9n6ZlSnj/HrdMZ2sjv8QA8M4Vg2vn81qUT/EsJQOjJA6n30ybncZHWB
-ovmFgBlq9miX2gDCMRosiRkzm4HAETdWQhiQ/jU4RV+pgP3/sd/mk/u2D5nqMeuT
-Ni61ke1CfskuCar5knXTdw7PYfCVXrD1ndgpf7e+qdz534GMkHcFKQkEvWE+ZuWj
-CHx9t32JFekCSzJCYs5YuAfuIJc0aC+RmA/lF7UUGyj++wWFAMnkmVEf5MM3WGjM
-HRerEg==
+UHkgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOHbedXD
+M/g7KuSURqBOHo49S/9lGarUt/YOkTDjKlNhqNQ4YrG3Au/PlBi4v4sE+4ILgrrc
+19/Knj/+DI/jGIxmdheYiTacynDodfT4DVLZghI3bGqST+OG03KHtB0BMsovAdt+
+CiwDNU4M8OkM57D00ijEcSmVrQuEFoyrxm5EWE9E9F4Hc45TQKCP0ge8VVk1rzZi
+1z+Yjrvqu/m6T6r0jF+WpDNc3ZqMQNHkenMSmNdZelCIbwwZh8G3zLnIOrOEEfwx
+hNbMFJl1vdQjqZODrXmjCM34v0ZAjBfbwWOZGhOw+kFXFfIv6F46LMfabukgWLGU
+5/JO7bvxCpS32hkCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEA2Fq6Ll8dnmrTJXTu
+kC6qVomZ5J2zfjUWRGY1bOYCWzCwANnsgwhN5Q5AuSV4CwctXBhDYVunyyxTuJ9P
+Usz9FppKgdwAR4XPQq+Eh57PMZAl5l4LGskwzTwu+Ud94D0s23yBXdFReZgPtGM3
+T03pGKf8nGtt692CFdnQ+EtSFOtzt+VaaZy6SSg0MAGaRRLRpfAa1uzzTrlmEQ9w
+cUOemtIWKC1016gmtjU+N7suzqGPuDuVyfl6VqariGzpM5z10n5XFM9z9G7QCb2Q
+/5LnLll3R2caaa6QVmeW1Dpew4lUhoQ12mUpEELsJPIsSVxRxAVEzCFAMldeNgfw
+Fs9KxQ==
 -----END CERTIFICATE-----

tests/data/ssl/tests_CA_cert_1.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAegCCQClgkE5NPaTKTANBgkqhkiG9w0BAQsFADBCMSUwIwYDVQQLDBxN
+eVNRTENvbm5lY3RvclB5dGhvbiBSb290IENBMRkwFwYDVQQDDBBNeUNvbm5QeSBS
+b290IENBMB4XDTE3MDcxMjA5NDIyOVoXDTI2MDczMTA5NDIyOVowQjElMCMGA1UE
+CwwcTXlTUUxDb25uZWN0b3JQeXRob24gUm9vdCBDQTEZMBcGA1UEAwwQTXlDb25u
+UHkgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMWRBnCR
+Fnkqd+QhuJC26CWX34ChTeIeqat6WR3bpD79a9NbLnOZp9it/fw7s8AM9dngREeu
+X8xgO5pduohW3fyk0my/ojrb6XQPZA1heDOrjYgC+0m0IGzXGzaHP5bU0G4BRdxQ
+9eOHgzGKmV2SLxNcIxVKCFZqtxElfyLD3/asB7wcVRpgbZ/fhdYHxYnhgO8Q8p6c
+uhuk7g0mF2akoVrP0j2jieqO9yvAFF/HD5pi9SRzoPFJTm3wmI8y0R+fvnvOjvM+
+uaW3iC2KgabOuvN4AfiNKPJW4nhQO2Wu3wuWKUxN0H6xgd8yGy0Azuthcr8+idk1
+iZrPfeTXpBTRXfUCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAasvgyREtD5whbYCt
+ZRbWKgkYnnahYTVmejNurlNAuFj+JAuFFeDa20MVsPqfR0OFrYdmddFQqu9dFJPs
+jmP+aqXnvE+HZPqtyM1uRrLuzM2/yaDFQ7SZAtJDTBllNCjEU/gi0PfruLZ2K2BQ
+i0D1puzuNBL1VcfIBGkJWiE97bCRXOFs71TPgRP4F3+NQ665dUWcakvH/ChXx/x+
+br/c0ppBIKLhJECnvTCLpBiFoxlWBs5gGzKNXItIgbDaOUMQCeYnhXU1tRxIIlap
+vjUNvBKJrHja2se9QXeehplyQgvQdOKloCrBaA+rNS7+cExRW2We7xYo4gc9ocGr
+ll3Kqw==
+-----END CERTIFICATE-----

tests/data/ssl/tests_CA_key.pem

@@ -1,27 +1,27 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEA17HZ8wQMZ8WToogiOwKldDpGy/ucKVn4fuJP/EEwMe1BupVh
-fUcgNgZEClYiLQyaDeGiyuLpM7nAkgwwTBxK6tVK3Itc+kJPgODeIO4pOhh800a2
-4f0MVaHV+eR6eLSBsSH7/JM8h7cUtkIcP4XXZJPXPzyLgtc4bg26jMojZyZBwfF1
-WRhjOScxfggp0/gCeI+AyrT1iZAmNcfrLuU/MNd5S4bxis5K69+XhbZuOG3iYY/p
-hRRCTBnmptFB+uR25AHf6lr7s/pyR3er3WPX4fWREKfhrVLbzHM85p7LpwtD8NFU
-o/0TA9VX0ff9abwF1OvRkyzWzZVC2hybNynfmQIDAQABAoIBAQDMZI2KuqBiyZhQ
-IT6Gusg8rmieLYzappZS7nQrLz7TYOezPpEGXRsJ9sANJ3f1RobJdrKEHagsyu3P
-t9sglILtqzbobOurfqDGGNCFVgodMk0/DDiLR/ajQtt4lOj1bt+jEfgubPukA3qO
-B3GrRFJKzcnf86ikUPv5VescNQR9Xca8qvy0W69SmtkSSZcC55yhWhGwReUDmywH
-tu57eR07t1Jf3RdHwa98VsiEde4TcuA/wo/C3e2A1MZZW0AtqVAVrX8hq+UVAMJ8
-sMubjNqUmDjbOOL4YkLbyR237uC6V6ejmWKEjMXAYUlNnpme1EcoimSL35hCjDVU
-H6MwhBiBAoGBAPNawx7lICj0qYJ3CSP5VMiiD7vTdDmtNPg6KFesZ2XKPALR/Csq
-1WXSEOb4DvFOAuSWjWYPW+0gvV966LkhKXE+cXWf4RmggrpwhT1JPbkcBwbwQ5oo
-aJnNByCcxoTBvJavLkrDBvZzOW2j5lvcD8qfnNYtbNihsExzkxfFm7AxAoGBAOLn
-JJqLwuNK2cyi7F5mkRLhGCdtSglSoht/3xTuqdrQv0JsVjmGTOqZhh6EBeI91auu
-O89KLs2ARN/KKR90ckuf/h6iwsS5/PDjiPTWOcH8LjiocPuvtvoRzq6leoC1XWBm
-vqLZYjPGuZRNibvputUFIVprw38EmppZzcrBuPPpAoGAa1mIZWKRsz9qX0D/aT0d
-p3vGEQcQaDj9+to83aAR5Jc3rc7PvIMiq83k4t5eSRgusoOvUGxKEuq0XyAq9S+p
-xmjTSB4FAHcL9A6a2BQtBDFW8Dqgt6pHqkEFed9uuzVzac1RUG2D7seZd8IrZi5H
-UQzj9J8JOu7ohHEfXAcxzKECgYA9mJ/wMGasi0JK8iOWkONrK54B/gIuO7d0Hady
-qEOF+kshfgV+Qj4ZJaoqGI78VurtWzQzVqET+nE4C0pUlqj8bKdwq6CSBSdsQWiJ
-hqpRReNKUDezq4TRqAnikVuLGzEJHXs8/CRTh+wTHWV5lL66W1UtlbmRfq91nVFn
-bGWIGQKBgE3S/0XsB9Ox+lNyxj5TycmT9VEfn+vvB+PF3ITWLRkcDanK5ynh4Pvt
-2HbwWIShQXGczn4jzWX61AwWE7Lkc1an1yiCQ2/SJItyhWJxVGO0V0BwTK9jmq+r
-1DXQSTgsOtmRknMdgGTk594Nj7S4r4GDYudzAujsbsrPEItw2nRr
+MIIEogIBAAKCAQEA4dt51cMz+Dsq5JRGoE4ejj1L/2UZqtS39g6RMOMqU2Go1Dhi
+sbcC78+UGLi/iwT7gguCutzX38qeP/4Mj+MYjGZ2F5iJNpzKcOh19PgNUtmCEjds
+apJP44bTcoe0HQEyyi8B234KLAM1Tgzw6QznsPTSKMRxKZWtC4QWjKvGbkRYT0T0
+XgdzjlNAoI/SB7xVWTWvNmLXP5iOu+q7+bpPqvSMX5akM1zdmoxA0eR6cxKY11l6
+UIhvDBmHwbfMucg6s4QR/DGE1swUmXW91COpk4OteaMIzfi/RkCMF9vBY5kaE7D6
+QVcV8i/oXjosx9pu6SBYsZTn8k7tu/EKlLfaGQIDAQABAoIBAD3W8gztXZVh3eSo
+FI5f1U3sypoq/FQh2hys8GQKTtR1sNwqdBtkmJFArLP4IbnWq2Z38FtpjFHiEGJF
+FPtwmpAWnc7oHOmvFF7Fx0ZDhKJim5KRSkYDuYv6pnp9XXtzkIx7Qm7um6phVn8A
+XBXzSpzQ65nt724LZU355JKvla0q1bXfj88zS8JX7jsbmC0+nDCZRLcnenKeWtBS
+Kn4mjIZSYNIo45lybJCPn/jyE0ma7U8JTipjNDsVGW7yxb4yVuDIfJDKd0kv72RF
+QrhTeuRTm5189m8YWD+2H0m+RLIxTCDelRP4lO2p9KCnj3Kmz70BngPlznEXynGx
+Uz3eYAECgYEA8U1V4LbUyw9I+qyF47v58ES+RdCnJAk4g18fmFxLz4VZ6QOGxdkP
+RwivpR5zSgpzX5dkQCXoSWhIFAElv7n+hmT7su/xxpTMddcvUEOGA5tLlbwjDOTU
+HNotzgi+0qpG+NocaSuhfSItfUksz4M9Tj6MxgezQFcouhNCLtE27JkCgYEA751O
+wM9xRmAr7ytAyCnhE3x6Tag2e/Ey/6Asy/TXsWH++R9u2+wxbPuaZ05KjUKkJZdK
+EV5O53ZCm4bfmB0BNvHAcsZMo5zcAJ/4CHpFfelnOv3c1QwzBkmg2iM8Oii+PNBs
+4LaOUogfJab35+hrVOJ7cqCyQZZESEu5oXQLSYECgYBjDCCFFecw1rxZEPoAaceF
+RWJo2+XPl+1Xl3Mroi8IJq+qQuVOTvPDb6BRgbdHHBURlt3yqty3TRPRCkuJcHo2
+hjr+zxkKL0fh0ws7wgu/bT5QXyJwB3m9whztJo/Vf0mUmkrxLJSj/aR4edHn9/Hx
+LSGxo7WDYoN4JbGT8BLAeQKBgB+uQ9BYXRi59HUd2eXdK6Yg6ibEW9fNTznfGq0o
+xS/tzgFwN38aXnqTVZndDxxYOE3EEAX12ybdSvc3QO7ivttd4V0LfOyQ+8GVZPzx
+9agtKPnywLTmdQSazYqp5/eklWqDADJB0NV2q++VgOeHolFJ1JqWRptHW+XXJUcE
+ic2BAoGAH+iwDqyAHX92TcH+jzbt91Bil2/tj7s9NaXBaOFlM46mHSMwiYPjaYwf
+2NGJhsFdICV6kA2GiAKyDr8zqwl0lGYwaTpxzKUf1VZaGrKBuNcGuUaQJLkTbK59
+DdHDUNdo8BXPn3qsLbV3aLlXSCp0cirbpJfy7W0pYvLEfrX8lGY=
 -----END RSA PRIVATE KEY-----

tests/data/ssl/tests_CA_key_1.pem

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAxZEGcJEWeSp35CG4kLboJZffgKFN4h6pq3pZHdukPv1r01su
+c5mn2K39/DuzwAz12eBER65fzGA7ml26iFbd/KTSbL+iOtvpdA9kDWF4M6uNiAL7
+SbQgbNcbNoc/ltTQbgFF3FD144eDMYqZXZIvE1wjFUoIVmq3ESV/IsPf9qwHvBxV
+GmBtn9+F1gfFieGA7xDynpy6G6TuDSYXZqShWs/SPaOJ6o73K8AUX8cPmmL1JHOg
+8UlObfCYjzLRH5++e86O8z65pbeILYqBps6683gB+I0o8lbieFA7Za7fC5YpTE3Q
+frGB3zIbLQDO62Fyvz6J2TWJms995NekFNFd9QIDAQABAoIBAQC0GmEkfR9flbd1
+4MfAJP28R5cYS/QUDp/eEsrqzTANvDhvlM/j0k+Q2AyRxFs42JfG5wtXzT7HsXKk
+Zo2FfKshhZ/OQ2RBA/juNJmhGRnbAKklNJKfvfVRQ0crjmAJwDfCEKb/EU8W/JI8
+t3zYMEt5+qSA49x16xK4LtaXerjQxKce7gNU+um22JTR+27g/HATSGG0LFHWmJ6h
+DroOK1Md1KSvZ+Pc3ucfNV65ZueLrVmk9DwKl27Ul7wLe+WqmANjv1wzyLX3nmTL
+B+6JwxdGlnaIw1T0JZV+9RrYMcUqeOgOqRfonVlQF9rDmdTQl1Kjsmxd+LmQEF+x
+4znvh2QBAoGBAPXXR8Z7usgJBWSJxioomiRLfdSz4kelTYshGIv0GABXvEfjrhkk
+Ain/p7QVo95A+xKf2LrXTh25NYvq783cZkVgY1ftE643G/1HN4P5XguUwa1EBMyC
+0gwluys4RMkZOstuXaJk8+xDqDvGx8EFX6X/f+cQ0j7Dj0TO2BVjPnhJAoGBAM27
+DkY1WQDVgV1PejuvzJFct4AbwbBKSBNIjPLZF0AHtIGyEm1TxSPW0pd8KVvp1spx
+n4585bDcMU+twekuqqxFOmaoxPyfMoZ4tkrMoKwJo9UNIy1wxr/z7NhzSmw109B3
+Kb3cob25xKZgpl7A7t0WYbzm8YU3MO9xlLEHrbBNAoGANNbOoISbgr8dn5xVMV6E
+suRe6Ua4jfmjjxHP+tS+C+TPnQv8sX6h0HEYlIZKMEz7KeedZ5s7OPxD3Azk+fQz
+LxomgBF+t2U06N1Tu1PvuMGCV0FVXreHegDqF8ICVs7LakoQagUUwGVSVXbGHGCR
+TFZ8ISfmaIMT2hAzNXWdSbECgYEAyPS+rLXPipEDHDJWI5dFK3h1hh2WxKzKWouz
+okOMAm+EUmuutDvvhWKBspcFj1KLDJSQVo6JjoiHYl1H3I5JCJ1WvpB8Wobmw5OF
+/OqEx4djEOkUQ361pSqPX56+Q5UQocDEdUDefITJIfumh0fOCweh0POFV6rhkgJQ
+S9xEPMECgYEAzevAAJ2PqnEfw5/Nm2ho4gzRXPtk495kEdYHI20ZZF8l/3LUU5xe
+j1dDIFeQTYJiAxmdomZssYqPy90zRTelx+MAhHRlZyaEyLWs/AFaW9m89+T/Fan9
+x4AUeJ5xgyEdQKJ9GlPbWFFG90oK9AKsKgH9J7yZxGn4sTMWzakTmLQ=
+-----END RSA PRIVATE KEY-----