add e2e test workflow on pr

.github/workflows/pr.yaml

@@ -3,6 +3,32 @@ name: Lint and Test Charts
 on: pull_request
 
 jobs:
+  e2e-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      
+      - name: Run It
+        run: |
+          sudo rm $(which kubectl)
+          sudo RUN_IN_CI=1 TLS_CERT=test/localhost.crt TLS_KEY=test/localhost.key ./deploy_jitsi.sh localhost test@localhost.local
+      
+      - name: Wait for pods
+        run: |
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/name=prosody --for condition=Ready --timeout=90s
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/component=web --for condition=Ready --timeout=90s
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/component=jicofo --for condition=Ready --timeout=180s
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/component=etherpad --for condition=Ready --timeout=180s
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/component=jvb --for condition=Ready --timeout=300s
+
+      - name: Check homepage
+        run: |
+          curl -vIL --cacert test/rootca.crt https://localhost
+
+      - name: Tear down
+        run: sudo /usr/local/bin/k3s-uninstall.sh
+
   lint-test:
     runs-on: ubuntu-latest
     steps:

deploy_jitsi.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 function err {
-    echo $1 1>&2
+    echo -e $1 1>&2
     exit 1
 }
 
@@ -29,7 +29,7 @@ if [[ "${FQDN}" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
     err "both of 'TLS_CERT' and 'TLS_KEY' envvars should be specified when deploying without domain name"
   fi
 else
-  export PUBLIC_IP=$(nslookup ${FQDN} | grep -A1 Name: | grep Address: | cut -d' ' -f2)
+  export PUBLIC_IP=$(nslookup ${FQDN} | grep -A1 Name: | grep Address: | cut -d' ' -f2 | grep -v ':' | head -1)
 fi
 
 if [ -z "${PUBLIC_IP}" ]; then
@@ -38,8 +38,8 @@ else
   echo "resolved hostname '${1}' to ip address ${PUBLIC_IP}"
 fi
 
-if ! (curl -s https://ipinfo.io/ip | grep -q ${PUBLIC_IP}); then
-  err "the host doesn't have such public ip: ${PUBLIC_IP}"
+if [ ${FQDN} != "localhost" ] && ! (curl -s https://ipinfo.io/ip | grep -q ${PUBLIC_IP}); then
+  err "the host doesn't have such public ip: ${PUBLIC_IP}, but these: \n$(curl -s https://ipinfo.io/ip)"
 fi
 
 if [ -n "${TEST_INSTALL}" ]; then
@@ -61,24 +61,30 @@ DEPLOY_GIT_REPO=${DEPLOY_GIT_REPO:-"https://github.com/shanghailug/jitsi-deploy.
 
 # workspace
 WS_DIR=${HOME}/deploy/$(date +"%Y%m%d_%H%M%S")
-SRC_DIR=${WS_DIR}/jitsi-deploy
+if [ -n "${RUN_IN_CI}" ]; then
+  SRC_DIR=${PWD}
+else
+  SRC_DIR=${WS_DIR}/jitsi-deploy
+fi
 mkdir -p ${WS_DIR}
 
 function get_helm {
   if ! which helm || ! ( helm version | grep -q ${HELM_VERSION} ); then
     cd ${WS_DIR}/
-    wget https://get.helm.sh/${HELM_ARCHIVE}
+    wget -nv https://get.helm.sh/${HELM_ARCHIVE}
     tar -zxvf ${HELM_ARCHIVE}
     mv $(find -type f -name helm) /usr/local/bin/
   fi
 }
 
 function get_src {
-  cd ${WS_DIR}/
-  git clone ${DEPLOY_GIT_REPO}
-  cd $SRC_DIR/
-  if [ -n "${DEPLOY_GIT_VERSION}" ]; then
-    git checkout ${DEPLOY_GIT_VERSION}
+  if [ -z "${RUN_IN_CI}" ]; then
+    cd ${WS_DIR}/
+    git clone ${DEPLOY_GIT_REPO}
+    cd $SRC_DIR/
+    if [ -n "${DEPLOY_GIT_VERSION}" ]; then
+      git checkout ${DEPLOY_GIT_VERSION}
+    fi
   fi
 }
 
@@ -110,7 +116,7 @@ function do_k3s {
 function get_argocd {
   if ! which argocd || ! (argocd -n argocd version --client | grep ^argocd: | grep -q ${ARGOCD_VERSION}); then
     cd ${WS_DIR}/
-    wget https://github.com/argoproj/argo-cd/releases/download/${ARGOCD_VERSION}/argocd-linux-amd64
+    wget -nv https://github.com/argoproj/argo-cd/releases/download/${ARGOCD_VERSION}/argocd-linux-amd64
     chmod a+x argocd-linux-amd64
     mv argocd-linux-amd64 /usr/local/bin/argocd
   fi

test/domains.ext

@@ -0,0 +1,6 @@
+authorityKeyIdentifier=keyid,issuer
+basicConstraints=CA:FALSE
+keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = localhost

test/localhost.crt

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDbDCCAlSgAwIBAgIUcc7tSYM5y/4KVnGR8OWlEcau374wDQYJKoZIhvcNAQEL
+BQAwJDELMAkGA1UEBhMCQ04xFTATBgNVBAMMDFRlc3QtUm9vdC1DQTAeFw0yMjA1
+MjkxMDE2NTRaFw0zMjA1MjgxMDE2NTRaMGkxCzAJBgNVBAYTAkNOMREwDwYDVQQI
+DAhTaGFuZ2hhaTERMA8GA1UEBwwIU2hhbmdoYWkxGjAYBgNVBAoMEVRlc3QtQ2Vy
+dGlmaWNhdGVzMRgwFgYDVQQDDA9sb2NhbGhvc3QubG9jYWwwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDENvP4g4VFHetaQh+VgadakrwWQZl2zv0pK4a8
+MIbJZjFWm1BSNBMt6gyEXTAbxNtHRmEMX09u4CJs3uPlHP4l/qGjvMCnBwX4FWK9
+zHc7/nfhfUY/IugYp+yPDW9zUeZvNPgVg2SGbJVVoaQacVDyRGULGz4KYkjmiEtL
+HHBbSGnjOPccuxFDOLddq5GXyo2K5eL99m/HRZS3WG6tHdJgujVEjLTFLRsOmoTI
+hheWbL0wKSKEyRr358wLYklfmFopKJf96RKzTYAcG4S48HEnE8utICS7vdpQkFvg
+PGfWhmm6tF4p32EBY9RHIhIruQl5a3R64GgkVh/XB3BQwoQ5AgMBAAGjUTBPMB8G
+A1UdIwQYMBaAFMLiGgOohW2V366tFw8by/ljyocUMAkGA1UdEwQCMAAwCwYDVR0P
+BAQDAgTwMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAQEA
+4oZZZaNCFt80IISTVnJqARox62r/xq4cjYk8fGa5UdjetA3uKPJ7mAfAMGalaCjy
+4OcWcFhCYuJMZofWHFBmo51M0Po0F/sWGpnqzS4v0Bd8dSGw8LgX2H2Iz+Kbv8IB
+p3G5dNWaTxqu8Wx2K4Uu5dbmrQ6fwW+/o/ES/x5VYuKukPCSGVL1UA/k8T1NtnCy
+mcEHFL83A3ZQRxpctUpQVYveF5CQCCVarxfSCw+z5rU6JUfKdJ7UshYjYqcTCUtc
+dH5eZB28vr8vPp/qKvZ6lfa4BzO/O56CfcQhMHeVFlLin0vLdcQSjdEQXiWPkx9Y
+taQng1IMk10ELix76aHTog==
+-----END CERTIFICATE-----

test/localhost.csr

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICrjCCAZYCAQAwaTELMAkGA1UEBhMCQ04xETAPBgNVBAgMCFNoYW5naGFpMREw
+DwYDVQQHDAhTaGFuZ2hhaTEaMBgGA1UECgwRVGVzdC1DZXJ0aWZpY2F0ZXMxGDAW
+BgNVBAMMD2xvY2FsaG9zdC5sb2NhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBAMQ28/iDhUUd61pCH5WBp1qSvBZBmXbO/SkrhrwwhslmMVabUFI0Ey3q
+DIRdMBvE20dGYQxfT27gImze4+Uc/iX+oaO8wKcHBfgVYr3Mdzv+d+F9Rj8i6Bin
+7I8Nb3NR5m80+BWDZIZslVWhpBpxUPJEZQsbPgpiSOaIS0sccFtIaeM49xy7EUM4
+t12rkZfKjYrl4v32b8dFlLdYbq0d0mC6NUSMtMUtGw6ahMiGF5ZsvTApIoTJGvfn
+zAtiSV+YWikol/3pErNNgBwbhLjwcScTy60gJLu92lCQW+A8Z9aGabq0XinfYQFj
+1EciEiu5CXlrdHrgaCRWH9cHcFDChDkCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IB
+AQC7WRAd2iYn0F9h/ebQ4FZ4hhguzMDya79xe9rKCbGkYqYoYwY2Msg9E1Rikr19
+KI5Spm3vFVe51BKTdysxfYckBQ1h5yfO/rjh7Id7bAoJlNb9zjOFAt3YvtIgLA5W
+GDKZ/36jIY9SNDWVmWU4gC1Zqvowtd1kT91CqH9Kbs4VhiORwj2+2Q7xQZDZwrW1
+oLLelVVF2VjZ6pWqCamoO8i9tkIfNtpvZCYdnG8J54tPIap18G2AgC/3Val5MWfp
+jXGBDNy+l6EldOmEhzm6NYN+aOP2prhrMD9QKZiO5uWJq6IdBCtnVf0vOj484Osk
+twKkfxAAUpPLhiDx2znRvAGt
+-----END CERTIFICATE REQUEST-----

test/localhost.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDENvP4g4VFHeta
+Qh+VgadakrwWQZl2zv0pK4a8MIbJZjFWm1BSNBMt6gyEXTAbxNtHRmEMX09u4CJs
+3uPlHP4l/qGjvMCnBwX4FWK9zHc7/nfhfUY/IugYp+yPDW9zUeZvNPgVg2SGbJVV
+oaQacVDyRGULGz4KYkjmiEtLHHBbSGnjOPccuxFDOLddq5GXyo2K5eL99m/HRZS3
+WG6tHdJgujVEjLTFLRsOmoTIhheWbL0wKSKEyRr358wLYklfmFopKJf96RKzTYAc
+G4S48HEnE8utICS7vdpQkFvgPGfWhmm6tF4p32EBY9RHIhIruQl5a3R64GgkVh/X
+B3BQwoQ5AgMBAAECggEBAKnClbAUMjCLYz1y6hqS0zUUsPBcjybwjK2a//Y/0c3b
+waIZvBNzBIj77xpx+ZZ86e6voHVw3Kuj9YTWDrwCKoy60iR0wQWBmRN7hTOK/DoG
+vrdziFxFmiMC3jMiP6O5XzIl1OHgDRAUT9uHfxB1q7//lqBWUIXxZPs3PlVc5ITE
+DR7kScGq/E+14qlQ07NXSXZ94nRAVII2oa/NpafE112IL54mHbtApme/Shg2KEeM
+IE8c0hhIxbTCbpkfBAbEaSRMIT76ACsyCGNm7uMwXl1wCIpAlKuoEB5GyJjhuFgU
++R7UEdVZDSeOn0SCNB+T8QMzHHlLzXP/17i+SXJFAVECgYEA5EoXjfIQYrba+yYV
+TJ9IwumBsXT2IXUqYfrLaUTnl29xwfa79EjfUGmJGoLstTlLboXGI6aj5d1dyrfZ
+RuRNO/y2MMf7TmP/xiZJFYYvIqPnYgeAN1FlikjpgzLstNpZegrG1hP6kjsUJgZV
+sBqitOdhv4JnPPuv+BFJmpkDWzUCgYEA3Agp9GEwoVyTLlpq1f0qnAYlAxbzc/x2
+Vi5eynaJEJGBdaL8ZekGlqUPdNR6FtN9vwk/uWH+sf4k6QGp3TGmE2ARtHE3rN86
+o6VFIBeJvmI9a6MCkc1heXGSb19qA/vEi8zaojmX/R4St3Qz+ZDKjKZIP7rkp/4S
+dK+RmxyYIXUCgYB5/pYjxq228tyGxc0wCxbJAhvKhyRYsNIbVfiJosbYCDgUXRQH
+8UFVKXCY+EoidiG3SEmgF5cSaX+Lqz+zQKF9YwjBfLzxIUM30pHPrMtXiZtGqZd8
++ER454nSEM6pvt19+HBVSovmxSd5Qn1cBH/aiKOVwcwFrMJWoHZi5U4D2QKBgChv
+p6Ytpk5BQRsnqrKg0A/UYUDsGtmZ7/VumCUFG7NbyjrgNRpVdMyCkRCba8R+IYHW
+JUvgYno7hnT7xUfNNAQjh51toRm3/ILOgKGhMcM3MqpxTquU3vD+mja1hjotLrWy
+dAuUIgZ2XGIyjMq0fUTT2js8EYF+A85F5bBn1N1xAoGBAJ7gwV6knxm3ks25C+Jx
+8Le8hzvhM2Vm6O5+fQh8m09m5RfBpfxDgObGZITD61JckfVyShP6OmotLX5Kw3kP
+jTkep0CuICpKYDy34c+8bzNCPtm8obwaR4UwHGLT7ukt1YBnL9Tz2bizKRYA9dCM
+mPgSq9VdqPkbNdoptdlPjhzL
+-----END PRIVATE KEY-----

test/rootca.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDKTCCAhGgAwIBAgIUQf/FpPggQl+eoZw7T+HIF4x6yqUwDQYJKoZIhvcNAQEL
+BQAwJDELMAkGA1UEBhMCQ04xFTATBgNVBAMMDFRlc3QtUm9vdC1DQTAeFw0yMjA1
+MjkxMDE2MDZaFw0zMjA1MjkxMDE2MDZaMCQxCzAJBgNVBAYTAkNOMRUwEwYDVQQD
+DAxUZXN0LVJvb3QtQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD1
+hppTIv/OLBhZMmzx34SJp3vme9vtTWgd5s5yFua2dUonM6880zac2uLSwU5eJaNr
+EFVsHG+1axEMrZG+EE6BQwgL3O6uOxwm6NhWN5IFEI8INTRZvXgkfX2nMcz/4mPe
+rPV4wfC/M37HWLLWhwhbIdr455DzdJ4dj16oeVksMyq0ogZVnOJNmPA6RgmCxp1C
++etvgGsqM30POgnRxrCNMcl9m9/zw5n1qYJ1NVHJUSxzaEZydeTWxEpQTj5myS9P
+59VHn36Qpb9Pmvd1RuO/MbxLCTpL9azA1dvnuMkK39gYwRw5Y8UWlBgDCI2yfiDW
+ayC/EkyuNCLYYDkySRQPAgMBAAGjUzBRMB0GA1UdDgQWBBTC4hoDqIVtld+urRcP
+G8v5Y8qHFDAfBgNVHSMEGDAWgBTC4hoDqIVtld+urRcPG8v5Y8qHFDAPBgNVHRMB
+Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQADjLM6wUKR2Ucd+QY6TjkwdXEV
+0cMKhdXLeibo27XBgWnj+HZaKCNxfgP6tmLh6EBfyLsSf83zgcS8SEiep9NPw67F
+98qHkU9vJWQfrcH9kCSfCRmGrEwMW56IE8rplbQpOBx/n9YLPGRwqN5RRUnG3rhl
+ukAZKm54Vt3pMNuQAPyirXQhaQ5G9jlss73nov/UOi7J2TTklPaJnmccldbFzwVU
+EqUneOPhW5/eu25wMI7TL4VaOKCY97vOHAdORAeHnP2Z1UrqmTWBqxc6gsCUmdMI
+DoCzO9p/u4UKiaen++u4qrgC8IBwfisuKS0exhL3hKXjUscllevzCwYlCVd7
+-----END CERTIFICATE-----

test/rootca.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQD1hppTIv/OLBhZ
+Mmzx34SJp3vme9vtTWgd5s5yFua2dUonM6880zac2uLSwU5eJaNrEFVsHG+1axEM
+rZG+EE6BQwgL3O6uOxwm6NhWN5IFEI8INTRZvXgkfX2nMcz/4mPerPV4wfC/M37H
+WLLWhwhbIdr455DzdJ4dj16oeVksMyq0ogZVnOJNmPA6RgmCxp1C+etvgGsqM30P
+OgnRxrCNMcl9m9/zw5n1qYJ1NVHJUSxzaEZydeTWxEpQTj5myS9P59VHn36Qpb9P
+mvd1RuO/MbxLCTpL9azA1dvnuMkK39gYwRw5Y8UWlBgDCI2yfiDWayC/EkyuNCLY
+YDkySRQPAgMBAAECggEBAKBJ1LxL0BaoQOkSe39Yfe1kEwZAfC6q5zsGMGbZPpuF
+bPi0zEV4WmICoCwZGPFrvwkpa6sd0Wvtzv6o3cnoWWgX+8vK22ORoWphfsKimsiF
+q+se2ONxR1sDNiIN6BhxkuOPpN3GN0aL9strw608EJ92Nb9jZgUacBM6QwDX3/hy
+05ppA93N7uZMXSH3M3bfeNzWNaKCI/QhMRkUAQoqDYyufFWBSiftSRP+ymfrYqcp
+stL/VR1qVOete2j+3q/M9X1B4JrrYP1Q+Mqs8R7kBIkSgi77shZnsyAuQ8R00/0x
+Z2kodB5MJBvIDE2sR5u+mom3SFvj5wrQKEfiV/OSPrkCgYEA/1InDpb8s3MYa4tg
+BZixz/rymIjNZI0CgoZ66zShhnLveiYOdDCJZfqwG1oPAeW1GH7DcP7vjBk9h2CO
+65Jh0vSLGodbVf5SCXbnGrlwlq7BV2/5swlY7vfjpM2GLk1Q58BIlrolctldVA7b
++aFcihpq82Zv+Dqx+s1AycQPQGsCgYEA9i3H4f1z4jd4eVlBinZ4ZCm9fFyjur+y
+XlFbiX0JpHuVuwBgX7kC05wmZsvxTTkj7mZNwCnwLeAK2Dj9EXaFL7IJH8tFExGt
+kw+jSI/K3TvcP9JLsnKkcFYiXTA5mjUzPttBwns9LpWfsJ+C7eCwM5r6tr38Rdjw
+G17PF1HHk+0CgYEAylRxDRfL0+1OmdMOWgECT/3fB8/JbHhuV794YzIHGsO0UUkd
+RSg9ieoaauJ4aBl/5JR4DvCIJq7N2p1DRR1wljsijPhdAg2TN1rZk40G0vJT1xWu
+fBnZNy6MYMpaHhE5Hx56p6+GA7iLRBSub+lWqz56KL6x1rW02zqSsBHFwFcCgYBi
+YN02FKFQz7YXWHH2sW1fKccNgb/0i1Lumjiocw19a93kQzxARKE6i3ZVMj8WCzWu
+ubdsidXvn072JaAMcH69FrrKt+K8wh3JXUB1aPE7BAb6gkG56FKKigFlmDYMyCHY
+hqp62+ERUr3kSXp7MYV4ugBjMv0ztIQPjA3aVdYZ6QKBgQDlDqbFEHpxXO4/bycR
+kflfv2TDmxxb11cn6NnuRZjEY2EhYXBRN/OXRYjpUEiBqte9EsyPQCwVPh78BpIb
+C9md4GsZNJpuvHXhFQxwAyorGOoXvfTehROcIKz7B/9ec2ksQG18E60q1+xNAXF+
+wnXl7pICKzczQFGd/EzJwvFARQ==
+-----END PRIVATE KEY-----

test/rootca.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDKTCCAhGgAwIBAgIUQf/FpPggQl+eoZw7T+HIF4x6yqUwDQYJKoZIhvcNAQEL
+BQAwJDELMAkGA1UEBhMCQ04xFTATBgNVBAMMDFRlc3QtUm9vdC1DQTAeFw0yMjA1
+MjkxMDE2MDZaFw0zMjA1MjkxMDE2MDZaMCQxCzAJBgNVBAYTAkNOMRUwEwYDVQQD
+DAxUZXN0LVJvb3QtQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD1
+hppTIv/OLBhZMmzx34SJp3vme9vtTWgd5s5yFua2dUonM6880zac2uLSwU5eJaNr
+EFVsHG+1axEMrZG+EE6BQwgL3O6uOxwm6NhWN5IFEI8INTRZvXgkfX2nMcz/4mPe
+rPV4wfC/M37HWLLWhwhbIdr455DzdJ4dj16oeVksMyq0ogZVnOJNmPA6RgmCxp1C
++etvgGsqM30POgnRxrCNMcl9m9/zw5n1qYJ1NVHJUSxzaEZydeTWxEpQTj5myS9P
+59VHn36Qpb9Pmvd1RuO/MbxLCTpL9azA1dvnuMkK39gYwRw5Y8UWlBgDCI2yfiDW
+ayC/EkyuNCLYYDkySRQPAgMBAAGjUzBRMB0GA1UdDgQWBBTC4hoDqIVtld+urRcP
+G8v5Y8qHFDAfBgNVHSMEGDAWgBTC4hoDqIVtld+urRcPG8v5Y8qHFDAPBgNVHRMB
+Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQADjLM6wUKR2Ucd+QY6TjkwdXEV
+0cMKhdXLeibo27XBgWnj+HZaKCNxfgP6tmLh6EBfyLsSf83zgcS8SEiep9NPw67F
+98qHkU9vJWQfrcH9kCSfCRmGrEwMW56IE8rplbQpOBx/n9YLPGRwqN5RRUnG3rhl
+ukAZKm54Vt3pMNuQAPyirXQhaQ5G9jlss73nov/UOi7J2TTklPaJnmccldbFzwVU
+EqUneOPhW5/eu25wMI7TL4VaOKCY97vOHAdORAeHnP2Z1UrqmTWBqxc6gsCUmdMI
+DoCzO9p/u4UKiaen++u4qrgC8IBwfisuKS0exhL3hKXjUscllevzCwYlCVd7
+-----END CERTIFICATE-----

test/rootca.srl

@@ -0,0 +1 @@
+71CEED498339CBFE0A567191F0E5A511C6AEDFBE

test/steps.txt

@@ -0,0 +1,15 @@
+
+openssl req -x509 -nodes -new -sha256 -days 3653 -newkey rsa:2048 -keyout rootca.key -out rootca.pem -subj "/C=CN/CN=Test-Root-CA"
+openssl x509 -outform pem -in rootca.pem -out rootca.crt
+
+cat > domains.ext <<EOF
+authorityKeyIdentifier=keyid,issuer
+basicConstraints=CA:FALSE
+keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = localhost
+EOF
+
+openssl req -new -nodes -newkey rsa:2048 -keyout localhost.key -out localhost.csr -subj "/C=CN/ST=Shanghai/L=Shanghai/O=Test-Certificates/CN=localhost.local"
+openssl x509 -req -sha256 -days 3652 -in localhost.csr -CA rootca.pem -CAkey rootca.key -CAcreateserial -extfile domains.ext -out localhost.crt