Renew info about TLS in http api

cmd/acra-server/acra-server.go

@@ -46,6 +46,9 @@ import (
 	"syscall"
 	"time"
 
+	log "github.com/sirupsen/logrus"
+	bolt "go.etcd.io/bbolt"
+
 	"github.com/cossacklabs/acra/cmd"
 	"github.com/cossacklabs/acra/cmd/acra-server/common"
 	"github.com/cossacklabs/acra/crypto"
@@ -67,8 +70,6 @@ import (
 	"github.com/cossacklabs/acra/pseudonymization/storage"
 	"github.com/cossacklabs/acra/sqlparser"
 	"github.com/cossacklabs/acra/utils"
-	log "github.com/sirupsen/logrus"
-	bolt "go.etcd.io/bbolt"
 )
 
 var restartSignalsChannel chan os.Signal
@@ -141,7 +142,7 @@ func realMain() error {
 	scriptOnPoison := flag.String("poison_run_script_file", "", "On detecting poison record: log about poison record detection, execute script, return decrypted data")
 
 	enableHTTPAPI := flag.Bool("http_api_enable", false, "Enable HTTP API. Use together with --http_api_tls_transport_enable whenever possible.")
-	httpAPIUseTLS := flag.Bool("http_api_tls_transport_enable", false, "Enable HTTPS support for the API. Use together with the --http_api_enable. TLS configuration is the same as in the Acra Proxy.")
+	httpAPIUseTLS := flag.Bool("http_api_tls_transport_enable", false, "Enable HTTPS support for the API. Use together with the --http_api_enable. TLS configuration is the same as in the Acra Proxy. Starting from 0.96.0 the flag value will be true by default.")
 
 	network.RegisterTLSBaseArgs(flag.CommandLine)
 	network.RegisterTLSArgsForService(flag.CommandLine, false, "", network.ClientNameConstructorFunc())

configs/acra-server.yaml

@@ -95,7 +95,7 @@ generate_markdown_args_table: false
 # Enable HTTP API. Use together with --http_api_tls_transport_enable whenever possible.
 http_api_enable: false
 
-# Enable HTTPS support for the API. Use together with the --http_api_enable. TLS configuration is the same as in the Acra Proxy.
+# Enable HTTPS support for the API. Use together with the --http_api_enable. TLS configuration is the same as in the Acra Proxy. Starting from 0.96.0 the flag value will be true by default.
 http_api_tls_transport_enable: false
 
 # Port for AcraServer for HTTP API

tests/test.py

@@ -657,7 +657,11 @@ def test_clearing(self):
         # execute any query for loading key by acra
         result = self.engine1.execute(sa.select([1]).limit(1))
         result.fetchone()
-        with urlopen('http://localhost:{}/resetKeyStorage'.format(self.ACRASERVER_PORT + 1)) as response:
+
+        ssl_context = ssl.create_default_context(cafile=base.TEST_TLS_CA)
+        ssl_context.load_cert_chain(base.TEST_TLS_CLIENT_CERT, base.TEST_TLS_CLIENT_KEY)
+        ssl_context.check_hostname = True
+        with urlopen('https://localhost:{}/resetKeyStorage'.format(self.ACRASERVER_PORT + 1), context=ssl_context) as response:
             self.assertEqual(response.status, 200)
 
 

tests/test_common.py

@@ -261,6 +261,7 @@ def get_acra_cli_args(self, acra_kwargs):
             'acrastruct_injectedcell_enable': 'false' if self.WHOLECELL_MODE else 'true',
             'd': 'true' if self.DEBUG_LOG else 'false',
             'http_api_enable': 'true',
+            'http_api_tls_transport_enable': 'true',
             'keystore_cache_on_start_enable': 'false',
             'keys_dir': base.KEYS_FOLDER.name,
         }