test: renew the expired server certificate, add a podman/docker test-server script

[joelparkerhenderson]

I'm human. During my Rust work, this issue below came up during AI automatic review. The issue report below is by Claude. Happy to explain more if that can help. -Joel

The problem

docker/certs/server.crt expired on 2024-12-20.

$ openssl x509 -in docker/certs/server.crt -noout -dates
notBefore=Jun  3 11:40:33 2024 GMT
notAfter=Dec 20 11:40:33 2024 GMT

Every image built from docker/ since then presents an expired certificate. The server starts fine and reports the certificate loaded successfully, so nothing looks wrong from its side — but the client aborts the handshake, and the entire server-dependent suite fails with:

Error: Tls("connection closed via error")

That reads like a client or configuration bug rather than a stale fixture, which makes it an expensive thing to walk into. It is currently the first thing a new contributor hits when they try to run the tests.

The fix

Regenerated with this repository's own docker/certs/generate-signed-cert.sh, unchanged:

notBefore=Aug 24 08:49:53 2026 GMT
notAfter=Mar 12 08:49:53 2027 GMT

The customCA is untouched and remains valid until 2027-11-14, so only the leaf is renewed and anything already trusting the CA keeps working. openssl verify -CAfile customCA.crt server.crt passes.

The script mints 200-day certificates, so this will lapse again around March 2027. Worth a calendar note, or a CI job that fails when the leaf is within a month of expiry — happy to add the latter here if you want it.

Also: docker/test-server.sh

A small script that brings a server up under podman or docker, since there was no one-liner for this:

./docker/test-server.sh up
export TIBERIUS_TEST_CONNECTION_STRING='server=tcp:localhost,1433;user=SA;password=<YourStrong@Passw0rd>;IntegratedSecurity=true;TrustServerCertificate=true'
cargo test
./docker/test-server.sh down

It picks podman if present, otherwise docker, and both engine and image are overridable (ENGINE=docker IMAGE=mssql-2022 ./docker/test-server.sh up).

Two decisions worth explaining:

• It defaults to azure-sql-edge. The full SQL Server images are x86_64 only, so on arm64 (Apple silicon) they refuse to run or run slowly under emulation. The edge image is the one that works on both, and this repo already had a dockerfile for it.
• It polls the log, not the port. 1433 accepts connections well before the server will answer, so a port check reports ready too early and the first test fails.

docker-compose.yml is left alone — this is additive.

Verification

With the certificate renewed, against a server built by this script:

cargo test --tests --no-default-features \
  --features "tds73,rustls,sql-browser-tokio,chrono,time,rust_decimal"

390 passed, 0 failed

One thing I did not fix

With the renewed certificate the suite passes under --features rustls, but still fails under the default native-tls on macOS with the same Tls("connection closed via error"). The server log shows no complaint, so the rejection is client-side in Security.framework. I did not chase it down and it is out of scope here — but it means a macOS contributor running plain cargo test will still see failures after this PR, and I would rather say so than let it look fixed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e075b9ec-fa4a-4433-991b-3bfc7d9b66ab

📥 Commits

Reviewing files that changed from the base of the PR and between a6b4fcd and 5d8bb45.

⛔ Files ignored due to path filters (1)

• docker/certs/server.pem is excluded by !**/*.pem

📒 Files selected for processing (5)

• docker/certs/customCA.srl
• docker/certs/server-full.crt
• docker/certs/server.crt
• docker/certs/server.key
• docker/test-server.sh

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Summary by CodeRabbit

• New Features

  • Added a utility for starting, stopping, and viewing logs from the SQL Server test container.
  • Supports Docker and Podman, configurable connection settings, readiness checks, and timeout diagnostics.

• Chores

  • Renewed the local server certificates and corresponding private key.
  • Updated certificate serial information for local development and testing.

Walkthrough

The change renews the server certificate chain, private key, and certificate serial metadata. It adds a Bash utility that builds and runs a SQL Server test container through Podman or Docker. The utility supports configurable settings, readiness polling, failure diagnostics, container removal, and log following.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes both primary changes: renewing the expired certificate and adding the Podman/Docker test-server script.
Description check	✅ Passed	The description directly explains the certificate renewal, test-server script, verification results, and remaining native TLS limitation.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}