Split off tests for validate, simplifying HTTP-01 and TLS-SNI-01 tests.

acme/client.go

@@ -99,8 +99,8 @@ func NewClient(caDirURL string, user User, keyBits int, optPort string) (*Client
 	// Add all available solvers with the right index as per ACME
 	// spec to this map. Otherwise they won`t be found.
 	solvers := make(map[string]solver)
-	solvers["http-01"] = &httpChallenge{jws: jws, optPort: optPort}
+	solvers["http-01"] = &httpChallenge{jws: jws, validate: validate, optPort: optPort}
-	solvers["tls-sni-01"] = &tlsSNIChallenge{jws: jws, optPort: optPort}
+	solvers["tls-sni-01"] = &tlsSNIChallenge{jws: jws, validate: validate, optPort: optPort}
 
 	return &Client{directory: dir, user: user, jws: jws, keyBits: keyBits, solvers: solvers}, nil
 }
@@ -671,6 +671,11 @@ func parseLinks(links []string) map[string]string {
 	return linkMap
 }
 
+var (
+	pollInterval    = 1 * time.Second
+	maxPollInterval = 15 * time.Minute
+)
+
 // validate makes the ACME server start validating a
 // challenge response, only returning once it is done.
 func validate(j *jws, uri string, chlng challenge) error {
@@ -680,8 +685,7 @@ func validate(j *jws, uri string, chlng challenge) error {
 		return err
 	}
 
-	interval := 1 * time.Second
+	delay := pollInterval
-	maxInterval := 15 * time.Minute
 
 	// After the path is sent, the ACME server will access our server.
 	// Repeatedly check the server for an updated status on our request.
@@ -699,10 +703,10 @@ func validate(j *jws, uri string, chlng challenge) error {
 		}
 
 		// Poll with exponential back-off.
-		time.Sleep(interval)
+		time.Sleep(delay)
-		interval *= 2
+		delay *= 2
-		if interval > maxInterval {
+		if delay > maxPollInterval {
-			interval = maxInterval
+			delay = maxPollInterval
 		}
 
 		if err := getJSON(uri, &challengeResponse); err != nil {

acme/client_test.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 )
 
@@ -59,6 +60,77 @@ func TestNewClient(t *testing.T) {
 	}
 }
 
+func TestValidate(t *testing.T) {
+	// Disable polling delay in validate for faster tests.
+	pollInterval = 0
+
+	var statuses []string
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Minimal stub ACME server for validation.
+		w.Header().Add("Replay-Nonce", "12345")
+		switch r.Method {
+		case "HEAD":
+		case "POST":
+			st := statuses[0]
+			statuses = statuses[1:]
+			writeJSONResponse(w, &challenge{Type: "http-01", Status: st, URI: "http://example.com/", Token: "token"})
+
+		case "GET":
+			st := statuses[0]
+			statuses = statuses[1:]
+			writeJSONResponse(w, &challenge{Type: "http-01", Status: st, URI: "http://example.com/", Token: "token"})
+
+		default:
+			http.Error(w, r.Method, http.StatusMethodNotAllowed)
+		}
+	}))
+	defer ts.Close()
+
+	privKey, _ := generatePrivateKey(rsakey, 512)
+	j := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
+
+	tsts := []struct {
+		name     string
+		statuses []string
+		want     string
+	}{
+		{"POST-unexpected", []string{"weird"}, "unexpected"},
+		{"POST-valid", []string{"valid"}, ""},
+		{"POST-invalid", []string{"invalid"}, "not validate"},
+		{"GET-unexpected", []string{"pending", "weird"}, "unexpected"},
+		{"GET-valid", []string{"pending", "valid"}, ""},
+		{"GET-invalid", []string{"pending", "invalid"}, "not validate"},
+	}
+
+	for _, tst := range tsts {
+		statuses = tst.statuses
+		if err := validate(j, ts.URL, challenge{Type: "http-01", Token: "token"}); err == nil && tst.want != "" {
+			t.Errorf("[%s] validate: got error %v, want something with %q", tst.name, err, tst.want)
+		} else if err != nil && !strings.Contains(err.Error(), tst.want) {
+			t.Errorf("[%s] validate: got error %v, want something with %q", tst.name, err, tst.want)
+		}
+	}
+}
+
+// writeJSONResponse marshals the body as JSON and writes it to the response.
+func writeJSONResponse(w http.ResponseWriter, body interface{}) {
+	bs, err := json.Marshal(body)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	if _, err := w.Write(bs); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+	}
+}
+
+// stubValidate is like validate, except it does nothing.
+func stubValidate(j *jws, uri string, chlng challenge) error {
+	return nil
+}
+
 type mockUser struct {
 	email      string
 	regres     *RegistrationResource

acme/http_challenge.go

@@ -9,6 +9,7 @@ import (
 
 type httpChallenge struct {
 	jws      *jws
+	validate func(j *jws, uri string, chlng challenge) error
 	optPort  string
 }
 
@@ -56,5 +57,5 @@ func (s *httpChallenge) Solve(chlng challenge, domain string) error {
 
 	go http.Serve(listener, mux)
 
-	return validate(s.jws, chlng.URI, challenge{Resource: "challenge", Type: chlng.Type, Token: chlng.Token, KeyAuthorization: keyAuth})
+	return s.validate(s.jws, chlng.URI, challenge{Resource: "challenge", Type: chlng.Type, Token: chlng.Token, KeyAuthorization: keyAuth})
 }

acme/http_challenge_test.go

@@ -2,263 +2,56 @@ package acme
 
 import (
 	"crypto/rsa"
-	"crypto/tls"
-	"encoding/json"
 	"io/ioutil"
 	"net/http"
-	"net/http/httptest"
-	"regexp"
 	"strings"
 	"testing"
-
-	"github.com/square/go-jose"
 )
 
-func TestHTTPNonRootBind(t *testing.T) {
+func TestHTTPChallenge(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 128)
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey)}
-
-	solver := &httpChallenge{jws: jws}
-	clientChallenge := challenge{Type: "http01", Status: "pending", URI: "localhost:4000", Token: "http1"}
-
-	// validate error on non-root bind to 80
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("BIND: Expected Solve to return an error but the error was nil.")
-	} else {
-		expectedError := "Could not start HTTP server for challenge -> listen tcp :80: bind: permission denied"
-		if err.Error() != expectedError {
-			t.Errorf("Expected error \"%s\" but instead got \"%s\"", expectedError, err.Error())
-		}
-	}
-}
-
-func TestHTTPShortRSA(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 128)
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), nonces: []string{"test1", "test2"}}
-
-	solver := &httpChallenge{jws: jws, optPort: "23456"}
-	clientChallenge := challenge{Type: "http01", Status: "pending", URI: "http://localhost:4000", Token: "http2"}
-
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
-	} else {
-		expectedError := "Failed to post JWS message. -> crypto/rsa: message too long for RSA public key size"
-		if err.Error() != expectedError {
-			t.Errorf("Expected error %s but instead got %s", expectedError, err.Error())
-		}
-	}
-}
-
-func TestHTTPConnectionRefusal(t *testing.T) {
 	privKey, _ := generatePrivateKey(rsakey, 512)
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), nonces: []string{"test1", "test2"}}
+	j := &jws{privKey: privKey.(*rsa.PrivateKey)}
-
+	clientChallenge := challenge{Type: "http-01", Token: "http1"}
-	solver := &httpChallenge{jws: jws, optPort: "23456"}
+	mockValidate := func(_ *jws, _ string, chlng challenge) error {
-	clientChallenge := challenge{Type: "http01", Status: "pending", URI: "http://localhost:4000", Token: "http3"}
+		uri := "http://localhost:23457/.well-known/acme-challenge/" + chlng.Token
-
+		resp, err := http.Get(uri)
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
-	} else {
-		reg := "/Failed to post JWS message\\. -> Post http:\\/\\/localhost:4000: dial tcp 127\\.0\\.0\\.1:4000: (getsockopt: )?connection refused/g"
-		test2 := "Failed to post JWS message. -> Post http://localhost:4000: dial tcp 127.0.0.1:4000: connection refused"
-		r, _ := regexp.Compile(reg)
-		if r.MatchString(err.Error()) && r.MatchString(test2) {
-			t.Errorf("Expected \"%s\" to match %s", err.Error(), reg)
-		}
-	}
-}
-
-func TestHTTPUnexpectedServerState(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 512)
-
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Add("Replay-Nonce", "12345")
-		w.Write([]byte("{\"type\":\"http01\",\"status\":\"what\",\"uri\":\"http://some.url\",\"token\":\"http4\"}"))
-	}))
-
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
-	solver := &httpChallenge{jws: jws, optPort: "23456"}
-	clientChallenge := challenge{Type: "http01", Status: "pending", URI: ts.URL, Token: "http4"}
-
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
-	} else {
-		expectedError := "The server returned an unexpected state."
-		if err.Error() != expectedError {
-			t.Errorf("Expected error %s but instead got %s", expectedError, err.Error())
-		}
-	}
-}
-
-func TestHTTPChallengeServerUnexpectedDomain(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 512)
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey)}
-
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "POST" {
-			tr := &http.Transport{
-				TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-			}
-			client := &http.Client{Transport: tr}
-			req, _ := client.Get("https://localhost:23456/.well-known/acme-challenge/" + "htto5")
-			reqBytes, _ := ioutil.ReadAll(req.Body)
-			if string(reqBytes) != "TEST" {
-				t.Error("Expected http01 server to return string TEST on unexpected domain.")
-			}
-		}
-
-		w.Header().Add("Replay-Nonce", "12345")
-		w.Write([]byte("{\"type\":\"http01\",\"status\":\"invalid\",\"uri\":\"http://some.url\",\"token\":\"http5\"}"))
-	}))
-
-	solver := &httpChallenge{jws: jws, optPort: "23456"}
-	clientChallenge := challenge{Type: "http01", Status: "pending", URI: ts.URL, Token: "http5"}
-
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
-	}
-}
-
-func TestHTTPServerError(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 512)
-
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "HEAD" {
-			w.Header().Add("Replay-Nonce", "12345")
-		} else {
-			w.WriteHeader(http.StatusInternalServerError)
-			w.Header().Add("Replay-Nonce", "12345")
-			w.Write([]byte("{\"type\":\"urn:acme:error:unauthorized\",\"detail\":\"Error creating new authz :: Syntax error\"}"))
-		}
-	}))
-
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
-	solver := &httpChallenge{jws: jws, optPort: "23456"}
-	clientChallenge := challenge{Type: "http01", Status: "pending", URI: ts.URL, Token: "http6"}
-
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
-	} else {
-		expectedError := "acme: Error 500 - urn:acme:error:unauthorized - Error creating new authz :: Syntax error"
-		if err.Error() != expectedError {
-			t.Errorf("Expected error |%s| but instead got |%s|", expectedError, err.Error())
-		}
-	}
-}
-
-func TestHTTPInvalidServerState(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 512)
-
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Add("Replay-Nonce", "12345")
-		w.Write([]byte("{\"type\":\"http01\",\"status\":\"invalid\",\"uri\":\"http://some.url\",\"token\":\"http7\"}"))
-	}))
-
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
-	solver := &httpChallenge{jws: jws, optPort: "23456"}
-	clientChallenge := challenge{Type: "http01", Status: "pending", URI: ts.URL, Token: "http7"}
-
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
-	} else {
-		expectedError := "The server could not validate our request."
-		if err.Error() != expectedError {
-			t.Errorf("Expected error |%s| but instead got |%s|", expectedError, err.Error())
-		}
-	}
-}
-
-func TestHTTPValidServerResponse(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 512)
-
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Add("Replay-Nonce", "12345")
-		w.Write([]byte("{\"type\":\"http01\",\"status\":\"valid\",\"uri\":\"http://some.url\",\"token\":\"http8\"}"))
-	}))
-
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
-	solver := &httpChallenge{jws: jws, optPort: "23456"}
-	clientChallenge := challenge{Type: "http01", Status: "pending", URI: ts.URL, Token: "http8"}
-
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err != nil {
-		t.Errorf("VALID: Expected Solve to return no error but the error was -> %v", err)
-	}
-}
-
-func TestHTTPValidFull(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 512)
-
-	ts := httptest.NewServer(nil)
-
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
-	solver := &httpChallenge{jws: jws, optPort: "23457"}
-	clientChallenge := challenge{Type: "http01", Status: "pending", URI: ts.URL, Token: "http9"}
-
-	// Validate server on port 23456 which responds appropriately
-	ts.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var request challenge
-		w.Header().Add("Replay-Nonce", "12345")
-
-		if r.Method == "HEAD" {
-			return
-		}
-
-		clientJws, _ := ioutil.ReadAll(r.Body)
-		j, err := jose.ParseSigned(string(clientJws))
 		if err != nil {
-			t.Errorf("Client sent invalid JWS to the server.\n\t%v", err)
+			return err
-			return
-		}
-		output, err := j.Verify(&privKey.(*rsa.PrivateKey).PublicKey)
-		if err != nil {
-			t.Errorf("Unable to verify client data -> %v", err)
-		}
-		json.Unmarshal(output, &request)
-
-		transport := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
-		client := &http.Client{Transport: transport}
-
-		reqURL := "http://localhost:23457/.well-known/acme-challenge/" + clientChallenge.Token
-		t.Logf("Request URL is: %s", reqURL)
-		req, err := http.NewRequest("GET", reqURL, nil)
-		if err != nil {
-			t.Error(err)
-		}
-		req.Host = "127.0.0.1"
-		resp, err := client.Do(req)
-		if err != nil {
-			t.Errorf("Expected the solver to listen on port 23457 -> %v", err)
 		}
 		defer resp.Body.Close()
 
-		body, _ := ioutil.ReadAll(resp.Body)
+		if want := "text/plain"; resp.Header.Get("Content-Type") != want {
+			t.Errorf("Get(%q) Content-Type: got %q, want %q", uri, resp.Header.Get("Content-Type"), want)
+		}
+
+		body, err := ioutil.ReadAll(resp.Body)
+		if err != nil {
+			return err
+		}
 		bodyStr := string(body)
 
-		if resp.Header.Get("Content-Type") != "text/plain" {
+		if bodyStr != chlng.KeyAuthorization {
-			t.Errorf("Expected server to respond with content type text/plain.")
+			t.Errorf("Get(%q) Body: got %q, want %q", uri, bodyStr, chlng.KeyAuthorization)
 		}
 
-		tokenRegex := regexp.MustCompile("^[\\w-]{43}$")
+		return nil
-		parts := strings.Split(bodyStr, ".")
-
-		if len(parts) != 2 {
-			t.Errorf("Expected server token to be a composite of two strings, seperated by a dot")
 	}
+	solver := &httpChallenge{jws: j, validate: mockValidate, optPort: "23457"}
 
-		if parts[0] != clientChallenge.Token {
+	if err := solver.Solve(clientChallenge, "localhost:23457"); err != nil {
-			t.Errorf("Expected the first part of the server token to be the challenge token.")
+		t.Errorf("Solve error: got %v, want nil", err)
-		}
+	}
-
+}
-		if !tokenRegex.MatchString(parts[1]) {
+
-			t.Errorf("Expected the second part of the server token to be a properly formatted key authorization")
+func TestHTTPChallengeInvalidPort(t *testing.T) {
-		}
+	privKey, _ := generatePrivateKey(rsakey, 128)
-
+	j := &jws{privKey: privKey.(*rsa.PrivateKey)}
-		valid := challenge{Type: "http01", Status: "valid", URI: ts.URL, Token: "1234567812"}
+	clientChallenge := challenge{Type: "http-01", Token: "http2"}
-		jsonBytes, _ := json.Marshal(&valid)
+	solver := &httpChallenge{jws: j, validate: stubValidate, optPort: "123456"}
-		w.Write(jsonBytes)
+
-	})
+	if err := solver.Solve(clientChallenge, "localhost:123456"); err == nil {
-
+		t.Error("Solve error: got %v, want error", err)
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err != nil {
+	} else if want := "invalid port 123456"; !strings.HasSuffix(err.Error(), want) {
-		t.Errorf("VALID: Expected Solve to return no error but the error was -> %v", err)
+		t.Errorf("Solve error: got %q, want suffix %q", err.Error(), want)
 	}
 }

acme/tls_sni_challenge.go

@@ -11,6 +11,7 @@ import (
 
 type tlsSNIChallenge struct {
 	jws      *jws
+	validate func(j *jws, uri string, chlng challenge) error
 	optPort  string
 }
 
@@ -48,7 +49,7 @@ func (t *tlsSNIChallenge) Solve(chlng challenge, domain string) error {
 
 	go http.Serve(listener, nil)
 
-	return validate(t.jws, chlng.URI, challenge{Resource: "challenge", Type: chlng.Type, Token: chlng.Token, KeyAuthorization: keyAuth})
+	return t.validate(t.jws, chlng.URI, challenge{Resource: "challenge", Type: chlng.Type, Token: chlng.Token, KeyAuthorization: keyAuth})
 }
 
 func (t *tlsSNIChallenge) generateCertificate(keyAuth string) (tls.Certificate, error) {

acme/tls_sni_challenge_test.go

@@ -5,61 +5,17 @@ import (
 	"crypto/sha256"
 	"crypto/tls"
 	"encoding/hex"
-	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"strings"
-	"net/http"
-	"net/http/httptest"
 	"testing"
-
-	"github.com/square/go-jose"
 )
 
-func TestTLSSNINonRootBind(t *testing.T) {
+func TestTLSSNIChallenge(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 128)
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey)}
-
-	solver := &tlsSNIChallenge{jws: jws}
-	clientChallenge := challenge{Type: "tls-sni-01", Status: "pending", URI: "localhost:4000", Token: "tls1"}
-
-	// validate error on non-root bind to 443
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("BIND: Expected Solve to return an error but the error was nil.")
-	} else {
-		expectedError := "Could not start HTTPS server for challenge -> listen tcp :443: bind: permission denied"
-		if err.Error() != expectedError {
-			t.Errorf("Expected error \"%s\" but instead got \"%s\"", expectedError, err.Error())
-		}
-	}
-}
-
-func TestTLSSNI(t *testing.T) {
 	privKey, _ := generatePrivateKey(rsakey, 512)
-	optPort := "5001"
+	j := &jws{privKey: privKey.(*rsa.PrivateKey)}
-
+	clientChallenge := challenge{Type: "tls-sni-01", Token: "tlssni1"}
-	ts := httptest.NewServer(nil)
+	mockValidate := func(_ *jws, _ string, chlng challenge) error {
-
+		conn, err := tls.Dial("tcp", "localhost:23457", &tls.Config{
-	ts.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var request challenge
-		w.Header().Add("Replay-Nonce", "12345")
-
-		if r.Method == "HEAD" {
-			return
-		}
-
-		clientJws, _ := ioutil.ReadAll(r.Body)
-		j, err := jose.ParseSigned(string(clientJws))
-		if err != nil {
-			t.Errorf("Client sent invalid JWS to the server.\n\t%v", err)
-			return
-		}
-		output, err := j.Verify(&privKey.(*rsa.PrivateKey).PublicKey)
-		if err != nil {
-			t.Errorf("Unable to verify client data -> %v", err)
-		}
-		json.Unmarshal(output, &request)
-
-		conn, err := tls.Dial("tcp", "localhost:"+optPort, &tls.Config{
 			InsecureSkipVerify: true,
 		})
 		if err != nil {
@@ -77,7 +33,7 @@ func TestTLSSNI(t *testing.T) {
 			t.Errorf("Expected the challenge certificate to have exactly one DNSNames entry but had %d", count)
 		}
 
-		zBytes := sha256.Sum256([]byte(request.KeyAuthorization))
+		zBytes := sha256.Sum256([]byte(chlng.KeyAuthorization))
 		z := hex.EncodeToString(zBytes[:sha256.Size])
 		domain := fmt.Sprintf("%s.%s.acme.invalid", z[:32], z[32:])
 
@@ -85,16 +41,24 @@ func TestTLSSNI(t *testing.T) {
 			t.Errorf("Expected the challenge certificate DNSName to match %s but was %s", domain, remoteCert.DNSNames[0])
 		}
 
-		valid := challenge{Type: "tls-sni-01", Status: "valid", URI: ts.URL, Token: "tls1"}
+		return nil
-		jsonBytes, _ := json.Marshal(&valid)
+	}
-		w.Write(jsonBytes)
+	solver := &tlsSNIChallenge{jws: j, validate: mockValidate, optPort: "23457"}
-	})
 
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
+	if err := solver.Solve(clientChallenge, "localhost:23457"); err != nil {
-	solver := &tlsSNIChallenge{jws: jws, optPort: optPort}
+		t.Errorf("Solve error: got %v, want nil", err)
-	clientChallenge := challenge{Type: "tls-sni-01", Status: "pending", URI: ts.URL, Token: "tls1"}
+	}
-
+}
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err != nil {
+
-		t.Error("UNEXPECTED: Expected Solve to return no error but the error was %s.", err.Error())
+func TestTLSSNIChallengeInvalidPort(t *testing.T) {
+	privKey, _ := generatePrivateKey(rsakey, 128)
+	j := &jws{privKey: privKey.(*rsa.PrivateKey)}
+	clientChallenge := challenge{Type: "tls-sni-01", Token: "tlssni2"}
+	solver := &tlsSNIChallenge{jws: j, validate: stubValidate, optPort: "123456"}
+
+	if err := solver.Solve(clientChallenge, "localhost:123456"); err == nil {
+		t.Error("Solve error: got %v, want error", err)
+	} else if want := "invalid port 123456"; !strings.HasSuffix(err.Error(), want) {
+		t.Errorf("Solve error: got %q, want suffix %q", err.Error(), want)
 	}
 }