Arrow flight CI test failing on `master`

[alamb]

Describe the bug

Arrow flight CI test failing on master

Example:
https://github.com/apache/arrow-rs/actions/runs/11354119801/job/31580643040

running 3 tests
test tests::test_execute_update ... FAILED
test tests::test_select ... FAILED
test tests::test_auth ... FAILED

failures:

---- tests::test_execute_update stdout ----
testing uds client
Client finished!
=======
testing http client
Client finished!
=======
testing https client
thread 'tests::test_execute_update' panicked at arrow-flight/examples/flight_sql_server.rs:834:65:
called `Result::unwrap()` on an `Err` value: IpcError("Can't handshake status: Unknown, message: \"transport error\", details: [], metadata: MetadataMap { headers: {} }")
stack backtrace:

To Reproduce
RunC CI

Expected behavior
Should pass

Additional context

[alamb]

First started happening with 04fa369 which is unrelated to flight

I suspect something changed in one of the underlying libraries

[alamb]

Starting to look at this one

[alamb]

I believe the issue is that the client pem files expired

 andrewlamb@Andrews-MacBook-Pro-2:~/Software/arrow-rs$ openssl x509 -in ./arrow-flight/examples/data/client1.pem -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:b1:3d:77:54:5f:b7:98:78:92:ee:c5:48:0b:d6:77
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=Tonic Example Client Root CA
        Validity
            Not Before: Oct 14 12:39:36 2019 GMT
            Not After : Oct 12 12:39:36 2024 GMT.  <--- note this is about when the test started failing
        Subject: CN=client1

[tustvold]

@viirya perhaps you could take a look, as it appears you added these in #3388

[alamb]

I looked into these certificates a bit -- they appear to be copied from the tonic repo. I also tried my hand at regenerating them and failed to get the tests to pass. I will try my hand again either later today or tomorrow if no one beats me to it

[viirya]

Hmm, I forgot where I got these certificates...
I will try taking a look if @alamb doesn't fix it.

[itsjunetime]

These certificates are identical to the ones in the tonic repo (examples/data/tls/client1.pem) and it seems they've neglected to update them. For example, you can do the following:

1. Clone the tonic repo
2. cd tonic/examples
3. cargo run --bin tls-client-auth-server
4. Open a new terminal window, cd to the same place, and run cargo run --bin tls-client-auth-client
5. Observe the following error: Error: Status { code: Unknown, message: "transport error", source: Some(tonic::transport::Error(Transport, hyper::Error(Io, Custom { kind: InvalidData, error: "received fatal alert: CertificateExpired" }))) }

I think we need to regen the root CA (ca.pem) as well as the certs to make the tests work, but I haven't verified this.

I also think this warrants opening an issue in the tonic repo, so I'll do that next.

[itsjunetime]

I think I've got this fixed with #6585, a review would be appreciated :)