Fix improper removals of randomness

Author: aarongable

ra/ra_test.go

@@ -15,7 +15,6 @@ import (
 	"encoding/pem"
 	"errors"
 	"fmt"
-	"math"
 	"math/big"
 	mrand "math/rand/v2"
 	"net/netip"
@@ -2907,27 +2906,6 @@ func TestFinalizeWithMustStaple(t *testing.T) {
 	}, testKey)
 	test.AssertNotError(t, err, "creating must-staple CSR")
 
-	serial, err := rand.Int(nil, big.NewInt(math.MaxInt64))
-	test.AssertNotError(t, err, "generating random serial number")
-	template := &x509.Certificate{
-		SerialNumber:          serial,
-		Subject:               pkix.Name{CommonName: domain},
-		DNSNames:              []string{domain},
-		NotBefore:             fc.Now(),
-		NotAfter:              fc.Now().Add(365 * 24 * time.Hour),
-		BasicConstraintsValid: true,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
-		ExtraExtensions:       []pkix.Extension{ocspMustStapleExt},
-	}
-	cert, err := x509.CreateCertificate(nil, template, template, testKey.Public(), testKey)
-	test.AssertNotError(t, err, "creating certificate")
-	ra.CA = &mocks.MockCA{
-		PEM: pem.EncodeToMemory(&pem.Block{
-			Bytes: cert,
-			Type:  "CERTIFICATE",
-		}),
-	}
-
 	_, err = ra.FinalizeOrder(context.Background(), &rapb.FinalizeOrderRequest{
 		Order: order,
 		Csr:   csr,

wfe2/wfe_test.go

@@ -803,8 +803,11 @@ func (fr fakeRand) Read(p []byte) (int, error) {
 func TestDirectory(t *testing.T) {
 	wfe, _, signer := setupWFE(t)
 	mux := wfe.Handler(metrics.NoopRegisterer)
+
+	// We need deterministic randomness for the random directory entry.
+	origRand := core.RandReader
 	core.RandReader = fakeRand{}
-	defer func() { core.RandReader = nil }()
+	defer func() { core.RandReader = origRand }()
 
 	dirURL, _ := url.Parse("/directory")
 
@@ -920,8 +923,11 @@ func TestDirectory(t *testing.T) {
 func TestRelativeDirectory(t *testing.T) {
 	wfe, _, _ := setupWFE(t)
 	mux := wfe.Handler(metrics.NoopRegisterer)
+
+	// We need deterministic randomness for the random directory entry.
+	origRand := core.RandReader
 	core.RandReader = fakeRand{}
-	defer func() { core.RandReader = nil }()
+	defer func() { core.RandReader = origRand }()
 
 	expectedDirectory := func(hostname string) string {
 		expected := new(bytes.Buffer)