https://github.com/freeipa/freeipa/pull/1516 is a good start. I'm pushing the new test.

I'd also like to see additional steps in the test to verify that replica is able to sign a certificate with the new sub CA. You might have to adjust the ACL for the CA on master.

On master

ipa caacl-add ...

on replica

ipa-getcert request -w -k /etc/pki/tls/private/testcert.key -f /etc/pki/tls/private/testcert.crt -X test_subca
ipa-getcert status -v -f /etc/pki/tls/private/testcert.crt
openssl x509 -text -in /etc/pki/tls/private/testcert.crt

Check for status: MONITORING and issuer is the sub CA.

master:

• e5a508a749364f6a8916676061185c62972ea4a9 ipa_tests: test subca key replication

ipa-4-6:

• a454cba68dd46d8e330eee743da603cb453910c2 ipa_tests: test subca key replication

ipa-4-5:

• b2c356747658c09d4f713fbb8efb37de0a828a9e ipa_tests: test subca key replication

The reviewer requested an additional test. Are you planning to add that as part of this ticket or will you file a new one?

This one is ok. This is why it was not closed I guess.

master:

• 317c20e9dc673c2165ec4d8cc8875ba2ca59e066 ipa_tests: test signing request with subca on replica

@mreznik manual backport of this last test is required for ipa-4-5.

ipa-4-6:

• 458eafeccb2a7add9706eb782d57915766737556 ipa_tests: test signing request with subca on replica

ipa-4-5:

• 28de056c923dc61df3ee1c43b4176397005b3ada ipa_tests: test signing request with subca on replica