freeipa

#8893 Nightly test failure in test_integration/test_external_ca.py::TestSelfExternalSelf
Closed: fixed by frenaud. Opened by mpolovka.

Closed: fixed
Reopen Issue

Tests:
- test_switch_to_external_ca
- test_issuerDN_after_renew_to_external
- test_switch_back_to_self_signed

are failing in [testing_ipa-4.6] Nightly PR #987 with the errors:

    def test_switch_to_external_ca(self):
        result = self.master.run_command([paths.IPA_CACERT_MANAGE, 'renew',
                                         '--external-ca'])
        assert result.returncode == 0
        # Sign CA, transport it to the host and get ipa a root ca paths.
        root_ca_fname, ipa_ca_fname = tasks.sign_ca_and_transport(
            self.master, paths.IPA_CA_CSR, ROOT_CA, IPA_CA)
        # renew CA with externally signed one
        result = self.master.run_command([paths.IPA_CACERT_MANAGE, 'renew',
                                          '--external-cert-file={}'.
                                          format(ipa_ca_fname),
                                          '--external-cert-file={}'.
                                          format(root_ca_fname)])
        assert result.returncode == 0
        # update IPA certificate databases
        result = self.master.run_command([paths.IPA_CERTUPDATE])
        assert result.returncode == 0
        # Check if external CA have "C" flag after the switch
        result = check_CA_flag(self.master)
>       assert bool(result), ('External CA does not have "C" flag')
E       AssertionError: External CA does not have "C" flag
E       assert False
E        +  where False = bool(None)

E           subprocess.CalledProcessError: Command '['ipa', 'ca-show', 'ipa']' returned non-zero exit status 1.
...
[ipatests.pytest_ipa.integration.host.Host.master.ParamikoTransport] RUN ['ipa', 'ca-show', 'ipa']
[ipatests.pytest_ipa.integration.host.Host.master.cmd30] RUN ['ipa', 'ca-show', 'ipa']
[ipatests.pytest_ipa.integration.host.Host.master.cmd30] ipa: ERROR: Failed to authenticate to CA REST API
[ipatests.pytest_ipa.integration.host.Host.master.cmd30] Exit code: 1
ipa: ERROR: stderr: ipa: ERROR: Failed to authenticate to CA REST API

and finally

E           subprocess.CalledProcessError: Command '['/usr/sbin/ipa-cacert-manage', 'renew', '--self-signed']' returned non-zero exit status 1.
...
[ipatests.pytest_ipa.integration.host.Host.master.cmd30] stderr: ipa: ERROR: Failed to authenticate to CA REST API

Full report

Issue happens consistently on ipa-4-6 branch. The last successful run was PR #972 on June 13 with the same set of installed pkgs.

The culprit commit is likely one of these 3:

$ git log --since 2021/06/13 --pretty=oneline
16ee41b4e42060a8fcf06369d42dedf2c0ee703c (HEAD -> ipa-4-6, origin/ipa-4-6) Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server
f99067f4a34da4416d1877f63e257a8bec470bf5 ipatests: use non-ascii chars in CA-less install
82b4e8872c4890fd598a6e86924fd396810c845c CA less installation: non ASCII chars in CA subject

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/5876

ipa-4-6:

  • 86a3070c3d18f72fa7b75755b2a763b3a858678a Switch to external ca: fix certmonger script

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

test-failure tests

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.