The nightly test test_commands.py::TestIPACommand::test_ipa_cacert_manage_prune started failing, see for instance PR #2057 with the following logs and report:

self = <ipatests.test_integration.test_commands.TestIPACommand object at 0x7fce555ea5f0>
    def test_ipa_cacert_manage_prune(self):
        """Test for ipa-cacert-manage prune"""
        certfile = os.path.join(self.master.config.test_dir, 'cert.pem')
        self.master.put_file_contents(certfile, isrgrootx1)
        result = self.master.run_command(
            [paths.IPA_CACERT_MANAGE, 'install', certfile])
        certs_before_prune = self.master.run_command(
            [paths.IPA_CACERT_MANAGE, 'list'], raiseonerr=False
        ).stdout_text
        assert isrgrootx1_nick in certs_before_prune
        # Jump in time to make sure the cert is expired
        self.master.run_command(['date', '-s', '+15Years'])
        result = self.master.run_command(
            [paths.IPA_CACERT_MANAGE, 'prune'], raiseonerr=False
        ).stdout_text
        self.master.run_command(['date', '-s', '-15Years'])
>       assert isrgrootx1_nick in result
E       AssertionError: assert 'CN=ISRG Root X1,O=Internet Security Research Group,C=US' in ''

Test scenario:
- add external CA using ipa-cacert-manage install
- move the date in the future (+15 years = Sep 2037) so that ISRG Root X1 expires
- run ipa-cacert-manage prune
- assert that ISRG Root X1 was removed by the prune command

The issue happens because another expired CA is also present. A previous test added O=EXAMPLE.COM, CN=Certificate Authority that expires Sept 20 2037 (the date explains why the test started failing yesterday).
As a consequence, there are 2 expired CA certs and the prune option fails when more than 1 cert needs to be removed.
The logic for pruning is the following:

• get a list of the CA certs
• for each CA cert:
  • call _delete_by_nickname for this CA cert

_delete_by_nickname creates a NSS DB with all the CA certs except the one to be removed, and tries to verify each remaining cert.
If there are multiple expired certs (for instance certA and certB), _delete_by_nickname(certA) tries to validate certB and fails because it's expired.

Instead of deleting the certs one at a time, the code could remove all the expired ones in a single pass and validate the remaining ones.

In conclusion:
- the test detected a real issue: ipa-cacert-manage prune is failing if there are more than 1 expired cert
- the test should be enhanced to detect the ipa-cacert-manage prune error. Currently it's using raiseonerr=False to make sure the cleanup is done (go back to the current date) but doesn't check the prune return code.