freeipa

#9348 Nightly test failure (testing_master_pki): test_integration/test_acme.py::TestACMEPrune::test_prune_cert_manual
Closed: fixed by frenaud. Opened by amore.

Closed: fixed
Reopen Issue

The nightly tests detected a regression when using the nightly build of pki master branch.
Failing test:
test_integration/test_acme.py::TestACMEPrune::test_prune_cert_manual
The regression was seen with PR #2434, with the following logs and report:

Test scenario:
- expire cert by moving date past expiry of acme cert
- check that the certificate issued for the client
- ipa cert-find --subject client_hostname

Actual output:

E           subprocess.CalledProcessError: Command '['ipa', 'cert-find', '--subject', 'client0.ipa.test']' returned non-zero exit status 1.
pytest_ipa/integration/host.py:202: CalledProcessError
 ------------------------------Captured stderr call------------------------------ 
ipa: ERROR: stderr: ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (500)

Metadata Update from @amore:
- Issue tagged with: test-failure, tests

The CA is not logging to debug after the time switch. Only March 13 entries exist in the log so we can't see the details on why the request failed. The catalina log in June is reporting the 500 though, but that just confirms that the CA failed the request, not the why.

Perhaps try an explicit restart of pki-tomcat@pki-tomcatd, if not ipactl restart, after moving time.

Reproduced in testing_master_pki , report

Reproduced in [testing_master_pki] , report

Reproduced in testing_master_pki , report

Reproduced in testing_master_pki , report

@myusuf Could you please look into this.

It looks like time is jumping backwards twice (or not returning to current time). I can't tell exactly where. test_prune_cert_cron is jumping back to Tue Jan 24 05:51:27 AM, before the certificates were issued, which is likely why the authentication is failing.

test_prune_cert_manual (passing) jumped forward to Sun Jul 23 07:48:51 AM UTC 2023.

Reproduced in testing_master_pki , report

Reproduced in testing_master_pki , report

The issue now also happens in rawhide, see PR #2755, with the release of pki 11.4.3

master:

  • bbb53a12711f864601a9d7c024145603c9c596a1 ipatests: remove fixture call and wait to get things settle

ipa-4-10:

  • ff6cfcacd67a0461a0341e17854732cbe301f1d6 ipatests: remove fixture call and wait to get things settle

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • a6f01115cf2abbf6be5570d96fa607e716ba7ba9 ipatests: fixture can produce IndexError

ipa-4-10:

  • f816b4d9e6ff7a47b0da1a368d2454add78af07c ipatests: fixture can produce IndexError
Metadata
None

test-failure tests

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.