freeipa

#9428 Failure in test_integration/test_acme.py::TestACMEPrune::test_prune_cert_manual
Closed: fixed by frenaud. Opened by myusuf.

Closed: fixed
Reopen Issue

Request for enhancement

Failure in test_integration/test_acme.py::TestACMEPrune::test_prune_cert_manual

Steps to Reproduce

  1. Issue and acme certficiate
  2. Move date 90days+1hours to expire the cert
  3. issue acme prune command to prune the expired cert

Actual behavior

certificate still there

Expected behavior

(what do you expect to happen)
certificate should be prune

DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:513 RUN ['ipa', 'cert-find', '--subject', 'client1.testrelm.test']
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:557 ---------------------
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:557 1 certificate matched
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:557 ---------------------
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:557 Issuing CA: ipa
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:557 Subject: CN=client1.testrelm.test
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:557 Issuer: CN=Certificate Authority,O=TESTRELM.TEST
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:557 Not Before: Thu Aug 17 10:15:40 2023 UTC
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:557 Not After: Wed Nov 15 11:15:40 2023 UTC
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:557 Serial number: 1058417751455364049400090613654013847
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:557 Serial number (hex): 0xCBD8062B11D8A2BD1BACF2AD74C797
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:557 Status: EXPIRED
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:557 Revoked: False
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:557 ----------------------------
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd115:transport.py:557 Number of entries returned 1

Now when date changed as following:

INFO ipatests.pytest_ipa.integration.host.Host.client1.IPAOpenSSHTransport:transport.py:391 RUN ['date', '-s', '+90days+60minutes']
DEBUG ipatests.pytest_ipa.integration.host.Host.client1.cmd80:transport.py:513 RUN ['date', '-s', '+90days+60minutes']
DEBUG ipatests.pytest_ipa.integration.host.Host.client1.cmd80:transport.py:557 Wed Nov 15 06:15:42 EST 2023
DEBUG ipatests.pytest_ipa.integration.host.Host.client1.cmd80:transport.py:217 Exit code: 0

It is observed in downstream. Day light saving time started on 12th March 2023 and ends on 5th Nov 2023. Certificate issued which will expire after Nov 5 would have 1 hour difference into expiry due to DST.

The fix is to move the date by 90days2hours so that it expire certs irrespective of DST.

PR:: https://github.com/freeipa/freeipa/pull/6962

master:

  • 8d081ce8942b15d926525f66a049ef2c383cfc8f ipatests: accommodate DST in ACME cert expiry

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-1659

ipa-4-11:

  • b13b8fbb472ec24dfe35a690147e43aea363f3e4 ipatests: accommodate DST in ACME cert expiry

ipa-4-10:

  • e0145f6ad9eacdf6a059fd3154a377be45f584f9 ipatests: accommodate DST in ACME cert expiry

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.