freeipa

#9881 Test failure in test_ipahealthcheck.py::TestIpaHealthCheck::test_ipahealthcheck_dogtag_ca_connectivity_check
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

The test test_ipahealthcheck.py::TestIpaHealthCheck::test_ipahealthcheck_dogtag_ca_connectivity_check started failing after the commit for #9738 During server installation don't use the PKI API directly to issue certificates

Steps to Reproduce

  1. Enable the copr repo @freeipa/freeipa-master-nightly and install freeipa-server package
  2. install the server with ipa-server-install
  3. stop pki-tomcatd@pki-tomcat
  4. call ipa-healthcheck --source ipahealthcheck.dogtag.ca --check DogtagCertsConnectivityCheck

Actual behavior

ipa healthcheck returns an error with a different message:

RUN ['ipa-healthcheck', '--source', 'ipahealthcheck.dogtag.ca', '--check', 'DogtagCertsConnectivityCheck', '--output-type', 'json']
/usr/lib/python3.14/site-packages/ipahealthcheck/core/core.py:8: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources
ra.get_certificate(): Unable to communicate with CMS (Failed to retrieve certificate: 503 Server Error: Service Unavailable for url: https://master.ufreeipa.test:443/ca/rest/certs/310755924739360942035656774297205087608)
[
  {
    "source": "ipahealthcheck.dogtag.ca",
    "check": "DogtagCertsConnectivityCheck",
    "result": "ERROR",
    "uuid": "4abc507b-c81f-4317-b245-1c825c49dcd4",
    "when": "20251124094513Z",
    "duration": "0.110881",
    "kw": {
      "key": "cert_show_ra",
      "error": "Certificate operation cannot be completed: Unable to communicate with CMS (Failed to retrieve certificate: 503 Server Error: Service Unavailable for url: https://master.ufreeipa.test:443/ca/rest/certs/310755924739360942035656774297205087608)",
      "serial": "310755924739360942035656774297205087608",
      "msg": "Request for certificate failed: {error}"
    }
  }
]

Expected behavior

The test should succeed

Version/Release/Distribution

freeipa-server-4.13.0.dev202511211100+git0aced7392-0.fc44.x86_64

Additional info:

The test needs to be updated with the new expected error message. Right now it's expecting:

        additional_msg = (
            "Certificate operation cannot be completed: "
            "Request failed with status 503: "
            "Non-2xx response from CA REST API: 503.  (503)"
        )

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/8035

master:

  • 9b9c71475b6a8d009335738108050c86213b0251 test_ipahealthcheck_dogtag_ca_connectivity_check: update expected msg

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

test-failure tests

None
None
None
https://github.com/freeipa/freeipa/pull/8035
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.