From 0037b698eda11185cb5f22ff74f4b008bc24fe40 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Thu, 15 Oct 2020 13:41:59 -0400 Subject: [PATCH] Test that the KRA profiles can renewal its three certificates The KRA was previously configured with Internal CA profiles which did not work with the IPA RA. Use public, common profiles to manage renewal of the KRA subsystem certificates. https://pagure.io/freeipa/issue/8545 Signed-off-by: Rob Crittenden Reviewed-By: Florence Blanc-Renaud --- .../test_integration/test_installation.py | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/ipatests/test_integration/test_installation.py b/ipatests/test_integration/test_installation.py index 1e0b3182a..b5df42b67 100644 --- a/ipatests/test_integration/test_installation.py +++ b/ipatests/test_integration/test_installation.py @@ -33,6 +33,7 @@ from ipatests.pytest_ipa.integration.env_config import get_global_config from ipatests.test_integration.base import IntegrationTest from ipatests.test_integration.test_caless import CALessBase, ipa_certs_cleanup from ipaplatform import services +from ipaserver.install import krainstance config = get_global_config() @@ -1053,6 +1054,38 @@ class TestInstallMasterKRA(IntegrationTest): def test_install_dns(self): tasks.install_dns(self.master) + def test_kra_certs_renewal(self): + """ + Test that the KRA subsystem certificates renew properly + """ + kra = krainstance.KRAInstance(self.master.domain.realm) + for nickname in kra.tracking_reqs: + cert = tasks.certutil_fetch_cert( + self.master, + paths.PKI_TOMCAT_ALIAS_DIR, + paths.PKI_TOMCAT_ALIAS_PWDFILE_TXT, + nickname + ) + starting_serial = int(cert.serial_number) + cmd_arg = [ + 'ipa-getcert', 'resubmit', '-v', '-w', + '-d', paths.PKI_TOMCAT_ALIAS_DIR, + '-n', nickname, + ] + result = self.master.run_command(cmd_arg) + request_id = re.findall(r'\d+', result.stdout_text) + + status = tasks.wait_for_request(self.master, request_id[0], 120) + assert status == "MONITORING" + + cert = tasks.certutil_fetch_cert( + self.master, + paths.PKI_TOMCAT_ALIAS_DIR, + paths.PKI_TOMCAT_ALIAS_PWDFILE_TXT, + nickname + ) + assert starting_serial != int(cert.serial_number) + class TestInstallMasterDNS(IntegrationTest):