IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Test that the KRA profiles can renewal its three certificates

Browse Source 
The KRA was previously configured with Internal CA profiles
which did not work with the IPA RA.

Use public, common profiles to manage renewal of the KRA
subsystem certificates.

https://pagure.io/freeipa/issue/8545

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
This commit is contained in:
Rob Crittenden
2020-10-15 13:41:59 -04:00
parent a9e1c014f6
commit bd4771d75f
1 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
ipatests/test_integration/test_installation.py
View File

@@ -33,6 +33,7 @@ from ipatests.pytest_ipa.integration.env_config import get_global_config
from ipatests.test_integration.base import IntegrationTest
from ipatests.test_integration.test_caless import CALessBase, ipa_certs_cleanup
from ipaplatform import services
from ipaserver.install import krainstance
config = get_global_config()
@@ -1053,6 +1054,38 @@ class TestInstallMasterKRA(IntegrationTest):
def test_install_dns(self):
tasks.install_dns(self.master)
def test_kra_certs_renewal(self):
"""
Test that the KRA subsystem certificates renew properly
"""
kra = krainstance.KRAInstance(self.master.domain.realm)
for nickname in kra.tracking_reqs:
cert = tasks.certutil_fetch_cert(
self.master,
paths.PKI_TOMCAT_ALIAS_DIR,
paths.PKI_TOMCAT_ALIAS_PWDFILE_TXT,
nickname
)
starting_serial = int(cert.serial_number)
cmd_arg = [
'ipa-getcert', 'resubmit', '-v', '-w',
'-d', paths.PKI_TOMCAT_ALIAS_DIR,
'-n', nickname,
]
result = self.master.run_command(cmd_arg)
request_id = re.findall(r'\d+', result.stdout_text)
status = tasks.wait_for_request(self.master, request_id[0], 120)
assert status == "MONITORING"
cert = tasks.certutil_fetch_cert(
self.master,
paths.PKI_TOMCAT_ALIAS_DIR,
paths.PKI_TOMCAT_ALIAS_PWDFILE_TXT,
nickname
)
assert starting_serial != int(cert.serial_number)
class TestInstallMasterDNS(IntegrationTest):