freeipa

#6886 Sub-CA replication test is needed
Closed: fixed by ftweedal. Opened by mbasti.

Closed: fixed
Reopen Issue

There is no test for sub-CAs over multiple FreeIPA servers. Sub-CA keys are distributed by ipa-custodia thus we need integration tests to check if sub-CA keys are successfully distributed.

Metadata Update from @mbasti:
- Issue tagged with: tests

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.7

Tests should create sub CAs on multiple replicas and verify that key material is replicated to all other replicas.

https://pagure.io/freeipa/issue/7567 was closed duplication of this ticket.

Description:

See ticket https://pagure.io/freeipa/issue/7536

  • set up master and replica with CA
  • ipa ca-add
  • compare output of certutil -d /etc/pki/pki-tomcat/alias/ -f /etc/pki/pki-tomcat/alias/pwdfile.txt -L and certutil -d /etc/pki/pki-tomcat/alias/ -f /etc/pki/pki-tomcat/alias/pwdfile.txt -K on master and replica

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.7.1 (was: FreeIPA 4.7)

FreeIPA 4.7 has been released, moving to FreeIPA 4.7.1 milestone

We have integration tests for LWCA key replication, in test_replica_promotion.py :: TestSubCAkeyReplication. These were added as part of fix for https://pagure.io/freeipa/issue/7590. (commit 6896c90eb25ffa6ab1ae64efa06b1f8c854aaed6).

Closing as fixed.

Metadata Update from @ftweedal:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

tests

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.