Issue

Integration test TestExternalCAInvalidCert::test_external_ca_with_too_small_key fails on systems where OpenSSL runs in FIPS mode. The test builds a deliberately weak RSA-1024 external CA on the pytest runner via tasks.sign_ca_and_transport() → ExternalCA.create_ca(). Cryptography then fails at CertificateBuilder.sign() with ValueError: Unable to sign/verify with this key, because FIPS policy does not allow signing with 1024-bit RSA. The failure happens before ipa-cacert-manage runs, so the test never exercises the intended IPA/NSS rejection path.

This is a test / CI environment problem, not incorrect IPA product behavior for CA renewal.

Steps to Reproduce

Use a FIPS-enabled environment (e.g. RHEL in FIPS mode, or a runner where cryptography’s OpenSSL backend reports FIPS).

Run the external CA integration suite so TestExternalCAInvalidCert runs after the deployment from test_external_ca.

Execute:pytest ipatests/test_integration/test_external_ca.py::TestExternalCAInvalidCert::test_external_ca_with_too_small_key

Actual behavior

sign_ca_and_transport(..., key_size=1024) raises during local certificate creation, for example:

ValueError: Unable to sign/verify with this key
(stack in cryptography.x509.base.CertificateBuilder.sign / OpenSSL backend, FIPS: True).

Expected behavior/Fix

Skip the test with weak RSA-1024 key size in fips mode.

Additional info:

A larger size (e.g. 2048) is generally accepted for external CAs in this stack; the test is meant to hit NSS/certutil -V rejection for an undersized CA key, which is naturally 1024 for this case.