freeipa

#9991 Nightly test failure in test_integration/test_pki_config_override.py::TestPKIConfigOverride::test_cert_rsa4096
Opened by frenaud. Modified

Open
Close Issue

Issue

The nightly test test_integration/test_pki_config_override.py::TestPKIConfigOverride::test_cert_rsa4096 started failing after the commit of PR #8240 Add support for IPA replicas with ML-DSA

Steps to Reproduce

  1. Install ipa server with a PKI override file forcing a key size = 4096:
# cat /tmp/pki-config-override
[DEFAULT]
ipa_ca_key_size=4096
ipa_ca_key_algorithm=SHA512withRSA
ipa_ca_signing_algorithm=SHA512withRSA
# ipa-server-install --domain ipa.test --realm IPA.TEST -a Secret123 -p Secret123 --pki-config-override /tmp/pki-config-override -U
  1. Check that the CA cert has the expected key size
openssl x509 -noout -text -in /etc/ipa/ca.crt  | grep "Public-Key:"
                Public-Key: (3072 bit)

Actual behavior

The key is 3072-bit long instead of 4096 as expected.

Expected behavior

The override pki config file should force a 4096 key size

Version/Release/Distribution

freeipa-server-4.14.0.dev202605121751+git564db1017-0.fc44.x86_64

Additional info:

The regression was introduced with https://github.com/freeipa/freeipa/pull/8240
This commit adds a new option to ipa-server-server: --ca-key-type, allowing to specify the key type without an override file (default: RSA:3072).

The new behavior does not seem to take into account the pki override file.

Logs available in https://$ARTIFACTS_SERVER/idm-ci/freeipa_upstream_nightly/Nightly-latest-testing-repo/master/2026-05-13_09-50/latest-testing-repo/test_pki_config_override/1/report.html?sort=result

@rcritten could you have a look?

We have two possible solutions:
- either allow to override key type and size only through the new command line --ca-key-type (refuse changes in pki-config-override, as we do for instance for the immutable HSM options)
- or allow override through both methods (1. CLI option --ca-key-type and 2. pki-config-override file) and fix the current behavior.

Metadata Update from @rcritten:
- Issue assigned to rcritten
Metadata

test-failure

None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.