From cedd52d7f96f9d9db74b1b45e0c2a9e12532fa5c Mon Sep 17 00:00:00 2001 From: Michal Reznik Date: Thu, 9 Nov 2017 19:59:34 +0100 Subject: [PATCH] test_caless: fix http.p12 is not valid In "test_invalid_ds_cn" test case an old invalid http.p12 cert is used as a leftover after previous "test_invalid_http_cn" test. Get new valid http.p12 cert using create_pkcs12(). Also use server-badname cert instead of cert for replica. This explicitly ensures a non-matching hostname/SAN rather than implicitly by using a certificate for the replica. https://pagure.io/freeipa/issue/7254 Reviewed-By: Rob Crittenden --- ipatests/test_integration/test_caless.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ipatests/test_integration/test_caless.py b/ipatests/test_integration/test_caless.py index d00322ec4..76f40292f 100644 --- a/ipatests/test_integration/test_caless.py +++ b/ipatests/test_integration/test_caless.py @@ -526,7 +526,8 @@ class TestServerInstall(CALessBase): def test_invalid_ds_cn(self): "IPA server install with DS certificate with invalid CN" - self.create_pkcs12('ca1/replica', filename='dirsrv.p12') + self.create_pkcs12('ca1/server', filename='http.p12') + self.create_pkcs12('ca1/server-badname', filename='dirsrv.p12') self.prepare_cacert('ca1') result = self.install_server(http_pkcs12='http.p12',