On to, 04 helmi 2021, Antonio Torres via FreeIPA-devel wrote:
I am adding a `prune` option to `ipa-cacert-manage` (as discussed in
The test for this option would be to have an expired cert installed and
check that it is deleted after running the command, but I'm not sure
how to add an expired certificate in first place. Any pointers on this?
See ipatests/test_integration/test_caless.py, it has several tests that
deal with expired certificates. There is a helper that creates CA setup
for CA-less setup and aside from creating a normal external CA/certs, it
automatically adds expired certificates, intentionally valid in past.
So when a test in test_caless.py calls create_pki(), it gets a bunch of
certificates created for all IPA services:
- normal ones
- certificates with a bad organization name
- certificates with an alternative organization name
- certificates which already expired by the time of create_pki() run
- certificates which aren't yet valid
- certificates with a bad usage
- already revoked certificates
They all have predictable names (see gen_server_certs() for details), so
can be applied with any host and tests do use this a lot.
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland