From Fedora Project Wiki

Revision as of 17:37, 4 July 2024 by Sumantrom (talk | contribs) (Created page with "{{QA/Test_Case |description=This test case ensures the successful installation of an IPA server with HSM and the renewal of a certificate outside the grace period on Fedora. |setup=Install the pre-release version of Fedora to be tested on a bare metal system using the default Anaconda settings, except to reclaim all disk space in the process. |actions= # Install the freeipa packages: <code> dnf install freeipa-server freeipa-server-dns softhsm -y </code> # Rename the hos...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Description

This test case ensures the successful installation of an IPA server with HSM and the renewal of a certificate outside the grace period on Fedora.

Setup

Install the pre-release version of Fedora to be tested on a bare metal system using the default Anaconda settings, except to reclaim all disk space in the process.

How to test

  1. Install the freeipa packages: dnf install freeipa-server freeipa-server-dns softhsm -y
  2. Rename the hostname with the domain to be used with ipa
    1. hostnamectl hostname ipa.example.test
    2. echo “<ip-address> ipa.example.test” >> /etc/hosts
  3. Create softhsm token : runuser -u pkiuser -- /usr/bin/softhsm2-util --init-token --free --pin $TOKEN_PASSWORD --so-pin $TOKEN_PASSWORD --label ipa_token
  4. Install the IPA server : ipa-server-install -a $ADMIN_PASSWORD -p $DM_PASSWORD -r EXAMPLE.TEST -U --random-serial-numbers --token-name=ipa_token --token-library-path=/usr/lib64/pkcs11/libsofthsm2.so --token-password=$TOKEN_PASSWORD
  5. Move date to near the end of the grace period date -s +1years+11months+20days
  6. Monitor the renewal - It will take a bit for new certs to be issued and for certmonger to notice. To monitor it:

watch -n 5 'getcert list | grep status'

  1. The expired certificates (all but the CA cert) will be re-issued. As you monitor using getcert list you may see the certificates go through different states including: SUBMITTING, GENERATING_CSR, POST_SAVED_CERT, NEED_TO_SUBMIT and/or NEED_TO_SAVE_CERT
  2. If one certificate fails to renew with CA_UNREACHABLE wait until all of the certs are either in this state or MONITORING. Then restart certmonger and run the watch again. Certificate renewal can be bumpy as lots of service restarts happen and the renewals can step on one another.

Expected Results

  1. All installation steps complete without errors.
  2. The hostname is successfully renamed and resolved.
  3. The softhsm token is created and initialized correctly.
  4. The IPA server installs without issues and recognizes the HSM token.
  5. The system date is successfully changed to simulate the near-end expiration grace period.
  6. Certificates (excluding the CA cert) are re-issued correctly when expired.
  7. Certmonger successfully monitors and manages the certificate renewal process



Retrieved from "https://fedoraproject.org/w/index.php?title=QA:Testcase_Install_IPA_HSM_renew_cert_within_grace&oldid=713663"