Run ensure_beaker_ip_on before FakeCA collects cert SAN addresses - #285
Merged
Conversation
run_fake_pki_ca_on embeds the SUTs' live IP addresses in certificate subjectAltNames. On SUTs where the static private-network IP was never applied (EL10 under Vagrant), the certs were cut from the transient DHCP address; once ensure_beaker_ip_on corrected the interface, IKE peer IDs no longer matched the cert SANs and strict validators (libreswan 5) rejected authentication (AUTHENTICATION_FAILED). Correct the address before collecting SAN data, next to the existing activate_interfaces call.
nick-markowski
approved these changes
Jul 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #284.
run_fake_pki_ca_onembeds the SUTs' live IPs in cert subjectAltNames — but it can run (e.g. from abefore(:suite)hook, as pupmod-simp-libreswan does) before thebefore(:all)hook that appliesensure_beaker_ip_on. On EL10/Vagrant SUTs the certs were then cut from the transient DHCP address; after remediation, IKE peer IDs no longer matched the cert SANs and libreswan 5 (strict ID-vs-SAN matching) rejected auth withAUTHENTICATION_FAILED.Fix: correct the address inside
run_fake_pki_ca_on, right next to the existingactivate_interfacescall, before SAN data is collected. Version 3.1.1 + CHANGELOG.Diagnosed on a live left/right almalinux10 pair: cert SAN said
IP:10.254.16.168(pre-fix DHCP) while the wire IP was the corrected10.254.188.154.🤖 Generated with Claude Code