From 4f0e9cbf027d8dc24f5ea910bb2f788884b329f8 Mon Sep 17 00:00:00 2001
From: Steven Pritchard <steve@sicura.us>
Date: Fri, 3 Jul 2026 19:26:10 +0000
Subject: [PATCH] Run ensure_beaker_ip_on before FakeCA collects cert SAN
 addresses

run_fake_pki_ca_on embeds the SUTs' live IP addresses in certificate
subjectAltNames. On SUTs where the static private-network IP was never
applied (EL10 under Vagrant), the certs were cut from the transient DHCP
address; once ensure_beaker_ip_on corrected the interface, IKE peer IDs
no longer matched the cert SANs and strict validators (libreswan 5)
rejected authentication (AUTHENTICATION_FAILED). Correct the address
before collecting SAN data, next to the existing activate_interfaces
call.
---
 CHANGELOG.md                       | 9 +++++++++
 lib/simp/beaker_helpers.rb         | 7 +++++++
 lib/simp/beaker_helpers/version.rb | 2 +-
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4c46e2e..292c0d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,12 @@
+### 3.1.1 / 2026-07-03
+* Fixed:
+  * `run_fake_pki_ca_on` now runs `ensure_beaker_ip_on` before collecting
+    the IP addresses embedded in certificate subjectAltNames, so certs match
+    the corrected (Beaker-recorded) addresses on SUTs where the static
+    private-network IP was never applied (e.g. EL10 under Vagrant). Without
+    this, IKE peer IDs no longer match the cert SANs after remediation and
+    strict validators (libreswan 5) reject authentication.
+
 ### 3.1.0 / 2026-07-02
 * Added:
   * `ensure_beaker_ip_on`: detect SUTs whose recorded `host[:ip]` was never
diff --git a/lib/simp/beaker_helpers.rb b/lib/simp/beaker_helpers.rb
index 73caa12..dbce7f6 100644
--- a/lib/simp/beaker_helpers.rb
+++ b/lib/simp/beaker_helpers.rb
@@ -976,6 +976,13 @@ def run_fake_pki_ca_on(ca_sut = master, _suts = hosts, local_dir = '')
       # Ensure that all interfaces are active prior to collecting data
       activate_interfaces(host)
 
+      # Ensure the Beaker-recorded IP is actually applied before it is
+      # embedded in certificate subjectAltNames (on EL10 under Vagrant the
+      # static private-network IP is silently never applied and the
+      # interface falls back to DHCP; certs cut from the DHCP address no
+      # longer match the peer IDs once the address is corrected)
+      ensure_beaker_ip_on(host)
+
       networking_fact = pfact_on(host, 'networking')
       if networking_fact && networking_fact['interfaces']
         networking_fact['interfaces'].each_value do |data|
diff --git a/lib/simp/beaker_helpers/version.rb b/lib/simp/beaker_helpers/version.rb
index c523f44..8f24621 100644
--- a/lib/simp/beaker_helpers/version.rb
+++ b/lib/simp/beaker_helpers/version.rb
@@ -4,5 +4,5 @@
 module Simp; end
 
 module Simp::BeakerHelpers # rubocop:disable Style/OneClassPerFile
-  VERSION = '3.1.0'
+  VERSION = '3.1.1'
 end