Run ensure_beaker_ip_on before FakeCA collects cert SAN addresses

CHANGELOG.md

@@ -1,3 +1,12 @@
+### 3.1.1 / 2026-07-03
+* Fixed:
+  * `run_fake_pki_ca_on` now runs `ensure_beaker_ip_on` before collecting
+    the IP addresses embedded in certificate subjectAltNames, so certs match
+    the corrected (Beaker-recorded) addresses on SUTs where the static
+    private-network IP was never applied (e.g. EL10 under Vagrant). Without
+    this, IKE peer IDs no longer match the cert SANs after remediation and
+    strict validators (libreswan 5) reject authentication.
+
 ### 3.1.0 / 2026-07-02
 * Added:
   * `ensure_beaker_ip_on`: detect SUTs whose recorded `host[:ip]` was never

lib/simp/beaker_helpers.rb

@@ -976,6 +976,13 @@ def run_fake_pki_ca_on(ca_sut = master, _suts = hosts, local_dir = '')
       # Ensure that all interfaces are active prior to collecting data
       activate_interfaces(host)
 
+      # Ensure the Beaker-recorded IP is actually applied before it is
+      # embedded in certificate subjectAltNames (on EL10 under Vagrant the
+      # static private-network IP is silently never applied and the
+      # interface falls back to DHCP; certs cut from the DHCP address no
+      # longer match the peer IDs once the address is corrected)
+      ensure_beaker_ip_on(host)
+
       networking_fact = pfact_on(host, 'networking')
       if networking_fact && networking_fact['interfaces']
         networking_fact['interfaces'].each_value do |data|

lib/simp/beaker_helpers/version.rb

@@ -4,5 +4,5 @@
 module Simp; end
 
 module Simp::BeakerHelpers # rubocop:disable Style/OneClassPerFile
-  VERSION = '3.1.0'
+  VERSION = '3.1.1'
 end