Improve test reliability

Some tests have been updated to improve the reliability by
extending the cert validity, forcing CRL updates, and using
longer sleep times between operations.

.github/workflows/ca-pruning-test.yml

@@ -73,10 +73,10 @@ jobs:
 
       - name: Configure user cert profile
         run: |
-          # set cert validity to 3 minute
+          # set cert validity to 4 minute
           VALIDITY_DEFAULT="policyset.userCertSet.2.default.params"
           docker exec pki sed -i \
-              -e "s/^$VALIDITY_DEFAULT.range=.*$/$VALIDITY_DEFAULT.range=3/" \
+              -e "s/^$VALIDITY_DEFAULT.range=.*$/$VALIDITY_DEFAULT.range=4/" \
               -e "/^$VALIDITY_DEFAULT.range=.*$/a $VALIDITY_DEFAULT.rangeUnit=minute" \
               /etc/pki/pki-tomcat/ca/profiles/ca/caUserCert.cfg
 

.github/workflows/ocsp-basic-test.yml

@@ -181,6 +181,8 @@ jobs:
           # revoke CA agent cert
           docker exec pki /usr/share/pki/tests/ca/bin/ca-agent-cert-revoke.sh
 
+          sleep 5
+
           # get cert serial number
           docker exec pki pki nss-cert-show caagent | tee output
           CERT_ID=$(sed -n "s/^\s*Serial Number:\s*\(\S*\)$/\1/p" output)

.github/workflows/ocsp-crl-direct-test.yml

@@ -334,6 +334,18 @@ jobs:
           # revoke CA agent cert
           docker exec ca /usr/share/pki/tests/ca/bin/ca-agent-cert-revoke.sh
 
+          # https://github.com/dogtagpki/pki/wiki/UpdateCRL-Service
+          docker exec ca curl \
+              --cert-type P12 \
+              --cert /root/.dogtag/pki-tomcat/ca_admin_cert.p12:Secret.123 \
+              -sk \
+              -d "xml=true" \
+              https://ca.example.com:8443/ca/agent/ca/updateCRL \
+              | xmllint --format -
+
+          # wait for CRL update
+          sleep 10
+
           # get cert serial number
           docker exec ca pki nss-cert-show caagent | tee output
           CERT_ID=$(sed -n "s/^\s*Serial Number:\s*\(\S*\)$/\1/p" output)
@@ -369,6 +381,18 @@ jobs:
           # unrevoke CA agent cert
           docker exec ca /usr/share/pki/tests/ca/bin/ca-agent-cert-unrevoke.sh
 
+          # https://github.com/dogtagpki/pki/wiki/UpdateCRL-Service
+          docker exec ca curl \
+              --cert-type P12 \
+              --cert /root/.dogtag/pki-tomcat/ca_admin_cert.p12:Secret.123 \
+              -sk \
+              -d "xml=true" \
+              https://ca.example.com:8443/ca/agent/ca/updateCRL \
+              | xmllint --format -
+
+          # wait for CRL update
+          sleep 10
+
           # get cert serial number
           docker exec ca pki nss-cert-show caagent | tee output
           CERT_ID=$(sed -n "s/^\s*Serial Number:\s*\(\S*\)$/\1/p" output)

.github/workflows/ocsp-tests.yml

@@ -104,7 +104,7 @@ jobs:
         python -m pip install --upgrade pip
         pip install --user -r tests/ansible/requirements.txt
 
-    - name: Execute est playbook
+    - name: Execute OCSP playbook
       run: |
         ansible-playbook  -e 'pki_subsystem="ocsp"' tests/ansible/pki-playbook.yml 
       env:

tests/ansible/ocsp/tasks/certificate_self_validation_with_crl.yml

@@ -545,6 +545,10 @@
     container: "{{ ca_container }}"
     command: "pki -n caadmin  ca-cert-hold {{ ca_command.stdout | regex_search('\\s*Serial Number:\\s*(\\S*)', '\\1') | first }}  --force"
 
+- name: Wait for CRL propagation
+  ansible.builtin.pause:
+    seconds: 15
+
 - name: Restart OCSP
   community.docker.docker_container_exec:
     container: "{{ ocsp_container }}"
@@ -562,6 +566,10 @@
     container: "{{ ca_container }}"
     command: "pki -n caadmin  ca-cert-release-hold {{ ca_command.stdout | regex_search('\\s*Serial Number:\\s*(\\S*)', '\\1') | first }}  --force"
 
+- name: Wait for CRL propagation
+  ansible.builtin.pause:
+    seconds: 15
+
 - name: Restart OCSP 2 
   community.docker.docker_container_exec:
     container: "{{ ocsp_container }}"