[CI] HttpCertificateCommandTests testGenerateMultipleCertificateWithNewCA failing

[elasticsearchmachine]

Build Scans:

• elasticsearch-periodic #7537 / encryption-at-rest
• elasticsearch-pull-request #67006 / part-4
• elasticsearch-periodic-platform-support #7545 / almalinux-8_platform-support-unix
• elasticsearch-intake #21508 / part4

Reproduction Line:

./gradlew ":x-pack:plugin:security:cli:test" --tests "org.elasticsearch.xpack.security.cli.HttpCertificateCommandTests.testGenerateMultipleCertificateWithNewCA" -Dtests.seed=3385ED15607E6F4B -Dtests.locale=en-VC -Dtests.timezone=Atlantic/Faroe -Druntime.java=24

Applicable branches:
9.0

Reproduces locally?:
N/A

Failure History:
See dashboard

Failure Message:

java.lang.AssertionError: keyUsage bit [5] not expected to be set: []
Expected: <false>
     but: was <true>

Issue Reasons:

• [9.0] 4 failures in test testGenerateMultipleCertificateWithNewCA (4.1% fail rate in 97 executions)

Note:
This issue was created using new test triage automation. Please report issues or feedback to es-delivery.

[elasticsearchmachine]

This has been muted on branch main

Mute Reasons:

• [main] 2 failures in test testGenerateMultipleCertificateWithNewCA (0.9% fail rate in 229 executions)

Build Scans:

• elasticsearch-periodic-platform-support #7539 / ubuntu-2404_platform-support-unix
• elasticsearch-pull-request #66900 / checkpart4_release-tests

[elasticsearchmachine]

Pinging @elastic/es-security (Team:Security)

[n1v0lg]

Should be related to #126376 -- @slobodanadamovic would you be able to take a quick look? (Just wanna make sure this is a test issue, not prod code, because feature freeze).

[n1v0lg]

The nice thing is it actually reproduces with:

./gradlew ":x-pack:plugin:security:cli:test" --tests "org.elasticsearch.xpack.security.cli.HttpCertificateCommandTests.testGenerateMultipleCertificateWithNewCA" -Dtests.seed=9741894DA1305379 -Dtests.locale=tr-Latn-TR -Dtests.timezone=Pacific/Enderbury -Druntime.java=24

on main

[n1v0lg]

Happens when caKeyUsage = randomSubsetOf(CertGenUtils.KEY_USAGE_MAPPINGS.keySet()); is empty.

[n1v0lg]

Right, makes sense we now set a value by default so it's a matter of a broken test expection, not a prod code issue. Assigning low-risk.