Skip to content

Commit b10a495

Browse files
committed
test: ensure /etc/pki/tls/cert.pem exists for 802 tests on EL10
https://issues.redhat.com/browse/RHEL-87511 The `system_ca_certs: true` flag in NM tells wpa_supplicant to load the legacy single‑file CA bundle (historically at /etc/pki/tls/cert.pem). Under CentOS Stream 9 (and RHEL 8), that path existed (either as a file or a symlink to the bundle), so the default “system” loading worked. On CentOS Stream 10 (RHEL 10), Red Hat switched to a hashed directory trust store and removed `/etc/pki/tls/cert.pem` to optimize OpenSSL performance as indicated in https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10-beta/html/10.0_beta_release_notes/removed-features and https://issues.redhat.com/browse/RHEL-50293. wpa_supplicant's "system_ca_certs" code still tries the old cert.pem path, sees "No such file or directory" and aborts the TLS setup: ``` OpenSSL: tls_connection_ca_cert - Failed to load root certificates - No such file or directory EAP‑TLS: Failed to initialize SSL. ``` Hence `system_ca_certs: true` silently fails on Stream 10 because there is no longer a single‑file CA bundle at that location. The new ansible-lint does not like variables in play names. Signed-off-by: Rich Megginson <[email protected]>
1 parent c8e10ac commit b10a495

File tree

2 files changed

+11
-1
lines changed

2 files changed

+11
-1
lines changed

tests/playbooks/run_tasks.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# SPDX-License-Identifier: BSD-3-Clause
22
---
3-
- name: Run the tasklist {{ task }}
3+
- name: Run the tasklist
44
hosts: all
55
tasks:
66
- name: Include the task '{{ task }}'

tests/playbooks/tests_802_1x.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,16 @@
6868
- name: Update ca trust
6969
command: update-ca-trust
7070
changed_when: false
71+
- name: Workaround for EL10 CA trust location
72+
shell:
73+
cmd: |
74+
set -euxo pipefail
75+
exec 1>&2
76+
if [ ! -f /etc/pki/tls/cert.pem ]; then
77+
ln -s /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /etc/pki/tls/cert.pem
78+
fi
79+
executable: /bin/bash
80+
changed_when: false
7181
- name: Import network role
7282
import_role:
7383
name: linux-system-roles.network

0 commit comments

Comments
 (0)