name: CA Tests

on: [push, pull_request]

jobs:
  init:
    name: Initializing workflow
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.init.outputs.matrix }}
      repo: ${{ steps.init.outputs.repo }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Initialize workflow
        id: init
        env:
          BASE64_MATRIX: ${{ secrets.BASE64_MATRIX }}
          BASE64_REPO: ${{ secrets.BASE64_REPO }}
        run: |
          tests/bin/init-workflow.sh

  # docs/development/Building_PKI.md
  build:
    name: Building PKI
    needs: init
    runs-on: ubuntu-latest
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1

      - name: Build runner image
        uses: docker/build-push-action@v2
        with:
          context: .
          build-args: |
            OS_VERSION=${{ matrix.os }}
            COPR_REPO=${{ needs.init.outputs.repo }}
            BUILD_OPTS=--with-pkgs=base,server,ca,tests --with-timestamp --with-commit-id
          tags: pki-runner
          target: pki-runner
          outputs: type=docker,dest=/tmp/pki-runner.tar

      - name: Upload runner image
        uses: actions/upload-artifact@v2
        with:
          name: pki-runner-${{ matrix.os }}
          path: /tmp/pki-runner.tar

  # docs/installation/ca/Installing_CA.md
  ca-test:
    name: Testing CA
    needs: [init, build]
    runs-on: ubuntu-latest
    env:
      PKIDIR: /tmp/workdir/pki
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Download runner image
        uses: actions/download-artifact@v2
        with:
          name: pki-runner-${{ matrix.os }}
          path: /tmp

      - name: Load runner image
        run: docker load --input /tmp/pki-runner.tar

      - name: Run container
        run: |
          IMAGE=pki-runner \
          NAME=pki \
          HOSTNAME=pki.example.com \
          tests/bin/runner-init.sh

      - name: Install dependencies
        run: docker exec pki dnf install -y 389-ds-base

      - name: Install DS
        run: docker exec pki ${PKIDIR}/tests/bin/ds-create.sh

      - name: Install CA
        run: |
          docker exec pki pkispawn -f /usr/share/pki/server/examples/installation/ca.cfg -s CA -v
          # set buffer size to 0 so that revocation takes effect immediately
          docker exec pki pki-server ca-config-set auths.revocationChecking.bufferSize 0
          # enable signed audit log
          docker exec pki pki-server ca-config-set log.instance.SignedAudit.logSigning true
          # restart PKI server
          docker exec pki pki-server restart --wait

      - name: Run PKI healthcheck
        run: docker exec pki pki-healthcheck --debug

      - name: Initialize PKI client
        run: |
          docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
          docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec pki pki info

      - name: Test CA certs
        run: |
          docker exec pki /usr/share/pki/tests/ca/bin/test-ca-signing-cert.sh
          docker exec pki /usr/share/pki/tests/ca/bin/test-subsystem-cert.sh
          docker exec pki /usr/share/pki/tests/ca/bin/test-ca-certs.sh

      - name: Test CA admin
        run: |
          docker exec pki pki client-cert-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password-file /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
          docker exec pki pki -n caadmin ca-user-show caadmin

      - name: Test CA agent
        run: |
          docker exec pki /usr/share/pki/tests/ca/bin/ca-agent-create.sh
          docker exec pki /usr/share/pki/tests/ca/bin/ca-agent-cert-create.sh
          docker exec pki /usr/share/pki/tests/ca/bin/ca-agent-cert-revoke.sh
          docker exec pki /usr/share/pki/tests/ca/bin/ca-agent-cert-unrevoke.sh

      - name: Test CA auditor
        run: |
          docker exec pki /usr/share/pki/tests/ca/bin/test-ca-auditor-create.sh
          docker exec pki /usr/share/pki/tests/ca/bin/test-ca-auditor-cert.sh
          docker exec pki /usr/share/pki/tests/ca/bin/test-ca-auditor-logs.sh

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh pki
          tests/bin/pki-artifacts-save.sh pki
        continue-on-error: true

      - name: Remove CA
        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS
        run: docker exec pki ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ca-${{ matrix.os }}
          path: |
            /tmp/artifacts/pki

  # docs/installation/ca/Installing_CA_with_ECC.md
  ca-ecc-test:
    name: Testing CA with ECC
    needs: [init, build]
    runs-on: ubuntu-latest
    env:
      PKIDIR: /tmp/workdir/pki
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Download runner image
        uses: actions/download-artifact@v2
        with:
          name: pki-runner-${{ matrix.os }}
          path: /tmp

      - name: Load runner image
        run: docker load --input /tmp/pki-runner.tar

      - name: Run container
        run: |
          IMAGE=pki-runner \
          NAME=pki \
          HOSTNAME=pki.example.com \
          tests/bin/runner-init.sh

      - name: Install dependencies
        run: docker exec pki dnf install -y 389-ds-base

      - name: Install DS
        run: docker exec pki ${PKIDIR}/tests/bin/ds-create.sh

      - name: Install CA
        run: docker exec pki pkispawn -f /usr/share/pki/server/examples/installation/ca-ecc.cfg -s CA -v

      - name: Run PKI healthcheck
        run: docker exec pki pki-healthcheck --debug

      - name: Verify system keys
        run: |
          docker exec pki bash -c "echo Secret.123 > password.txt"
          docker exec pki certutil -K -d /etc/pki/pki-tomcat/alias -f password.txt
          echo "ec" > expected
          docker exec pki bash -c "certutil -K -d /etc/pki/pki-tomcat/alias -f password.txt | grep ca_signing | sed -n 's/<.*>\s\(\S\+\)\s.*/\1/p' > ${PKIDIR}/actual"
          diff expected actual
          docker exec pki bash -c "certutil -K -d /etc/pki/pki-tomcat/alias -f password.txt | grep ca_ocsp_signing | sed -n 's/<.*>\s\(\S\+\)\s.*/\1/p' > ${PKIDIR}/actual"
          diff expected actual
          docker exec pki bash -c "certutil -K -d /etc/pki/pki-tomcat/alias -f password.txt | grep ca_audit_signing | sed -n 's/<.*>\s\(\S\+\)\s.*/\1/p' > ${PKIDIR}/actual"
          diff expected actual
          docker exec pki bash -c "certutil -K -d /etc/pki/pki-tomcat/alias -f password.txt | grep subsystem | sed -n 's/<.*>\s\(\S\+\)\s.*/\1/p' > ${PKIDIR}/actual"
          diff expected actual
          docker exec pki bash -c "certutil -K -d /etc/pki/pki-tomcat/alias -f password.txt | grep sslserver | sed -n 's/<.*>\s\(\S\+\)\s.*/\1/p' > ${PKIDIR}/actual"
          diff expected actual

      - name: Verify CA admin
        run: |
          docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
          docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec pki pki client-cert-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password-file /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
          docker exec pki pki -n caadmin ca-user-show caadmin

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh pki
          tests/bin/pki-artifacts-save.sh pki
        continue-on-error: true

      - name: Remove CA
        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS
        run: docker exec pki ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ca-ecc-${{ matrix.os }}
          path: |
            /tmp/artifacts/pki

  # docs/installation/ca/Installing_Subordinate_CA.md
  subca-test:
    name: Testing subordinate CA
    needs: [init, build]
    runs-on: ubuntu-latest
    env:
      PKIDIR: /tmp/workdir/pki
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Download runner image
        uses: actions/download-artifact@v2
        with:
          name: pki-runner-${{ matrix.os }}
          path: /tmp

      - name: Load runner image
        run: docker load --input /tmp/pki-runner.tar

      - name: Create network
        run: docker network create example

      - name: Run root container
        run: |
          IMAGE=pki-runner \
          NAME=root \
          HOSTNAME=root.example.com \
          tests/bin/runner-init.sh

      - name: Connect root container to network
        run: docker network connect example root --alias root.example.com

      - name: Install dependencies in root container
        run: docker exec root dnf install -y 389-ds-base

      - name: Install DS in root container
        run: docker exec root ${PKIDIR}/tests/bin/ds-create.sh

      - name: Install root CA in root container
        run: docker exec root pkispawn -f /usr/share/pki/server/examples/installation/ca.cfg -s CA -v

      - name: Setup subordinate container
        run: |
          IMAGE=pki-runner \
          NAME=subordinate \
          HOSTNAME=sub.example.com \
          tests/bin/runner-init.sh

      - name: Connect subordinate container to network
        run: docker network connect example subordinate --alias sub.example.com

      - name: Install dependencies in subordinate container
        run: docker exec subordinate dnf install -y 389-ds-base

      - name: Install DS in subordinate container
        run: docker exec subordinate ${PKIDIR}/tests/bin/ds-create.sh

      - name: Install subordinate CA in subordinate container
        run: |
          docker exec root pki-server cert-export ca_signing --cert-file ${PKIDIR}/root-ca_signing.crt
          docker exec subordinate cp ${PKIDIR}/root-ca_signing.crt .
          docker exec subordinate pkispawn -f /usr/share/pki/server/examples/installation/subca.cfg -s CA -v

      - name: Run PKI healthcheck
        run: docker exec subordinate pki-healthcheck --debug

      - name: Verify CA admin
        run: |
          docker exec subordinate pki client-cert-import ca_signing --ca-cert root-ca_signing.crt
          docker exec subordinate pki client-cert-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password-file /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
          docker exec subordinate pki -n caadmin ca-user-show caadmin

      - name: Gather artifacts from root container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh root
          tests/bin/pki-artifacts-save.sh root
        continue-on-error: true

      - name: Gather artifacts from subordinate container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh subordinate
          tests/bin/pki-artifacts-save.sh subordinate
        continue-on-error: true

      - name: Remove subordinate CA from subordinate container
        run: docker exec subordinate pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS from subordinate container
        run: docker exec subordinate ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Disconnect subordinate container from network
        run: docker network disconnect example subordinate

      - name: Remove root CA from root container
        run: docker exec root pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS from root container
        run: docker exec root ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Disconnect root container from network
        run: docker network disconnect example root

      - name: Remove network
        run: docker network rm example

      - name: Upload artifacts from root container
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ca-root-${{ matrix.os }}
          path: |
            /tmp/artifacts/root

      - name: Upload artifacts from subordinate container
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ca-subordinate-${{ matrix.os }}
          path: |
            /tmp/artifacts/subordinate

  # docs/installation/ca/Installing_CA_with_External_CA_Signing_Certificate.md
  ca-external-cert-test:
    name: Testing CA with external signing certificate
    needs: [init, build]
    runs-on: ubuntu-latest
    env:
      PKIDIR: /tmp/workdir/pki
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Download runner image
        uses: actions/download-artifact@v2
        with:
          name: pki-runner-${{ matrix.os }}
          path: /tmp

      - name: Load runner image
        run: docker load --input /tmp/pki-runner.tar

      - name: Setup PKI container
        run: |
          IMAGE=pki-runner \
          NAME=pki \
          HOSTNAME=pki.example.com \
          tests/bin/runner-init.sh

      - name: Install dependencies
        run: docker exec pki dnf install -y 389-ds-base

      - name: Install DS
        run: docker exec pki ${PKIDIR}/tests/bin/ds-create.sh

      - name: Create root CA in NSS database
        run: |
          docker exec pki pki -d nssdb nss-cert-request \
              --subject "CN=Root CA Signing Certificate" \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --csr root-ca_signing.csr
          docker exec pki pki -d nssdb nss-cert-issue \
              --csr root-ca_signing.csr \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --cert root-ca_signing.crt
          docker exec pki pki -d nssdb nss-cert-import \
              --cert root-ca_signing.crt \
              --trust CT,C,C \
              root-ca_signing

      - name: Install subordinate CA
        run: |
          docker exec pki pkispawn -f /usr/share/pki/server/examples/installation/ca-external-cert-step1.cfg -s CA -v
          docker exec pki pki -d nssdb nss-cert-issue \
              --issuer root-ca_signing \
              --csr ca_signing.csr \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --cert ca_signing.crt
          docker exec pki pkispawn -f /usr/share/pki/server/examples/installation/ca-external-cert-step2.cfg -s CA -v

      - name: Run PKI healthcheck
        run: docker exec pki pki-healthcheck --debug

      - name: Verify CA admin
        run: |
          docker exec pki pki client-cert-import ca_signing --ca-cert root-ca_signing.crt
          docker exec pki pki client-cert-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password-file /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
          docker exec pki pki -n caadmin ca-user-show caadmin

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh pki
          tests/bin/pki-artifacts-save.sh pki
        continue-on-error: true

      - name: Remove subordinate CA
        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS
        run: docker exec pki ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ca-external-cert-${{ matrix.os }}
          path: |
            /tmp/artifacts/pki

  # docs/installation/ca/Installing_CA_with_Existing_Keys_in_Internal_Token.md
  ca-existing-certs-test:
    name: Testing CA with existing certificates
    needs: [init, build]
    runs-on: ubuntu-latest
    env:
      PKIDIR: /tmp/workdir/pki
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Download runner image
        uses: actions/download-artifact@v2
        with:
          name: pki-runner-${{ matrix.os }}
          path: /tmp

      - name: Load runner image
        run: docker load --input /tmp/pki-runner.tar

      - name: Setup PKI container
        run: |
          IMAGE=pki-runner \
          NAME=pki \
          HOSTNAME=pki.example.com \
          tests/bin/runner-init.sh

      - name: Install dependencies
        run: docker exec pki dnf install -y 389-ds-base

      - name: Install DS
        run: docker exec pki ${PKIDIR}/tests/bin/ds-create.sh

      - name: Create CA signing cert
        run: |
          docker exec pki pki -d nssdb nss-cert-request \
              --subject "CN=CA Signing Certificate" \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --csr ca_signing.csr
          docker exec pki pki -d nssdb nss-cert-issue \
              --csr ca_signing.csr \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --serial 1 \
              --cert ca_signing.crt
          docker exec pki pki -d nssdb nss-cert-import \
              --cert ca_signing.crt \
              --trust CT,C,C \
              ca_signing
          docker exec pki bash -c "certutil -K -d nssdb | grep ca_signing | sed 's/<.*>\s\+\S\+\s\+\(\S\+\).*/\1/' > ca_signing.key"

      - name: Create CA OCSP signing cert
        run: |
          docker exec pki pki -d nssdb nss-cert-request \
              --subject "CN=OCSP Signing Certificate" \
              --ext /usr/share/pki/server/certs/ocsp_signing.conf \
              --csr ca_ocsp_signing.csr
          docker exec pki pki -d nssdb nss-cert-issue \
              --issuer ca_signing \
              --csr ca_ocsp_signing.csr \
              --ext /usr/share/pki/server/certs/ocsp_signing.conf \
              --serial 2 \
              --cert ca_ocsp_signing.crt
          docker exec pki pki -d nssdb nss-cert-import \
              --cert ca_ocsp_signing.crt \
              ca_ocsp_signing
          docker exec pki bash -c "certutil -K -d nssdb | grep ca_ocsp_signing | sed 's/<.*>\s\+\S\+\s\+\(\S\+\).*/\1/' > ca_ocsp_signing.key"

      - name: Create CA audit signing cert
        run: |
          docker exec pki pki -d nssdb nss-cert-request \
              --subject "CN=Audit Signing Certificate" \
              --ext /usr/share/pki/server/certs/audit_signing.conf \
              --csr ca_audit_signing.csr
          docker exec pki pki -d nssdb nss-cert-issue \
              --issuer ca_signing \
              --csr ca_audit_signing.csr \
              --ext /usr/share/pki/server/certs/audit_signing.conf \
              --serial 3 \
              --cert ca_audit_signing.crt
          docker exec pki pki -d nssdb nss-cert-import \
              --cert ca_audit_signing.crt \
              --trust ,,P \
              ca_audit_signing
          docker exec pki bash -c "certutil -K -d nssdb | grep ca_audit_signing | sed 's/<.*>\s\+\S\+\s\+\(\S\+\).*/\1/' > ca_audit_signing.key"

      - name: Export CA certs
        run: |
          docker exec pki pki -d nssdb pkcs12-export \
              --pkcs12 ca-certs.p12 \
              --password Secret.123
          docker exec pki pki pkcs12-cert-find \
              --pkcs12 ca-certs.p12 \
              --password Secret.123

      - name: Install CA with existing certs
        run: |
          docker exec pki pkispawn -f /usr/share/pki/server/examples/installation/ca-existing-certs-step1.cfg -s CA -v
          sleep 1  # avoid pkispawn log conflict due to identical timestamps
          docker exec pki pkispawn -f /usr/share/pki/server/examples/installation/ca-existing-certs-step2.cfg -s CA -v

      - name: Run PKI healthcheck
        run: docker exec pki pki-healthcheck --debug

      - name: Verify CA keys
        run: |
          docker exec pki bash -c "echo Secret.123 > password.txt"
          docker exec pki bash -c "certutil -K -d /etc/pki/pki-tomcat/alias -f password.txt | grep ca_signing | sed 's/<.*>\s\+\S\+\s\+\(\S\+\).*/\1/' > ca_signing.key.new"
          docker exec pki diff ca_signing.key ca_signing.key.new
          docker exec pki bash -c "certutil -K -d /etc/pki/pki-tomcat/alias -f password.txt | grep ca_ocsp_signing | sed 's/<.*>\s\+\S\+\s\+\(\S\+\).*/\1/' > ca_ocsp_signing.key.new"
          docker exec pki diff ca_ocsp_signing.key ca_ocsp_signing.key.new
          docker exec pki bash -c "certutil -K -d /etc/pki/pki-tomcat/alias -f password.txt | grep ca_audit_signing | sed 's/<.*>\s\+\S\+\s\+\(\S\+\).*/\1/' > ca_audit_signing.key.new"
          docker exec pki diff ca_audit_signing.key ca_audit_signing.key.new

      - name: Verify CA admin
        run: |
          docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
          docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec pki pki client-cert-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password-file /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
          docker exec pki pki -n caadmin ca-user-show caadmin

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh pki
          tests/bin/pki-artifacts-save.sh pki
        continue-on-error: true

      - name: Remove CA
        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS
        run: docker exec pki ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ca-existing-certs-${{ matrix.os }}
          path: |
            /tmp/artifacts/pki

  # docs/installation/ca/Installing_CA_Clone.md
  ca-clone-test:
    name: Testing CA clone
    needs: [init, build]
    runs-on: ubuntu-latest
    env:
      PKIDIR: /tmp/workdir/pki
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Download runner image
        uses: actions/download-artifact@v2
        with:
          name: pki-runner-${{ matrix.os }}
          path: /tmp

      - name: Load runner image
        run: docker load --input /tmp/pki-runner.tar

      - name: Create network
        run: docker network create example

      - name: Run primary container
        run: |
          IMAGE=pki-runner \
          NAME=primary \
          HOSTNAME=primary.example.com \
          tests/bin/runner-init.sh

      - name: Connect primary container to network
        run: docker network connect example primary --alias primary.example.com

      - name: Install dependencies in primary container
        run: docker exec primary dnf install -y 389-ds-base

      - name: Install DS in primary container
        run: docker exec primary ${PKIDIR}/tests/bin/ds-create.sh

      - name: Install CA in primary container
        run: docker exec primary pkispawn -f /usr/share/pki/server/examples/installation/ca.cfg -s CA -v

      - name: Setup secondary container
        run: |
          IMAGE=pki-runner \
          NAME=secondary \
          HOSTNAME=secondary.example.com \
          tests/bin/runner-init.sh

      - name: Connect secondary container to network
        run: docker network connect example secondary --alias secondary.example.com

      - name: Install dependencies in secondary container
        run: docker exec secondary dnf install -y 389-ds-base

      - name: Install DS in secondary container
        run: docker exec secondary ${PKIDIR}/tests/bin/ds-create.sh

      - name: Install CA in secondary container
        run: |
          docker exec primary pki-server cert-export ca_signing --cert-file ${PKIDIR}/ca_signing.crt
          docker exec primary pki-server ca-clone-prepare --pkcs12-file ${PKIDIR}/ca-certs.p12 --pkcs12-password Secret.123
          docker exec secondary cp ${PKIDIR}/ca_signing.crt .
          docker exec secondary cp ${PKIDIR}/ca-certs.p12 .
          docker exec secondary pkispawn -f /usr/share/pki/server/examples/installation/ca-clone.cfg -s CA -v

      - name: Verify CA admin in secondary container
        run: |
          docker exec primary cp /root/.dogtag/pki-tomcat/ca_admin_cert.p12 ${PKIDIR}/ca_admin_cert.p12
          docker exec primary cp /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf ${PKIDIR}/pkcs12_password.conf
          docker exec secondary pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec secondary pki client-cert-import \
              --pkcs12 ${PKIDIR}/ca_admin_cert.p12 \
              --pkcs12-password-file ${PKIDIR}/pkcs12_password.conf
          docker exec secondary pki -n caadmin ca-user-show caadmin

      - name: Setup tertiary container
        run: |
          IMAGE=pki-runner \
          NAME=tertiary \
          HOSTNAME=tertiary.example.com \
          tests/bin/runner-init.sh

      - name: Connect tertiary container to network
        run: docker network connect example tertiary --alias tertiary.example.com

      - name: Install dependencies in tertiary container
        run: docker exec tertiary dnf install -y 389-ds-base

      - name: Install DS in tertiary container
        run: docker exec tertiary ${PKIDIR}/tests/bin/ds-create.sh

      - name: Install CA in tertiary container
        run: |
          docker exec secondary pki-server cert-export ca_signing --cert-file ${PKIDIR}/ca_signing.crt
          docker exec secondary pki-server ca-clone-prepare --pkcs12-file ${PKIDIR}/ca-certs.p12 --pkcs12-password Secret.123
          docker exec tertiary cp ${PKIDIR}/ca_signing.crt .
          docker exec tertiary cp ${PKIDIR}/ca-certs.p12 .
          docker exec tertiary pkispawn -f /usr/share/pki/server/examples/installation/ca-clone-of-clone.cfg -s CA -v

      - name: Verify CA admin in tertiary container
        run: |
          docker exec tertiary pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec tertiary pki client-cert-import \
              --pkcs12 ${PKIDIR}/ca_admin_cert.p12 \
              --pkcs12-password-file ${PKIDIR}/pkcs12_password.conf
          docker exec tertiary pki -n caadmin ca-user-show caadmin

      - name: Gather artifacts from primary container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh primary
          tests/bin/pki-artifacts-save.sh primary
        continue-on-error: true

      - name: Gather artifacts from secondary container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh secondary
          tests/bin/pki-artifacts-save.sh secondary
        continue-on-error: true

      - name: Gather artifacts from tertiary container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh tertiary
          tests/bin/pki-artifacts-save.sh tertiary
        continue-on-error: true

      - name: Remove CA from tertiary container
        run: docker exec tertiary pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS from tertiary container
        run: docker exec tertiary ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Disconnect tertiary container from network
        run: docker network disconnect example tertiary

      - name: Remove CA from secondary container
        run: docker exec secondary pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS from secondary container
        run: docker exec secondary ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Disconnect secondary container from network
        run: docker network disconnect example secondary

      - name: Remove CA from primary container
        run: docker exec primary pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS from primary container
        run: docker exec primary ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Disconnect primary container from network
        run: docker network disconnect example primary

      - name: Remove network
        run: docker network rm example

      - name: Upload artifacts from primary container
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ca-clone-primary-${{ matrix.os }}
          path: |
            /tmp/artifacts/primary

      - name: Upload artifacts from secondary container
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ca-clone-secondary-${{ matrix.os }}
          path: |
            /tmp/artifacts/secondary

      - name: Upload artifacts from tertiary container
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ca-clone-tertiary-${{ matrix.os }}
          path: |
            /tmp/artifacts/tertiary

  # docs/installation/ca/Installing_CA_with_Secure_Database_Connection.md
  ca-secure-ds-test:
    name: Testing CA with secure DS
    needs: [init, build]
    runs-on: ubuntu-latest
    env:
      PKIDIR: /tmp/workdir/pki
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Download runner image
        uses: actions/download-artifact@v2
        with:
          name: pki-runner-${{ matrix.os }}
          path: /tmp

      - name: Load runner image
        run: docker load --input /tmp/pki-runner.tar

      - name: Run container
        run: |
          IMAGE=pki-runner \
          NAME=pki \
          HOSTNAME=pki.example.com \
          tests/bin/runner-init.sh

      - name: Install dependencies
        run: docker exec pki dnf install -y 389-ds-base

      - name: Install DS
        run: docker exec pki ${PKIDIR}/tests/bin/ds-create.sh

      - name: Create DS signing cert
        run: |
          docker exec pki pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-request \
              --subject "CN=DS Signing Certificate" \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --csr ds_signing.csr
          docker exec pki pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-issue \
              --csr ds_signing.csr \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --cert ds_signing.crt
          docker exec pki pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-import \
              --cert ds_signing.crt \
              --trust CT,C,C \
              Self-Signed-CA
          docker exec pki certutil -L -d /etc/dirsrv/slapd-localhost

      - name: Create DS server cert
        run: |
          docker exec pki pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-request \
              --subject "CN=pki.example.com" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --csr ds_server.csr
          docker exec pki pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-issue \
              --issuer Self-Signed-CA \
              --csr ds_server.csr \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --cert ds_server.crt
          docker exec pki pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-import \
              --cert ds_server.crt \
              Server-Cert
          docker exec pki certutil -L -d /etc/dirsrv/slapd-localhost

      - name: Enable DS security
        run: |
          docker exec pki dsconf localhost config replace nsslapd-security=on
          docker exec pki dsctl localhost restart
          docker exec pki sleep 10
          docker exec -e LDAPTLS_CACERT=/ds_signing.crt pki ldapsearch -H ldaps://pki.example.com:636 -x -b "" -s base \* +

      - name: Install CA
        run: docker exec pki pkispawn -f /usr/share/pki/server/examples/installation/ca-secure-ds.cfg -s CA -v

      - name: Run PKI healthcheck
        run: docker exec pki pki-healthcheck --debug

      - name: Verify DS connection
        run: |
          docker exec pki pki-server ca-db-config-show > output
          cat output
          echo "pki.example.com" > expected
          sed -n 's/^\s\+Hostname:\s\+\(\S\+\)$/\1/p' output > actual
          diff expected actual
          echo "636" > expected
          sed -n 's/^\s\+Port:\s\+\(\S\+\)$/\1/p' output > actual
          diff expected actual
          echo "true" > expected
          sed -n 's/^\s\+Secure:\s\+\(\S\+\)$/\1/p' output > actual
          diff expected actual

      - name: Verify CA admin
        run: |
          docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
          docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec pki pki client-cert-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password-file /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
          docker exec pki pki -n caadmin ca-user-show caadmin

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh pki
          tests/bin/pki-artifacts-save.sh pki
        continue-on-error: true

      - name: Remove CA
        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS
        run: docker exec pki ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ca-secure-ds-${{ matrix.os }}
          path: |
            /tmp/artifacts/pki

  # docs/installation/ca/Installing_CA_Clone.md
  # docs/installation/ca/Installing_CA_with_Secure_Database_Connection.md
  ca-clone-secure-ds-test:
    name: Testing CA clone with secure DS
    needs: [init, build]
    runs-on: ubuntu-latest
    env:
      PKIDIR: /tmp/workdir/pki
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Download runner image
        uses: actions/download-artifact@v2
        with:
          name: pki-runner-${{ matrix.os }}
          path: /tmp

      - name: Load runner image
        run: docker load --input /tmp/pki-runner.tar

      - name: Create network
        run: docker network create example

      - name: Run primary container
        run: |
          IMAGE=pki-runner \
          NAME=primary \
          HOSTNAME=primary.example.com \
          tests/bin/runner-init.sh

      - name: Connect primary container to network
        run: docker network connect example primary --alias primary.example.com

      - name: Install dependencies in primary container
        run: docker exec primary dnf install -y 389-ds-base

      - name: Install DS in primary container
        run: docker exec primary ${PKIDIR}/tests/bin/ds-create.sh

      - name: Create DS signing cert in primary container
        run: |
          docker exec primary pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-request \
              --subject "CN=DS Signing Certificate" \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --csr ds_signing.csr
          docker exec primary pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-issue \
              --csr ds_signing.csr \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --cert ds_signing.crt
          docker exec primary pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-import \
              --cert ds_signing.crt \
              --trust CT,C,C \
              Self-Signed-CA
          docker exec primary certutil -L -d /etc/dirsrv/slapd-localhost

      - name: Create DS server cert in primary container
        run: |
          docker exec primary pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-request \
              --subject "CN=primary.example.com" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --csr ds_server.csr
          docker exec primary pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-issue \
              --issuer Self-Signed-CA \
              --csr ds_server.csr \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --cert ds_server.crt
          docker exec primary pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-import \
              --cert ds_server.crt \
              Server-Cert
          docker exec primary certutil -L -d /etc/dirsrv/slapd-localhost

      - name: Enable DS security in primary container
        run: |
          docker exec primary dsconf localhost config replace nsslapd-security=on
          docker exec primary dsctl localhost restart
          docker exec primary sleep 10
          docker exec -e LDAPTLS_CACERT=/ds_signing.crt primary ldapsearch -H ldaps://primary.example.com:636 -x -b "" -s base \* +

      - name: Install CA in primary container
        run: docker exec primary pkispawn -f /usr/share/pki/server/examples/installation/ca-secure-ds-primary.cfg -s CA -v

      - name: Run PKI healthcheck in primary container
        run: docker exec primary pki-healthcheck --debug

      - name: Verify DS connection in primary container
        run: |
          docker exec primary pki-server ca-db-config-show > output
          cat output
          echo "primary.example.com" > expected
          sed -n 's/^\s\+Hostname:\s\+\(\S\+\)$/\1/p' output > actual
          diff expected actual
          echo "636" > expected
          sed -n 's/^\s\+Port:\s\+\(\S\+\)$/\1/p' output > actual
          diff expected actual
          echo "true" > expected
          sed -n 's/^\s\+Secure:\s\+\(\S\+\)$/\1/p' output > actual
          diff expected actual

      - name: Verify CA admin in primary container
        run: |
          docker exec primary pki-server cert-export ca_signing --cert-file ca_signing.crt
          docker exec primary pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec primary pki client-cert-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password-file /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
          docker exec primary pki -n caadmin ca-user-show caadmin

      - name: Run secondary container
        run: |
          IMAGE=pki-runner \
          NAME=secondary \
          HOSTNAME=secondary.example.com \
          tests/bin/runner-init.sh

      - name: Connect secondary container to network
        run: docker network connect example secondary --alias secondary.example.com

      - name: Install dependencies in secondary container
        run: docker exec secondary dnf install -y 389-ds-base

      - name: Install DS in secondary container
        run: docker exec secondary ${PKIDIR}/tests/bin/ds-create.sh

      - name: Import DS signing cert into secondary container
        run: |
          docker exec primary pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              pkcs12-export \
              --pkcs12-file ${PKIDIR}/ds_signing.p12 \
              --pkcs12-password Secret.123 \
              Self-Signed-CA
          docker exec secondary pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              pkcs12-import \
              --pkcs12-file ${PKIDIR}/ds_signing.p12 \
              --pkcs12-password Secret.123
          docker exec secondary certutil -L -d /etc/dirsrv/slapd-localhost

      - name: Create DS server cert in secondary container
        run: |
          docker exec secondary pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-request \
              --subject "CN=secondary.example.com" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --csr ds_server.csr
          docker exec secondary pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-issue \
              --issuer Self-Signed-CA \
              --csr ds_server.csr \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --cert ds_server.crt
          docker exec secondary pki \
              -d /etc/dirsrv/slapd-localhost \
              -C /etc/dirsrv/slapd-localhost/pwdfile.txt \
              nss-cert-import \
              --cert ds_server.crt \
              Server-Cert
          docker exec secondary certutil -L -d /etc/dirsrv/slapd-localhost

      - name: Enable DS security in secondary container
        run: |
          docker exec secondary dsconf localhost config replace nsslapd-security=on
          docker exec secondary dsctl localhost restart
          docker exec secondary sleep 10
          docker exec secondary bash -c "certutil -L -d /etc/dirsrv/slapd-localhost -n Self-Signed-CA -a > ds_signing.crt"
          docker exec -e LDAPTLS_CACERT=/ds_signing.crt secondary ldapsearch -d 65535 -H ldaps://secondary.example.com:636 -x -b "" -s base \* +

      - name: Install CA in secondary container
        run: |
          docker exec primary pki-server cert-export ca_signing --cert-file ${PKIDIR}/ca_signing.crt
          docker exec primary pki-server ca-clone-prepare --pkcs12-file ${PKIDIR}/ca-certs.p12 --pkcs12-password Secret.123
          docker exec secondary cp ${PKIDIR}/ca_signing.crt .
          docker exec secondary cp ${PKIDIR}/ca-certs.p12 .
          docker exec secondary pkispawn -f /usr/share/pki/server/examples/installation/ca-secure-ds-secondary.cfg -s CA -v

      - name: Run PKI healthcheck in secondary container
        run: docker exec secondary pki-healthcheck --debug

      - name: Verify DS connection in secondary container
        run: |
          docker exec secondary pki-server ca-db-config-show > output
          cat output
          echo "secondary.example.com" > expected
          sed -n 's/^\s\+Hostname:\s\+\(\S\+\)$/\1/p' output > actual
          diff expected actual
          echo "636" > expected
          sed -n 's/^\s\+Port:\s\+\(\S\+\)$/\1/p' output > actual
          diff expected actual
          echo "true" > expected
          sed -n 's/^\s\+Secure:\s\+\(\S\+\)$/\1/p' output > actual
          diff expected actual

      - name: Verify CA admin in secondary container
        run: |
          docker exec primary cp /root/.dogtag/pki-tomcat/ca_admin_cert.p12 ${PKIDIR}/ca_admin_cert.p12
          docker exec primary cp /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf ${PKIDIR}/pkcs12_password.conf
          docker exec secondary pki-server cert-export ca_signing --cert-file ca_signing.crt
          docker exec secondary pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec secondary pki client-cert-import \
              --pkcs12 ${PKIDIR}/ca_admin_cert.p12 \
              --pkcs12-password-file ${PKIDIR}/pkcs12_password.conf
          docker exec secondary pki -n caadmin ca-user-show caadmin

      - name: Gather artifacts from primary container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh primary
          tests/bin/pki-artifacts-save.sh primary
        continue-on-error: true

      - name: Gather CA artifacts from secondary container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh secondary
          tests/bin/pki-artifacts-save.sh secondary
        continue-on-error: true

      - name: Remove CA from secondary container
        run: docker exec secondary pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS from secondary container
        run: docker exec secondary ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Remove CA from primary container
        run: docker exec primary pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS from primary container
        run: docker exec primary ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Upload artifacts from primary container
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ca-secure-ds-primary-${{ matrix.os }}
          path: |
            /tmp/artifacts/primary

      - name: Upload artifacts from secondary container
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ca-secure-ds-secondary-${{ matrix.os }}
          path: |
            /tmp/artifacts/secondary

  scep-test:
    name: Testing SCEP responder
    needs: [init, build]
    runs-on: ubuntu-latest
    env:
      PKIDIR: /tmp/workdir/pki
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Download runner image
        uses: actions/download-artifact@v2
        with:
          name: pki-runner-${{ matrix.os }}
          path: /tmp

      - name: Load runner image
        run: docker load --input /tmp/pki-runner.tar

      - name: Create network
        run: docker network create example

      - name: Run PKI container
        run: |
          IMAGE=pki-runner \
          NAME=pki \
          HOSTNAME=pki.example.com \
          tests/bin/runner-init.sh

      - name: Connect PKI container to network
        run: docker network connect example pki --alias pki.example.com

      - name: Run client container
        run: |
          IMAGE=pki-runner \
          NAME=client \
          HOSTNAME=client.example.com \
          tests/bin/runner-init.sh

      - name: Connect client container to network
        run: |
          docker network connect example client --alias client.example.com
          docker inspect -f '{{ .NetworkSettings.Networks.example.IPAddress }}' client > client.ip
          echo "Client's IP: `cat client.ip`"

      - name: Install dependencies in PKI container
        run: docker exec pki dnf install -y 389-ds-base

      - name: Install DS in PKI container
        run: docker exec pki ${PKIDIR}/tests/bin/ds-create.sh

      - name: Install CA in PKI container
        run: docker exec pki pkispawn -f /usr/share/pki/server/examples/installation/ca.cfg -s CA -v

      # https://github.com/dogtagpki/pki/wiki/Configuring-SCEP-Responder
      - name: Configure SCEP in CA
        run: |
          docker exec pki pki-server ca-config-set ca.scep.enable true
          docker exec pki bash -c "echo UID:$(cat client.ip) > /etc/pki/pki-tomcat/ca/flatfile.txt"
          docker exec pki bash -c "echo PWD:Secret.123 >> /etc/pki/pki-tomcat/ca/flatfile.txt"
          docker exec pki pki-server restart --wait

      # https://github.com/dogtagpki/pki/wiki/Building-SSCEP
      - name: Build SSCEP in client container
        run: |
          docker exec client dnf install -y autoconf automake libtool openssl-devel rpm-build
          docker exec client bash -c "mkdir -p ~/rpmbuild/SOURCES"
          docker exec client curl -JLOSs https://github.com/certnanny/sscep/archive/v0.9.0/tags/sscep-0.9.0.tar.gz
          docker exec client bash -c "mv sscep-0.9.0.tar.gz ~/rpmbuild/SOURCES"
          docker exec client curl -JLOSs https://raw.githubusercontent.com/certnanny/sscep/v0.9.0/scripts/sscep.spec
          docker exec client sed -i '/%build/ a ./bootstrap.sh' sscep.spec
          docker exec client rpmbuild -ba sscep.spec
          docker exec client bash -c "find ~/rpmbuild/RPMS -name *.rpm" > files
          docker exec client dnf localinstall -y $(cat files)
          docker exec client curl -JLOSs https://raw.githubusercontent.com/certnanny/sscep/v0.9.0/mkrequest
          docker exec client chmod +x mkrequest

      # https://github.com/dogtagpki/pki/wiki/Certificate-Enrollment-with-SSCEP
      - name: Get CA certificate using SSCEP
        run: |
          docker exec client sscep getca \
              -u http://pki.example.com:8080/ca/cgi-bin/pkiclient.exe \
              -c ca.crt
          docker exec client openssl x509 -text -noout -in ca.crt

      - name: Enroll certificate with IP address using SSCEP
        run: |
          docker exec client ./mkrequest -ip $(cat client.ip) Secret.123
          docker exec client openssl req -text -noout -in local.csr
          docker exec client sscep enroll \
              -u http://pki.example.com:8080/ca/cgi-bin/pkiclient.exe \
              -c ca.crt \
              -k local.key \
              -r local.csr \
              -l local.crt \
              -E 3des \
              -S sha256
          docker exec client openssl x509 -text -noout -in local.crt

      - name: Gather artifacts from PKI container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh pki
          tests/bin/pki-artifacts-save.sh pki

      - name: Remove CA from PKI container
        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS from PKI container
        run: docker exec pki ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: scep-${{ matrix.os }}
          path: |
            /tmp/artifacts/pki
