software/erp5/test: check backend is serving using a caucase managed certificate

software/erp5/test/test/test_erp5.py

@@ -30,6 +30,7 @@ import json
 import glob
 import urlparse
 import socket
+import tempfile
 import time
 
 import psutil
@@ -54,17 +55,31 @@ class TestPublishedURLIsReachableMixin(object):
     # retry in a loop.
     # If we can move the "create site" in slapos node instance, then this retry loop
     # would not be necessary.
-    for i in range(1, 60):
-      r = requests.get(url, verify=False)  # XXX can we get CA from caucase already ?
-      if r.status_code in (requests.codes.service_unavailable,
-                           requests.codes.not_found):
-        delay = i * 2
-        self.logger.warn("ERP5 was not available, sleeping for %ds and retrying", delay)
-        time.sleep(delay)
-        continue
-      if r.status_code != requests.codes.ok:
-        r.raise_for_status()
-      break
+
+    # browse caucase HAL to get the CA certificate for services
+    caucase_hal = requests.get(
+        self.getRootPartitionConnectionParameterDict()['caucase-http-url']).json()
+    caucase_cas_hal = requests.get(
+        caucase_hal['_links']['getCASHAL']['href']).json()
+
+    caucase_cas_ca = requests.get(caucase_cas_hal['_links']['getCACertificate']['href']).text
+    self.assertIn('-----BEGIN CERTIFICATE-----', caucase_cas_ca)
+
+    with tempfile.NamedTemporaryFile() as cas_ca_file:
+      cas_ca_file.write(caucase_cas_ca)
+      cas_ca_file.flush()
+      import pdb; pdb.set_trace()
+      for i in range(1, 60):
+        r = requests.get(url, verify=cas_ca_file.name)
+        if r.status_code in (requests.codes.service_unavailable,
+                             requests.codes.not_found):
+          delay = i * 2
+          self.logger.warn("ERP5 was not available, sleeping for %ds and retrying", delay)
+          time.sleep(delay)
+          continue
+        if r.status_code != requests.codes.ok:
+          r.raise_for_status()
+        break
 
     self.assertIn("ERP5", r.text)