Issue observed when test started failing with error in RHEL-10.1:

def test_opensslchainvalidation_ipa_ca_cert(self, replace_ipa_chain):
"""
Test for IPAOpenSSLChainValidation when /etc/ipa/ca.crt
contains IPA CA cert but not the external CA
"""
version = tasks.get_healthcheck_version(self.master)
error_msg = "Certificate validation for

failed:

"
error_reason = (
"CN = Certificate Authority\nerror 2 at 1 depth "
"lookup: unable to get issuer certificate\n"
)
returncode, data = run_healthcheck(
self.master,
"ipahealthcheck.ipa.certs",
"IPAOpenSSLChainValidation",
)
> assert returncode == 1
E assert 0 == 1

After investigation the error is likely related to this issue: https://github.com/freeipa/freeipa-healthcheck/issues/340

which was fixed with ipa-healthcheck 0.18 with this commit: https://github.com/rcritten/freeipa-healthcheck/commit/8af886c515c2e3bc8a2233202c275f6ca9c87b3b

On RHEL 10.1 we have ipa-healthcheck 0.16 and the patch was not backported.