[Bug]: flaky failure on slow systems: FAIL: TestBootstrapClientServerRotation (19.30s)

[jas4711]

Steps to Reproduce

Run self-tests on a slow system

Your Environment

• OS - Debian sid on s390x
• step-ca Version - 0.28.4

Expected Behavior

PASS

Actual Behavior

275s === RUN   TestBootstrapClientServerRotation
275s 2025/11/01 16:35:56 Building new tls configuration using step-ca x509 Signer Interface
275s 2025/11/01 16:35:56 Serving HTTPS on 127.0.0.1:33065 ...
275s 2025/11/01 16:36:04 Building new tls configuration using step-ca x509 Signer Interface
275s 2025/11/01 16:36:05 Serving HTTPS on 127.0.0.1:33065 ...
275s 2025/11/01 16:36:10 Building new tls configuration using step-ca x509 Signer Interface
275s 2025/11/01 16:36:10 Serving HTTPS on 127.0.0.1:33065 ...
275s 2025/11/01 16:36:15 Building new tls configuration using step-ca x509 Signer Interface
275s 2025/11/01 16:36:15 Serving HTTPS on 127.0.0.1:33065 ...
275s 2025/11/01 16:36:15 /usr/lib/go-1.24/src/net/http/server.go:3638: http: TLS handshake error from 127.0.0.1:36882: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2025-11-01T16:36:15Z is after 2025-11-01T16:36:15Z
275s 2025/11/01 16:36:15 /usr/lib/go-1.24/src/net/http/server.go:3638: http: TLS handshake error from 127.0.0.1:36894: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2025-11-01T16:36:15Z is after 2025-11-01T16:36:15Z
275s     bootstrap_test.go:509: Test with rotate-ca-3.json failed: client.Post() failed: Post "https://127.0.0.1:33065/renew": remote error: tls: expired certificate
275s --- FAIL: TestBootstrapClientServerRotation (19.30s)

Additional Context

Looks like the test takes >1s so the cert expiry check fails?

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[jas4711]

Full build log here:

https://ci.debian.net/packages/g/golang-github-smallstep-certificates/testing/s390x/65722145/

[hslatman]

Hey @jas4711,

Thank you for opening the issue. The test is skipped in our CI: https://github.com/smallstep/certificates/blob/master/ca/bootstrap_test.go#L381-L385. My guess is this env var is not set in the builds your runner creates. Is it an option to do so?

For fixing the root case we have an existing issue: #873. I believe the issue is broader than just running the test on a slow machine.