IPAOpenSSLChainValidation: ignore default trust store

The check IPAOpenSSLChainValidation is ensuring that the
whole certification chain is present in IPA for httpd and RA
certificates.
It internally calls openssl verify -CAfile /etc/ipa/ca.crt.

With the latest version of ca-certificates package, openssl
verify also uses the default trust store. Since the
test wants to check the chain presence in /etc/ipa/ca.crt, add
the -no-CAfile -no-CApath and -no-CAstore options to ensure that
only /etc/ipa/ca.crt is used as trusted source.

Fixes: #340

Signed-off-by: Florence Blanc-Renaud <[email protected]>

src/ipahealthcheck/ipa/certs.py

@@ -1074,6 +1074,7 @@ def validate_openssl(self, file):
                 '-verbose',
                 '-show_chain',
                 '-CAfile', paths.IPA_CA_CRT,
+                '-no-CAfile', '-no-CApath', '-no-CAstore',
                 file]
 
         return ipautil.run(args, raiseonerr=False)