From 3b9a1d0d6414613f1ebb8b8fdb480465658361a3 Mon Sep 17 00:00:00 2001
From: ohemorange <erica@eff.org>
Date: Fri, 23 Jan 2026 14:09:38 -0800
Subject: [PATCH] Update integration tests to account for default key type
 changed to ecdsa (#10546)

Fixes #10423.

In
https://github.com/certbot/certbot/pull/10409#issuecomment-3180214385,
we noted that a comment in
`certbot-ci/src/certbot_integration_tests/certbot_tests/test_main.py:test_renew_with_ec_keys`
says:

> since ecdsa is now default, the integration test is not actually
testing "When running non-interactively, if --key-type is unspecified
but the default value differs to the lineage key type, Certbot should
keep the lineage key type." as it says in the comment. To fix that, it
should be initially created with rsa, not ecdsa.

That is no longer accurate, since the default key type changed to
ecdsda.

This PR adds a new test that does what the comment specifies, and
updates the comment to reflect that the existing test no longer does
that.
---
 .../certbot_tests/test_main.py                | 31 +++++++++++++++++--
 1 file changed, 28 insertions(+), 3 deletions(-)

diff --git a/certbot-ci/src/certbot_integration_tests/certbot_tests/test_main.py b/certbot-ci/src/certbot_integration_tests/certbot_tests/test_main.py
index a25c336cb..93dd2bd37 100644
--- a/certbot-ci/src/certbot_integration_tests/certbot_tests/test_main.py
+++ b/certbot-ci/src/certbot_integration_tests/certbot_tests/test_main.py
@@ -415,6 +415,29 @@ def test_renew_with_changed_private_key_complexity(context: IntegrationTestsCont
     key3 = join(context.config_dir, 'archive', certname, 'privkey3.pem')
     assert_rsa_key(key3, 2048)
 
+def test_certonly_non_default_key_size_kept(context: IntegrationTestsContext) -> None:
+    """Test that certonly keeps key type but uses default key size when unspecified."""
+
+    # create rsa 4096 key cert
+    certname = context.get_domain('renew')
+    context.certbot([
+        'certonly',
+        '--cert-name', certname,
+        '--key-type', 'rsa', '--rsa-key-size', '4096',
+        '--force-renewal', '-d', certname,
+    ])
+    key1 = join(context.config_dir, "archive", certname, 'privkey1.pem')
+    assert_rsa_key(key1, 4096)
+    assert_cert_count_for_lineage(context.config_dir, certname, 1)
+    assert_saved_lineage_option(context.config_dir, certname, 'key_type', 'rsa')
+
+    # When running non-interactively, if --key-type is unspecified but the default value differs
+    # to the lineage key type, Certbot should keep the lineage key type. The key size will still
+    # change to the default value, in order to stay consistent with the behavior of certonly.
+    context.certbot(['certonly', '--force-renewal', '-d', certname])
+    key2 = join(context.config_dir, 'archive', certname, 'privkey2.pem')
+    assert_rsa_key(key2, 2048)
+
 
 def test_renew_ignoring_directory_hooks(context: IntegrationTestsContext) -> None:
     """Test hooks are ignored during renewal with relevant CLI flag."""
@@ -742,6 +765,7 @@ def test_ecdsa_curves(context: IntegrationTestsContext, curve: str,
 
 def test_renew_with_ec_keys(context: IntegrationTestsContext) -> None:
     """Test proper renew with updated private key complexity."""
+    # create ecdsa 256 key cert
     certname = context.get_domain('renew')
     context.certbot([
         'certonly',
@@ -755,15 +779,16 @@ def test_renew_with_ec_keys(context: IntegrationTestsContext) -> None:
     assert_cert_count_for_lineage(context.config_dir, certname, 1)
     assert_saved_lineage_option(context.config_dir, certname, 'key_type', 'ecdsa')
 
+    # renew using 384 ecdsa key instead
     context.certbot(['renew', '--elliptic-curve', 'secp384r1'])
     assert_cert_count_for_lineage(context.config_dir, certname, 2)
     key2 = join(context.config_dir, 'archive', certname, 'privkey2.pem')
     assert 280 < os.stat(key2).st_size < 320  # ec keys of 384 bits are ~310 bytes
     assert_elliptic_key(key2, SECP384R1)
 
-    # When running non-interactively, if --key-type is unspecified but the default value differs
-    # to the lineage key type, Certbot should keep the lineage key type. The curve will still
-    # change to the default value, in order to stay consistent with the behavior of certonly.
+    # When running non-interactively, if --key-type is unspecified, Certbot should keep the
+    # lineage key type. The curve will still change to the default value, in order to stay
+    # consistent with the behavior of certonly.
     context.certbot(['certonly', '--force-renewal', '-d', certname])
     key3 = join(context.config_dir, 'archive', certname, 'privkey3.pem')
     assert 200 < os.stat(key3).st_size < 250  # ec keys of 256 bits are ~225 bytes