def test_disable_reenable_signing_master(self):
        dnskey_old = resolve_with_dnssec(self.master.ip, test_zone,
                                         rtype="DNSKEY").rrset

        # disable DNSSEC signing of zone on master
        args = [
            "ipa",
            "dnszone-mod", test_zone,
            "--dnssec", "false",
        ]
        self.master.run_command(args)

        time.sleep(DNSSEC_SLEEP)

        # test master
        assert not is_record_signed(
            self.master.ip, test_zone
        ), "Zone %s is still signed (master)" % test_zone

        # test replica
        assert not is_record_signed(
            self.replicas[0].ip, test_zone
        ), "DNS zone %s is still signed (replica)" % test_zone

        # reenable DNSSEC signing
        args = [
            "ipa",
            "dnszone-mod", test_zone,
            "--dnssec", "true",
        ]
        self.master.run_command(args)

        # TODO: test require restart
        tasks.restart_named(self.master, self.replicas[0])
        # test master
        assert wait_until_record_is_signed(
            self.master.ip, test_zone, timeout=100
        ), "Zone %s is not signed (master)" % test_zone

        # test replica
        assert wait_until_record_is_signed(
            self.replicas[0].ip, test_zone, timeout=200
        ), "DNS zone %s is not signed (replica)" % test_zone

        dnskey_new = resolve_with_dnssec(self.master.ip, test_zone,
                                         rtype="DNSKEY").rrset
>       assert dnskey_old != dnskey_new, "DNSKEY should be different"
E       AssertionError: DNSKEY should be different
E       assert <DNS dnssec.test. IN DNSKEY RRset: [<256 3 8 AwEAAcroCbPsyDr7Fx2bF80xLljKpn1A WZxrFSHlcik8fRVcAx+RIcVeB50mjeJ0 2VfUsYd...QYJx2i...>, <257 3 8 AwEAAbePaB5f2dA+vcCaJ1b0PUs6cTEZ kc3ydY7Pl1DmQfayN0hbaSKbKf84ETCG 3fkLfzWWhSITp7IJi6tPGlivBJ...>]> != <DNS dnssec.test. IN DNSKEY RRset: [<256 3 8 AwEAAcroCbPsyDr7Fx2bF80xLljKpn1A WZxrFSHlcik8fRVcAx+RIcVeB50mjeJ0 2VfUsYd...QYJx2i...>, <257 3 8 AwEAAbePaB5f2dA+vcCaJ1b0PUs6cTEZ kc3ydY7Pl1DmQfayN0hbaSKbKf84ETCG 3fkLfzWWhSITp7IJi6tPGlivBJ...>]>

test_integration/test_dnssec.py:234: AssertionError

    def test_disable_reenable_signing_replica(self):
        dnskey_old = resolve_with_dnssec(self.replicas[0].ip, test_zone_repl,
                                         rtype="DNSKEY").rrset

        # disable DNSSEC signing of zone on replica
        args = [
            "ipa",
            "dnszone-mod", test_zone_repl,
            "--dnssec", "false",
        ]
        self.master.run_command(args)

        time.sleep(DNSSEC_SLEEP)

        # test master
        assert not is_record_signed(
            self.master.ip, test_zone_repl
        ), "Zone %s is still signed (master)" % test_zone_repl

        # test replica
        assert not is_record_signed(
            self.replicas[0].ip, test_zone_repl
        ), "DNS zone %s is still signed (replica)" % test_zone_repl

        # reenable DNSSEC signing
        args = [
            "ipa",
            "dnszone-mod", test_zone_repl,
            "--dnssec", "true",
        ]
        self.master.run_command(args)

        # TODO: test require restart
        tasks.restart_named(self.master, self.replicas[0])
        # test master
        assert wait_until_record_is_signed(
            self.master.ip, test_zone_repl, timeout=100
        ), "Zone %s is not signed (master)" % test_zone_repl

        # test replica
        assert wait_until_record_is_signed(
            self.replicas[0].ip, test_zone_repl, timeout=200
        ), "DNS zone %s is not signed (replica)" % test_zone_repl

        dnskey_new = resolve_with_dnssec(self.replicas[0].ip, test_zone_repl,
                                         rtype="DNSKEY").rrset
>       assert dnskey_old != dnskey_new, "DNSKEY should be different"
E       AssertionError: DNSKEY should be different
E       assert <DNS dnssec-replica.test. IN DNSKEY RRset: [<257 3 8 AwEAAdb++F5pPAgJO0pojkS23Npm+0/h 01yPETkRlL20qNVE7IGTJmm8crIpyLcZ...5N48hA...>, <256 3 8 AwEAAcVNpVvMuHrRv9bDVkLh/L0DzX0v moCpr9N0p1qDI0uZWLyvJVJ6iVG8bXqo D+DgXPpenCA+HYy6/+UKvKshEk...>]> != <DNS dnssec-replica.test. IN DNSKEY RRset: [<257 3 8 AwEAAdb++F5pPAgJO0pojkS23Npm+0/h 01yPETkRlL20qNVE7IGTJmm8crIpyLcZ...5N48hA...>, <256 3 8 AwEAAcVNpVvMuHrRv9bDVkLh/L0DzX0v moCpr9N0p1qDI0uZWLyvJVJ6iVG8bXqo D+DgXPpenCA+HYy6/+UKvKshEk...>]>

test_integration/test_dnssec.py:282: AssertionError