Merge branch '43794-fix-domain-verification-validation-errors' into 'master'

Resolve "ActiveRecord::RecordInvalid: Validation failed: Certificate misses intermediates"

Closes #43794

See merge request gitlab-org/gitlab-ce!17992

app/services/verify_pages_domain_service.rb

@@ -34,7 +34,8 @@ class VerifyPagesDomainService < BaseService
     # Prevent any pre-existing grace period from being truncated
     reverify = [domain.enabled_until, VERIFICATION_PERIOD.from_now].compact.max
 
-    domain.update!(verified_at: Time.now, enabled_until: reverify)
+    domain.assign_attributes(verified_at: Time.now, enabled_until: reverify)
+    domain.save!(validate: false)
 
     if was_disabled
       notify(:enabled)
@@ -47,7 +48,9 @@ class VerifyPagesDomainService < BaseService
 
   def unverify_domain!
     if domain.verified?
-      domain.update!(verified_at: nil)
+      domain.assign_attributes(verified_at: nil)
+      domain.save!(validate: false)
+
       notify(:verification_failed)
     end
 
@@ -55,7 +58,8 @@ class VerifyPagesDomainService < BaseService
   end
 
   def disable_domain!
-    domain.update!(verified_at: nil, enabled_until: nil)
+    domain.assign_attributes(verified_at: nil, enabled_until: nil)
+    domain.save!(validate: false)
 
     notify(:disabled)
 

changelogs/unreleased/43794-fix-domain-verification-validation-errors.yml

+---
+title: Avoid validation errors when running the Pages domain verification service
+merge_request: 17992
+author:
+type: fixed

spec/services/verify_pages_domain_service_spec.rb

@@ -93,6 +93,25 @@ describe VerifyPagesDomainService do
           expect(domain).not_to be_enabled
         end
       end
+
+      context 'invalid domain' do
+        let(:domain) { build(:pages_domain, :expired, :with_missing_chain) }
+
+        before do
+          domain.save(validate: false)
+        end
+
+        it 'can be disabled' do
+          error_status[:message] += '. It is now disabled.'
+
+          stub_resolver
+
+          expect(service.execute).to eq(error_status)
+
+          expect(domain).not_to be_verified
+          expect(domain).not_to be_enabled
+        end
+      end
     end
 
     context 'timeout behaviour' do