I think this tests is simply wrong.
When a PIN is given, the program should run in batch mode.
So the question for "Enter password" should _not_ be present.

--- a/tests/cert-tests/certtool	2019-02-07 07:33:45.960887338 +0000
+++ b/tests/cert-tests/certtool	2019-02-07 07:36:14.550955051 +0000
@@ -49,7 +49,7 @@
 
 	#check whether password is being honoured
 	#some CI runners need GNUTLS_PIN (GNUTLS_PIN=${PASS})
-	${SETSID} "${CERTTOOL}" --generate-self-signed --load-privkey ${TMPFILE1} --template ${srcdir}/templates/template-test.tmpl --ask-pass >${TMPFILE2} 2>&1 <<EOF
+	GNUTLS_PIN=${PASS} ${SETSID} "${CERTTOOL}" --generate-self-signed --load-privkey ${TMPFILE1} --template ${srcdir}/templates/template-test.tmpl --ask-pass >${TMPFILE2} 2>&1 <<EOF
 $PASS
 EOF
 	if test $? != 0;then
@@ -59,7 +59,7 @@
 	fi
 
 	grep "Enter password" ${TMPFILE2} >/dev/null 2>&1
-	if test $? != 0;then
+	if test $? != 1; then
 		cat ${TMPFILE2}
 		echo "No password was asked"
 		exit 1