Description of problem:
When the CA attempts to build a CRL a search is performed that is different from previous versions and is now performing an unindexed search.  With a rather large database, this will cause the CRL to not generate as it will timeout before completion.


Version-Release number of selected component (if applicable):
pki-ca-10.5.16-6.el7_7.noarch

This appears to affect all the 10.x line.  

How reproducible:
Very

Steps to Reproduce:
1. Build generic CA
2. Start CA
3. It auto-generates a CRL on startup.

Actual results:

/var/log/dirsrv/slapd-rhcs/access
02/Mar/2020:12:35:39.413266718 -0500] conn=40 op=11 SRCH base="ou=certificateRepository,ou=ca,o=pki-tomcat-CA" scope=1 filter="(&(certStatus=REVOKED)(|(!(issuerName=*))(issuerName=CN=CA Signing Certificate,OU=pki-tomcat,O=example Security Domain)))" attrs="serialno revInfo objectClass"
[02/Mar/2020:12:35:39.413454492 -0500] conn=40 op=11 SORT serialno (0)
[02/Mar/2020:12:35:39.413464335 -0500] conn=40 op=11 VLV 0:100:A 0:0 (0)
[02/Mar/2020:12:35:39.413491873 -0500] conn=40 op=11 RESULT err=0 tag=101 nentries=0 etime=0.0000300364 notes=U

The new search now includes the filter of ' (|(!(issuerName=*))(issuerName=CN=CA Signing Certificate,OU=pki-tomcat,O=example Security Domain) '.

Expected results:
02/Mar/2020:12:35:39.413266718 -0500] conn=40 op=11 SRCH base="ou=certificateRepository,ou=ca,o=pki-tomcat-CA" scope=1 filter="(&(certStatus=REVOKED))" attrs="serialno revInfo objectClass"
[02/Mar/2020:12:35:39.413454492 -0500] conn=40 op=11 SORT serialno (0)
[02/Mar/2020:12:35:39.413464335 -0500] conn=40 op=11 VLV 0:100:A 0:0 (0)
[02/Mar/2020:12:35:39.413491873 -0500] conn=40 op=11 RESULT err=0 tag=101 nentries=0 etime=0.0000300364 

This is what the old search would filter.


Additional info:
The fix we performed was to create a new vlv index to include the above data.  It would be good to know if this change was intended or not.  Also, updating the vlv.ldif with the new index should be be intended.

dn: cn=allRevokedCaCertsCRL-{instanceId}, cn={database}, cn=ldbm database, cn=plugins, cn=config
objectClass: top
objectClass: vlvSearch
cn: allRevokedCaCertsCRL-{instanceId}
vlvBase: ou=certificateRepository,ou=ca,{rootSuffix}
vlvScope: 1
vlvFilter: (&(certStatus=REVOKED)(|(!(issuerName=*))(issuerName=CN=CA Signing Certificate,OU=pki-tomcat,O=example Security Domain)))