freeipa also needs a backport to Fedora 32 as this version is still supported, and the current version shipped in fc32 is 1:1.1.1i-1.fc32, which contains the issue.
Could you also build the fix for fedora32?

Thanks

+++ This bug was initially created as a clone of Bug #1916594 +++

Description of problem:
Fedora rawhide, 33 and 32 are now shipping openssl 1.1.1i that contains a regression in X509_verify_cert. The regression causes verification of a self-signed certificate to fail, and that prevents WebUI authentication in FreeIPA (see freeipa issue https://pagure.io/freeipa/issue/8632).

The regression has already been reported upstream as https://github.com/openssl/openssl/issues/13739 and a fix is available upstream (PR https://github.com/openssl/openssl/pull/13749 merged in commit https://github.com/openssl/openssl/commit/76ed0c0ad119569f6e6f6c96b27b76d3b110413b).

FreeIPA now needs the fix in Fedora rawhide, 33 and 32.

Version-Release number of selected component (if applicable):
openssl-1.1.1i-1.fc34 / openssl-1.1.1i-1.fc33 / openssl-1.1.1i-1.fc32 

How reproducible:
Always

Steps to Reproduce:
1. configure a freeipa server CA less with --no-pkinit option
2. login to webui https://host.ipa.test/ipa/ui

Actual results:
the login fails

Expected results:
login should be successful

--- Additional comment from Sahana Prasad on 2021-01-15 18:09:53 UTC ---

I will update the Fedora builds shortly.