RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2192625 - Better catch of the IPA web UI event "IPA Error 4301:CertificateOperationError", and IPA httpd error CertificateOperationError
Summary: Better catch of the IPA web UI event "IPA Error 4301:CertificateOperationErro...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: ipa
Version: 9.2
Hardware: All
OS: Unspecified
urgent
medium
Target Milestone: rc
: ---
Assignee: Rob Crittenden
QA Contact: Mohammad Rizwan
URL:
Whiteboard:
Depends On: 1959057 2164348
Blocks: 2164347
TreeView+ depends on / blocked
 
Reported: 2023-05-02 14:46 UTC by Rob Crittenden
Modified: 2024-03-07 04:25 UTC (History)
16 users (show)

Fixed In Version: ipa-4.10.2-1.el9
Doc Type: No Doc Update
Doc Text:
Clone Of: 2164348
Environment:
Last Closed: 2023-11-07 08:34:04 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker FREEIPA-9836 0 None None None 2023-05-02 14:47:20 UTC
Red Hat Issue Tracker RHELPLAN-156215 0 None None None 2023-05-02 14:47:31 UTC
Red Hat Product Errata RHBA-2023:6477 0 None None None 2023-11-07 08:34:39 UTC

Comment 2 Florence Blanc-Renaud 2023-05-16 11:11:05 UTC 
Fixed upstream
master:
https://pagure.io/freeipa/c/9e80616401fe878f4db9dcd5b6188c0b2039db53
Comment 3 Florence Blanc-Renaud 2023-05-16 15:35:49 UTC 
Fixed upstream
ipa-4-9:
https://pagure.io/freeipa/c/b9b268e5ed497400b3525b0eec95e2ae4f039526
Comment 4 Rob Crittenden 2023-05-16 20:24:48 UTC 
Fixed upstream
ipa-4-10:
https://pagure.io/freeipa/c/81a6b9ad2d42fecdd94e17fa7c888bbdea2daf3c
Comment 10 Mohammad Rizwan 2023-06-26 12:20:18 UTC 
version:
ipa-server-4.10.2-1.el9.x86_64

Steps:
https://bugzilla.redhat.com/show_bug.cgi?id=2164348#c4

Actual result:

when number if cert is > nssizelimit

[root@master ~]# ldapmodify -D cn=Directory\ Manager -w Secret123
dn: uid=pkidbuser,ou=people,o=ipaca
changetype: modify
add: nssizelimit
nssizelimit: 100

modifying entry "uid=pkidbuser,ou=people,o=ipaca"


^C
[root@master ~]# ipactl restart
Restarting Directory Service
Restarting krb5kdc Service
Restarting kadmin Service
Restarting named Service
Restarting httpd Service
Restarting ipa-custodia Service
Restarting pki-tomcatd Service
Restarting ipa-otpd Service
Restarting ipa-dnskeysyncd Service
ipa: INFO: The ipactl command was successful
[root@master ~]# ipa cert-find
ipa: ERROR: Certificate operation cannot be completed: Unable to search for certificates (500)
[root@master ~]# 
[root@master ~]# 

when number of cert < nssizelimit

[root@master ~]# ldapmodify -D cn=Directory\ Manager -w Secret123
dn: uid=pkidbuser,ou=people,o=ipaca
changetype: modify
replace: nssizelimit
nssizelimit: 200

modifying entry "uid=pkidbuser,ou=people,o=ipaca"

^C
[root@master ~]# ipactl restart
Restarting Directory Service
Restarting krb5kdc Service
Restarting kadmin Service
Restarting named Service
Restarting httpd Service
Restarting ipa-custodia Service
Restarting pki-tomcatd Service
Restarting ipa-otpd Service
Restarting ipa-dnskeysyncd Service
ipa: INFO: The ipactl command was successful
[root@master ~]# 
[root@master ~]# ipa cert-find
------------------------
100 certificates matched
------------------------


[..]

  Issuing CA: ipa
  Subject: CN=user88,O=TESTREALM.TEST
  Issuer: CN=Certificate Authority,O=TESTREALM.TEST
  Not Before: Mon Jun 26 11:32:56 2023 UTC
  Not After: Thu Jun 26 11:32:56 2025 UTC
  Serial number: 100
  Serial number (hex): 0x64
  Status: VALID
  Revoked: False
------------------------------
Number of entries returned 100
------------------------------
[root@master ~]#


Based on above observations, marking the bug verified.
Comment 13 errata-xmlrpc 2023-11-07 08:34:04 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (ipa bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6477
Comment 14 Red Hat Bugzilla 2024-03-07 04:25:46 UTC 
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days
Note You need to log in before you can comment on or make changes to this bug.