Fixed upstream master: https://pagure.io/freeipa/c/9e80616401fe878f4db9dcd5b6188c0b2039db53
Fixed upstream ipa-4-9: https://pagure.io/freeipa/c/b9b268e5ed497400b3525b0eec95e2ae4f039526
Fixed upstream ipa-4-10: https://pagure.io/freeipa/c/81a6b9ad2d42fecdd94e17fa7c888bbdea2daf3c
version: ipa-server-4.10.2-1.el9.x86_64 Steps: https://bugzilla.redhat.com/show_bug.cgi?id=2164348#c4 Actual result: when number if cert is > nssizelimit [root@master ~]# ldapmodify -D cn=Directory\ Manager -w Secret123 dn: uid=pkidbuser,ou=people,o=ipaca changetype: modify add: nssizelimit nssizelimit: 100 modifying entry "uid=pkidbuser,ou=people,o=ipaca" ^C [root@master ~]# ipactl restart Restarting Directory Service Restarting krb5kdc Service Restarting kadmin Service Restarting named Service Restarting httpd Service Restarting ipa-custodia Service Restarting pki-tomcatd Service Restarting ipa-otpd Service Restarting ipa-dnskeysyncd Service ipa: INFO: The ipactl command was successful [root@master ~]# ipa cert-find ipa: ERROR: Certificate operation cannot be completed: Unable to search for certificates (500) [root@master ~]# [root@master ~]# when number of cert < nssizelimit [root@master ~]# ldapmodify -D cn=Directory\ Manager -w Secret123 dn: uid=pkidbuser,ou=people,o=ipaca changetype: modify replace: nssizelimit nssizelimit: 200 modifying entry "uid=pkidbuser,ou=people,o=ipaca" ^C [root@master ~]# ipactl restart Restarting Directory Service Restarting krb5kdc Service Restarting kadmin Service Restarting named Service Restarting httpd Service Restarting ipa-custodia Service Restarting pki-tomcatd Service Restarting ipa-otpd Service Restarting ipa-dnskeysyncd Service ipa: INFO: The ipactl command was successful [root@master ~]# [root@master ~]# ipa cert-find ------------------------ 100 certificates matched ------------------------ [..] Issuing CA: ipa Subject: CN=user88,O=TESTREALM.TEST Issuer: CN=Certificate Authority,O=TESTREALM.TEST Not Before: Mon Jun 26 11:32:56 2023 UTC Not After: Thu Jun 26 11:32:56 2025 UTC Serial number: 100 Serial number (hex): 0x64 Status: VALID Revoked: False ------------------------------ Number of entries returned 100 ------------------------------ [root@master ~]# Based on above observations, marking the bug verified.