Fedora Account System
Red Hat Associate
Red Hat Customer
Title: ipa-4-13 plus Dogtag 11.10: cert_find returns CertificateOperationError 4301 because Apache’s AJP limit stays 8192 Component: FreeIPA server / CA proxy (ipa-pki-proxy.conf) Versions Fedora 45 freeipa-server-common-4.13.4-3.1.fc45 (IPA 4.13.4, API 2.257) dogtag-pki-*-11.10.1-1.fc45 Apache 2.4.68 (mod_proxy_ajp) Summary Dogtag 11.10 sets the Tomcat AJP connector packetSize to 65536. FreeIPA 4.13.4 never sets Apache ProxyIOBufferSize, so mod_proxy_ajp stays at 8192. A normal certificate search then produces one AJP packet larger than that limit. Apache drops it, and IPA reports a CA 500. Issue 9988 and PR 8399 describe the same AH01081 error, but only for ML-DSA-65/87, and the fix was not backported to ipa-4-13. A search of 100 ordinary certificates is enough. No ML-DSA certificate is required. Reproducible: Always Steps to Reproduce: 1.Install or upgrade an IPA CA server so that Dogtag is 11.10.x (packetSize="65536" on both AJP connectors in /etc/pki/pki-tomcat/server.xml) and FreeIPA is 4.13.4 (/etc/httpd/conf.d/ipa-pki-proxy.conf at template VERSION 17, no ProxyIOBufferSize). In the Web UI, open Authentication → Certificates, or run ipa cert-find (the framework calls /ca/v2/certs/search?size=100). Deleting a host with a certificate hits the same path: host_del calls ra.find() before it revokes. Actual result IPA Error 4301, CertificateOperationError: Certificate operation cannot be completed: 500 Server Error: Internal Server Error for url: https://:443/ca/v2/certs/search?size=100 /var/log/httpd/error_log: [proxy_ajp:error] AH01081: ajp_msg_check_header() incoming message is too big 45326, max is 8188 [proxy_ajp:error] AH01031: ajp_ilink_receive() received bad header [proxy_ajp:error] AH00992: ajp_read_header: ajp_ilink_receive failed [proxy_ajp:error] AH00893: dialog to [::1]:8009 (localhost:8009) failed ipa: ERROR: ra.find(): 500 Server Error: Internal Server Error for url: https://:443/ca/v2/certs/search?size=100 ipa: INFO: cert_find(None, version='2.257'): CertificateOperationError ipa: INFO: host_del(...): CertificateOperationError 8188 is the 8192-byte default minus the 4-byte AJP header. The same search in /var/log/pki/pki-tomcat/ca/debug ends with Search results: 100. Dogtag finished the search. Apache never delivered the body, so IPA treats the failed AJP dialog as an HTTP 500. host_del did not remove the host. A later host_show succeeded. 2. 3. Actual Results: Delete fails with the above-described certificate error Expected Results: Host is deleted Additional Information: The issue is also tracked at https://codeberg.org/freeipa/freeipa/issues/10083 and was previously referenced in pagure at https://pagure.io/freeipa/issue/9988/.
Proposed as a Freeze Exception for 45-final by Fedora user mhjacks using the blocker tracking app because: The issue prevents deletion of hosts by default on a FreeIPA server running under Fedora 45. A fix has been proposed and tested, and it is small, targeted, and straightforward to verify.
FEDORA-2026-7f4dc45e0f (freeipa-4.13.4-3.2.fc46) has been submitted as an update to Fedora 46. https://bodhi.fedoraproject.org/updates/FEDORA-2026-7f4dc45e0f
FEDORA-2026-7f4dc45e0f (freeipa-4.13.4-3.2.fc46) has been pushed to the Fedora 46 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-59d195ce8e (freeipa-4.13.4-3.2.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-59d195ce8e
FEDORA-2026-59d195ce8e has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-59d195ce8e` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-59d195ce8e See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
After running this upgrade, the top of my ipa-pki-proxy.conf file has: ``` # VERSION 17 - DO NOT REMOVE THIS LINE ProxyRequests Off # matches for ee port <LocationMatch "^/ca/ee/ca/checkRequest|^/ca/ee/ca/getCertChain|^/ca/ee/ca/getTokenInfo|^/ca/ee/ca/tokenAuthenticate|^/ca/ocsp|^/ca/ee/ca/updateNumberRange|^/ca/ee/ca/getCRL|^/ca/ee/ca/profileSubmit"> ``` While the template in /usr has: ``` # VERSION 18 - DO NOT REMOVE THIS LINE # Do not customise this file; it gets rewritten on every upgrade ProxyRequests Off $DOGTAG_AJP_PACKET_SIZE ``` I have not tried with a new install but I suspect it would work. For now, I have a separate, manually injected file in my apache config which contains: ``` # cat ipa-pki-ajp-buffer.conf # Dogtag AJP connectors use packetSize=65536. Apache default # 8192-byte AJP packet limit turns cert_find into HTTP 500 # (AH01081: incoming message is too big). ProxyIOBufferSize 65536 ``` This seems to be an effective workaround for the moment - but I think the key question is what it will take to get the version 18 file to render on RPM upgrades.
+3 in https://forge.fedoraproject.org/quality/blocker-review/issues/2202 , marking accepted FE (it's a weak approval, though. Please be really careful not to break anything worse)
Looking further into my systems, I do not have ipaupgrade.log entries matching the timeframe of the package install. I did run ipa-server-upgrade "manually" on both of them, which generated the logs and did successfully install the new version 18 of the ipa-pki-proxy.conf file. I do not understand why the %posttrans code seems not to have run. I don't have any further logging around the transaction beyond the dnf5 history info for the transaction ID's. They were both command-line dnf5 invocations so I didn't get the details that would come from, say, dnf5-automatic. I do have some potentially unusual elements in my dnf config. My hope is that I've hit a corner case on this and this won't be a problem for most users. Happy to share more if it would be helpful.
FEDORA-2026-59d195ce8e (freeipa-4.13.4-3.2.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.