freeipa

#5107 Usability: adding certificate with short key length deserves better error message
Opened by mbasti. Modified

Open
Close Issue

IPA with default cert profile supports only key length 1024, 2048, 3072, 4096.
Create certificate with key length 512

# certutil -R -d <nssdb> -a -g 512 -s 'CN=vm-226.example.com,O=EXAMPLE.COM'

Add certificate to service (user, host). Following error message is shown

Certificate operation cannot be completed: unknown(3) (Request Rejected - {0})

Is hard to understand what is wrong from this message.

response from /ca/eeca/ca/profileSubmitSSLClient: 

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<XMLResponse>
  <Status>3</Status>
  <Error>Request Rejected - {0}</Error>
  <RequestId>  15</RequestId>
</XMLResponse>

pki ticket: https://fedorahosted.org/pki/ticket/1494

Metadata Update from @mbasti:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.5 backlog
Metadata
None
None
None
Normal
defect
Certificate management
0
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.