freeipa

#7745 nss.conf needs to be zero length, not removed.
Closed: fixed Opened by rcritten.

Closed: fixed
Reopen Issue

Issue

When upgrading from using mod_nss to mod_ssl the method disable_nss_conf() is used to delete nss.conf.

This is incorrect. Removing the file completely will cause rpm to create a new nss.conf if/when mod_nss is upgraded which will blow up an upgrade.

A zero-length or commented-version of the file should be created.

Seen by Martin Kosek while trying to upgrade the public demo.

Steps to Reproduce

  1. Install IPA on F27
  2. Upgrade to F28
  3. double check that /etc/httpd/conf.d/nss.conf is gone
  4. Reinstall mod_nss
  5. ipa-server-upgrade

The root of the problem is that mod_nss uses 8443 as its listener by default which is also used by dogtag.

Metadata Update from @cheimes:
- Issue priority set to: critical
- Issue set to the milestone: FreeIPA 4.7.2
- Issue tagged with: easyfix

Metadata Update from @okozlov:
- Issue assigned to okozlov

master:

  • f28a8177a92938ecbbc5d8fa8f21ed995f00788f Replace nss.conf with zero-length file instead of removing

ipa-4-7:

  • 8fde7b81999780940bdb536671549158dba53c00 Replace nss.conf with zero-length file instead of removing

Fixed. Instead of removing nss.conf will be replaced with an empty file, it avoids recreation in case mod_nss is reinstalled.

Metadata Update from @okozlov:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

easyfix

None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.