Mozilla's NSS can be built without the support of legacy DB (DBM). This case is not handled in FreeIPA. For example, on Fedora33 tests fail with:
=========================== short test summary info ============================ FAILED test_ipapython/test_certdb.py::test_dbm_tmp - ipapython.ipautil.Called... FAILED test_ipapython/test_certdb.py::test_convert_db - ipapython.ipautil.Cal... FAILED test_ipapython/test_certdb.py::test_convert_db_nokey - ipapython.ipaut... 3 failed ... E ipapython.ipautil.CalledProcessError: CalledProcessError(Command ['/usr/bin/certutil', '-d', 'dbm:/tmp/tmpms2o812h', '-N', '-f', '/tmp/tmpms2o812h/pwdfile.txt', '-@', '/tmp/tmpms2o812h/pwdfile.txt'] returned non-zero exit status 255: 'certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.\n')
https://github.com/freeipa/freeipa/pull/5047
master:
nss-tools
ipa-4-8:
Metadata Update from @abbra: - Issue close_status updated to: fixed - Issue status updated to: Closed (was: Open)