freeipa

#9860 With PKI 11.7, ipa ca-del fails with with status 500: Non-2xx response from CA REST API: 500
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

The test test_integration/test_cert.py::TestInstallMasterClient::test_remove_missing_lwca is failing with PKI 11.7 (was green with PKI 11.6 - dogtag-pki-server-11.6.0-1.fc42.noarch).

Failure is visible in this PR: https://github.com/freeipa/freeipa/pull/7959
Using dogtag-pki-server-11.7.0-2.fc42.noarch

Steps to Reproduce

Install freeipa from the copr @freeipa/freeipa-master-nightly on fedora 42 with PKI 11.7
Add a subca with ipa ca-add lwca --subject cn=lwca
Remove the entry cn=ca_id,ou=authorities,ou=ca,o=ipaca
Delete the subca with ipa ca-del lwca

Actual behavior

# ipa ca-del lwca
ipa: ERROR: Request failed with status 500: Non-2xx response from CA REST API: 500.

Expected behavior

success, removal of the entry cn=lwca,cn=cas,cn=ca,$SUFFIX

Version/Release/Distribution

# rpm -qa freeipa-server dogtag-pki-server
dogtag-pki-server-11.7.0-2.fc42.noarch
freeipa-server-4.13.0.dev202509221618+git-0.fc42.x86_64

Metadata Update from @rcritten:
- Issue assigned to rcritten

Alexander pointed out in the PR that we can add application/json to the Accept type to get JSON errors. That is pretty straightforward.

The issue seems to stem from this commit https://github.com/dogtagpki/pki/commit/1d927c39bd4662d05fced7aa0da58708b77d7b21

We get a 500 HTTPException back and that isn't being translated into a 404 properly.

My original propose in the PR stands in that if we catch the 500 error and look for "No such object" that is a reasonable workaround for now. We can convert that into an ipa NotFound and handle it in the ca.py plugin.

Alexander pointed out in the PR that we can add application/json to the Accept type to get JSON errors. That is pretty straightforward.

The issue seems to stem from this commit https://github.com/dogtagpki/pki/commit/1d927c39bd4662d05fced7aa0da58708b77d7b21

We get a 500 HTTPException back and that isn't being translated into a 404 properly.

My original propose in the PR stands in that if we catch the 500 error and look for "No such object" that is a reasonable workaround for now. We can convert that into an ipa NotFound and handle it in the ca.py plugin.

I agree with the proposal

As usual the issue is deeper than first believed. It is still straightforward but for the other ca- commands to act in a sane way further changes are needed.

PR https://github.com/freeipa/freeipa/pull/7965

A PKI issue has been opened https://issues.redhat.com/browse/IDM-3521

Marco has addressed the regression in PKI in F42 update https://bodhi.fedoraproject.org/updates/FEDORA-2025-49155b024d

I did some manual testing and this mostly fixes the issue.

We still get the error back as XML but with a 404 so the issue is properly caught. The problem is we don't get an error string back so the tests will still fail.

It is probably better hygiene to specify all the data types we expect/want so I'll keep a portion of the original patch and also pass in application/json when retrieving the CA cert and chain.

The issue has been fixed with PKI 11.7.0-5.
Example of run in http://freeipa-org-pr-ci.s3-website.eu-central-1.amazonaws.com/jobs/31808570-ab51-11f0-abbf-fa163e863465/report.html?sort=result

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

test-failure

None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.