Issue

When running FreeIPA test suites on a system with FIPS mode enabled, multiple CA-related test cases fail consistently.

The failures all share the same root error:
- java.security.ProviderException: Initialization failed
- Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_GENERAL_ERROR

The error occurs when Dogtag initializes JSS / PKCS#11 during CA operations (e.g. CSR generation, CA DB removal, Tomcat JSS initialization).

The same tests pass reliably when FIPS mode is disabled on the same system.
This suggests a common underlying issue in PKCS#11/JSS initialization in FIPS mode, rather than individual test failures.

1. Install Fedora 43 on a system.
2. Enable FIPS mode and reboot the system.
3. Install the latest upstream FreeIPA build (version 4.14).
4. Run ipa-server-install with CA enabled.

Actual behavior

Multiple CA-related tests fail during execution.

Failures occur when Dogtag initializes JSS / PKCS#11, aborting with:

java.security.ProviderException: Initialization failed
Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_GENERAL_ERROR
at jdk.crypto.cryptoki/sun.security.pkcs11.wrapper.PKCS11.C_Initialize(...)
at org.mozilla.jss.CryptoManager.initialize(...)

Expected behavior

CA-related FreeIPA tests should pass successfully in FIPS mode on Fedora.

Version/Release/Distribution

freeipa-server-4.14.0.dev202512220920+gitba89a6b29-0.fc43.x86_64
freeipa-server-common-4.14.0.dev202512220920+gitba89a6b29-0.fc43.noarch
dogtag-jss-5.8.0-1.fc43.x86_64
dogtag-jss-tomcat-5.8.0-1.fc43.x86_64
dogtag-pki-acme-11.8.0-1.fc43.noarch
dogtag-pki-base-11.8.0-1.fc43.noarch
dogtag-pki-ca-11.8.0-1.fc43.noarch

nss-3.118.1-2.fc43.x86_64
nss-softokn-3.118.1-2.fc43.x86_64
nss-softokn-freebl-3.118.1-2.fc43.x86_64

Additional info:

Link: https://$ARTIFACT_SERVER/idm-ci/freeipa_upstream_nightly/Nightly-latest-fips/master/2025-12-30_04-33/latest/test_cockpit/1/

https://$ARTIFACT_SERVER/idm-ci/freeipa_upstream_nightly/Nightly-latest-fips/master/2025-12-30_04-33/latest/external_ca_TestExternalCAdirsrvStop/1/

Log file locations:
Server Install Logs:
https://$ARTIFACT_SERVER/idm-ci/freeipa_upstream_nightly/Nightly-latest-fips/master/2025-12-30_04-33/latest/external_ca_TestExternalCAdirsrvStop/1/logs/test_integration-test_external_ca.py-TestExternalCAdirsrvStop-install/master.ufreeipa.test/var/log/ipaserver-install.log