freeipa

#9988 Set ProxyIOBufferSize 65536 in ipa-pki-proxy.conf to support ML-DSA 65 and 87
Opened by rcritten. Modified

Open
Close Issue

Issue

The key sizes of ML-DSA 65 and 87 generate very large certificates, CSRs, etc. These can be larger than the default mod_proxy AJP setting allows (8192). This value needs to be increased in ipa-pki-proxy.conf.template and version number bumped in order to prevent failures. Using the max value of 65536 is recommended.

This has already been addressed in dogtagpki but as of today it has not landed in a release yet.

Fixed in https://github.com/dogtagpki/pki/pull/5342

Metadata Update from @rcritten:
- Issue assigned to rcritten

We've seen nightly failures where this setting is made only on the PKI side and large AJP buffers are being returned which are greater than the default Apache size (8192). The error looks like
[Mon May 11 09:22:01.400035 2026] [proxy_ajp:error] [pid 30861:tid 30918] AH01081: ajp_msg_check_header() incoming message is too big 8945, max is 8192

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://redhat.atlassian.net/browse/IDM-6233
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.