freeipa

#9998 ipa ca-show / ipa cert-request fail with HTTP 400 from Dogtag when the CA uses ML-DSA keys
Opened by shalini10. Modified

Open
Close Issue

Issue

After ipa-server-install --ca-key-type mldsa, install completes and ML-DSA CA keys are present in NSS, but post-install cert operations fail.

FreeIPA ca_show calls read_ca_cert() → Dogtag GET /ca/v2/authorities/{id}/cert, which returns 400 Bad Request. Enrollment never runs (EnrollProfile not reached). RSA CA installs work.

Steps to Reproduce

  1. Install: ipa-server-install ... --ca-key-type mldsa (and --key-type-size mldsa if desired).
  2. Run: ipa ca-show ipa or ipa cert-request with any CSR.

Actual behavior

FreeIPA ca_show calls read_ca_cert() → Dogtag GET /ca/v2/authorities/{id}/cert, which returns 400 Bad Request

Expected behavior

ipa ca-show ipa and ipa cert-request succeed; Dogtag returns the ML-DSA root CA cert via the REST API

I think this is related to https://pagure.io/freeipa/issue/9988 .

When I manually set ProxyIOBufferSize 65536 I can view a CA and request a certificate. I tested ML-DSA 44 and 65 sizes.

It's important to point out that the buffer needs to be increased both in tomcat and in Apache. If either is not then you'll see failures.
The current PKI build in rawhide should have packetSize="65536" in each of the localhost AJP connectors.

If not then pki will log something like:
Caused by: java.lang.IllegalArgumentException: Header message of length [8,194] received but the packetSize is only [8,192]
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.