ipa-healthcheck CA errors are often timeouts, not expired certificates

Mon, 17 Aug 2026 12:00:00 +0200

Running ipa-healthcheck --failures-only on my FreeIPA primary (idm.gnali.home, RHEL 10.2, IPA 4.13.1) reported two ERROR results against the Dogtag CA subsystem:

{
  "source": "pki.server.healthcheck.certs.expiration",
  "check": "CASystemCertExpiryCheck",
  "result": "ERROR",
  "kw": {
    "exception": "Request timed out"
  }
},
{
  "source": "pki.server.healthcheck.certs.trustflags",
  "check": "CASystemCertTrustFlagCheck",
  "result": "ERROR",
  "kw": {
    "key": "ocsp_signing",
    "nssdbDir": "/var/lib/pki/pki-tomcat/conf/alias",
    "msg": "Unable to load cert from NSSDB: Request timed out"
  }
}

The wording sounds alarming — certificate expiry and trust flags are core PKI concerns. In this case, the CA was healthy. The healthcheck simply ran out of time while reading the NSS database.

Pki on Gnali

ipa-healthcheck CA errors are often timeouts, not expired certificates