Rhel

Running ipa-healthcheck --failures-only on my FreeIPA primary (idm.gnali.home, RHEL 10.2, IPA 4.13.1) reported two ERROR results against the Dogtag CA subsystem: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 { "source": "pki.server.healthcheck.certs.expiration", "check": "CASystemCertExpiryCheck", "result": "ERROR", "kw": { "exception": "Request timed out" } }, { "source": "pki.server.healthcheck.certs.trustflags", "check": "CASystemCertTrustFlagCheck", "result": "ERROR", "kw": { "key": "ocsp_signing", "nssdbDir": "/var/lib/pki/pki-tomcat/conf/alias", "msg": "Unable to load cert from NSSDB: Request timed out" } } The wording sounds alarming — certificate expiry and trust flags are core PKI concerns. In this case, the CA was healthy. The healthcheck simply ran out of time while reading the NSS database. ...

On RHEL with firewalld’s nftables backend, allowing one libvirt VM network to reach another is not a classic firewall-cmd --direct problem anymore. Libvirt installs its own ip libvirt_network table, and that is what rejects NEW traffic between bridges. ...