ipa-healthcheck fails with CASystemCertTrustFlagCheck: Request timed out on RHEL 10 Identity Management server

Solution In Progress - Updated -

Environment

  • Red Hat Enterprise Linux 10
  • Identity Management (IdM)

Issue

  • ipa-healthcheck failing to execute on IDM servers
  • Error: Request timed out during certificate trust flag check
  • Error: Unable to load cert from NSSDB, resulting in Request timed out
[root@idm-server ~]# ipa-healthcheck
 [
    {
     "source": "pki.server.healthcheck.certs.trustflags",
     "check": "CASystemCertTrustFlagCheck",
     "result": "ERROR",
     "uuid": "3ec81403-cb1a-4170-b529-4d209018eedc",
     "when": "20260918073614Z",
     "duration": "10.000689",
     "kw": {
       "exception": "Request timed out"
     }
   }
]
 [
   {
     "source": "pki.server.healthcheck.certs.trustflags",
     "check": "CASystemCertTrustFlagCheck",
     "result": "ERROR",
     "uuid": "90f84643-0624-4251-a9a2-9ffb5c7051a5",
     "when": "20260918073624Z",
     "duration": "10.001322",
     "kw": {
       "key": "audit_signing",
       "nssdbDir": "/var/lib/pki/pki-tomcat/conf/alias",
       "msg": "Unable to load cert from NSSDB: Request timed out"
     }
   }
 ]

Resolution

To resolve this issue, increase the ipa-healthcheck REST API client timeout from the default 10 seconds to 30 seconds.

  1. Open or create the /etc/ipahealthcheck/ipahealthcheck.conf configuration file on the affected IdM server(s).

  2. Add or update the [default] section with timeout = 30:

[default]
timeout = 30
  1. Restart the IdM services to apply the configuration:
# ipactl restart
  1. Run ipa-healthcheck again to verify that it completes successfully:
 # ipa-healthcheck

Root Cause

  • By default, the ipa-healthcheck utility's internal REST client enforces a strict 10-second timeout when querying system certificates from the NSS database via the CA subsystem.
  • On slower or busy virtualized servers, the CA subsystem may take longer than 10 seconds to respond, leading to premature healthcheck timeouts.
  • This issue is tracked under:

Diagnostic Steps

  • Run the ipa-healthcheck command manually and note the exact duration field returned under the error block:
# ipa-healthcheck --failures-only

  • Verification: If the duration is extremely close to 10.00 seconds (e.g., 10.000689), it confirms that the internal client timeout of the health check is being reached.

  • Verify if any custom timeout configuration exists in /etc/ipahealthcheck/ipahealthcheck.conf:

# cat /etc/ipahealthcheck/ipahealthcheck.conf

  • By default, this file might not exist or the timeout parameter under the [default] section is unset, defaulting to 10 seconds.

  • Verify that the Dogtag CA service (pki-tomcatd) is running and healthy:

# systemctl status pki-tomcatd@pki-tomcat
  • Examine the /var/log/pki/pki-tomcat/ca/debug log files during the health check run to check for any slow queries or resource contention that might delay CA database lookups.
  • Component
  • ipa

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments