Request for enhancement

Possible bug

Issue

support_v2() makes an unauthenticated HTTP request that initializes the urllib3 connection pool without a client cert, causing all subsequent requests on that pool to also omit the client cert

Steps to Reproduce

While upgrading ipa server to VERSION: 4.13.1, API_VERSION: 2.257
1. run ipa-server-upgrade will fail (ipa service failing to start)
2. try to renew a certificate with ipa cert-request will fail

Actual behavior

Upgrade will fail:
"GET /ca/v2/account/login HTTP/1.1" 401 687
2026-06-02T17:04:19Z DEBUG PKI API login failed 401 Client Error: for url: https://...:8443/ca/v2/account/login

Expected behavior

Upgrade ends without errors or certificates will be issued

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.13.1-3.el9_8.2.x86_64
ipa-client-4.13.1-3.el9_8.2.x86_64
389-ds-base-2.8.0-6.el9_8.x86_64
package pki-ca is not installed
krb5-server-1.21.1-10.el9_8.x86_64

cat /etc/redhat-release
AlmaLinux release 9.8 (Olive Jaguar)

Additional info:

I do not know extensively FreeIPA, upgrades failed with the error reported above during a normal OS updates.
This could be just related somehow to our servers because I could not find the same bug anywhere on the Internet, maybe somewhere our servers were not correctly configured but we just upgrade from the Alma9 package sources (dnf update).

After a debug session with Claude, I am posting here how we solved it (in case someone could find it helpful or maybe confirm this is a real bug):
Fix: call set_client_auth() before support_v2() in every PKIClient construction in dogtag.py
grep -n "support_v2|set_client_auth" /usr/lib/python3.9/site-packages/ipaserver/plugins/dogtag.py
458:def support_v2(pki_client):
578: pki_client.set_client_auth(
581: pki_client = support_v2(pki_client)
635: pki_client.set_client_auth(
638: pki_client = support_v2(pki_client)
1302: pki_client.set_client_auth(
1305: pki_client = support_v2(pki_client)

All three occurrences are now correctly ordered — set_client_auth before support_v2 in every case.

Otherwise client certificate won't be sent.

We had also to modify the file /etc/httpd/conf.d/ipa-pki-proxy.conf:

30

after modifying dogtag.py and ipa-pki-proxy.conf (including restarting httpd), the issue is gone.