freeipa

#9743 The pki-tomcatd service can time out starting with a slow HSM
Closed: fixed by frenaud. Opened by rcritten.

Closed: fixed
Reopen Issue

Issue

Some HSMs are not particularly fast in some cases. We saw dbus timeouts starting tracking certificates in https://pagure.io/freeipa/issue/9725 and now we are seeing some tomcat startup timeouts on the same HSM.

In particular when installing a KRA in the initial installation step we see a 100% failure rate when the PKI service is restarted after the KRA is spawned.

Feb 04 10:18:10 hsm.example.test systemd[1]: Starting pki-tomcatd@pki-tomcat.service - PKI Tomcat Server pki-tomcat...

Feb 04 10:18:33 hsm.example.test ipa-pki-wait-running[674333]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='hsm.example.test', port=8080): Read timed out. (read timeout=1.0)

Feb 04 10:19:50 hsm.example.test systemd[1]: pki-tomcatd@pki-tomcat.service: start-post operation timed out. Terminating.
Feb 04 10:19:50 hsm.example.test systemd[1]: pki-tomcatd@pki-tomcat.service: Control process exited, code=killed, status=15/TERM
Feb 04 10:19:50 hsm.example.test systemd[1]: pki-tomcatd@pki-tomcat.service: Failed with result 'timeout'.
Feb 04 10:19:50 hsm.example.test systemd[1]: Failed to start pki-tomcatd@pki-tomcat.service - PKI Tomcat Server pki-tomcat.

Creating /etc/ipa/installer.conf with a startup_timeout mitigates a failure during the spawn but it always fails in systemd because it still uses the default systemd timeout.

https://github.com/freeipa/freeipa/pull/7686

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-77965

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-77965, https://issues.redhat.com/browse/RHEL-78726 (was: https://issues.redhat.com/browse/RHEL-77965)

master:

  • 11b4ef749c709738454f7fd72083b430808b93dd Configure the pki-tomcatd service systemd timeout
  • 4952dff42df78ed57ac397dd8026c191ae3c9453 Align startup_timeout with the systemd default and document it

ipa-4-12:

  • 47ce0982249ee7ce12b38eae5ce3ee6a9b5df52e Configure the pki-tomcatd service systemd timeout
  • 22cbc5ed4889d6c66e2916d5acde582b1868fbc9 Align startup_timeout with the systemd default and document it

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.