This whole code path is within Dogtag, not FreeIPA. Please open an issue at the https://github.com/dogtagpki/pki/issues.

Certificate with CN=E8,O=Let's Encrypt,C=US can be seen here: https://crt.sh/?id=12396132890, its SKI is 8F:0D:13:A2:F6:2E:7E:D1:50:6C:33:18:38:5D:59:8E:23:72:91:CA and AKI is keyid:7C:42:96:AE:DE:4B:48:3B:FA:92:F8:9E:8C:CF:6D:8B:A9:72:37:95.

Not sure why both are stated 'null' in the output, but this is Dogtag PKI calling JSS wrapper calling NSS library code and NSS giving that response. So please file a bug there.

Hi @obel1x

I remember that PKI tightened their checks related to certificates when they switched to the new socket factory. Can you provide the version of dogtag-pki-server?

Hi @obel1x

I remember that PKI tightened their checks related to certificates when they switched to the new socket factory. Can you provide the version of dogtag-pki-server?

May explain why the error has not occured before.
FreeIPA is a docker Image:
freeipa/freeipa-server:almalinux-9@sha256:1f25b13286f28d4208040d8ac4b27d9e31460cae2628ad28cbb54d54158e511a

It contains those rpms:
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.12.2-22.el9_7.1.x86_64
ipa-client-4.12.2-22.el9_7.1.x86_64
389-ds-base-2.7.0-7.el9_7.x86_64
package pki-ca is not installed
krb5-server-1.21.1-8.el9_6.x86_64

[root@ipa ipa]# pki info
Server URL: https://ipa.obel1x.de:8443
Server Version: 11.4.2

Maybe try another version?

This whole code path is within Dogtag, not FreeIPA. Please open an issue at the https://github.com/dogtagpki/pki/issues.

Certificate with CN=E8,O=Let's Encrypt,C=US can be seen here: https://crt.sh/?id=12396132890, its SKI is 8F:0D:13:A2:F6:2E:7E:D1:50:6C:33:18:38:5D:59:8E:23:72:91:CA and AKI is keyid:7C:42:96:AE:DE:4B:48:3B:FA:92:F8:9E:8C:CF:6D:8B:A9:72:37:95.

Not sure why both are stated 'null' in the output, but this is Dogtag PKI calling JSS wrapper calling NSS library code and NSS giving that response. So please file a bug there.

did so with https://github.com/dogtagpki/pki/issues/5242 - thanks!

Today the eError changed a bit:

[root@ipa ipa]# pki -d /var/lib/pki/pki-tomcat/conf/alias -f /var/lib/pki/pki-tomcat/conf/password.conf nss-cert-verify --debug </root/.dogtag/pki-tomcat/ca_admin.cert
FINE: Initializing NSS
FINE: Logging into internal token
FINE: Using internal token
FINE: PKITrustManager: getAcceptedIssuers():
FINE: PKITrustManager:  - CN=E7,O=Let's Encrypt,C=US
FINE: PKITrustManager:  - CN=E8,O=Let's Encrypt,C=US
FINE: PKITrustManager:  - CN=E5,O=Let's Encrypt,C=US
FINE: PKITrustManager:  - CN=ISRG Root X1,O=Internet Security Research Group,C=US
FINE: PKITrustManager:  - CN=Certificate Authority,O=OBEL1X.DE
FINE: PKITrustManager: checkCert(CN=ipa-ca-agent,O=OBEL1X.DE):
FINE: PKITrustManager: cert AKI: null
FINE: PKITrustManager: SKI of CN=E7,O=Let's Encrypt,C=US: null
ERROR: Invalid certificate: Key type is inconsistent with algorithm

Good news here: Dogtag has fixed the issue. Current version 11.10 of dogtag-pki will not give an error when different certificates are in the database and continue checking.

Can someone update FreeIPAs docker image with that version?

FreeIPA project team is not maintaining the container images. It is done by a separate project (under FreeIPA umbrella but it is separate from the core team) which has its own issue tracker. The updates are done automatically once there are package updates in the corresponding distributions.

When Dogtag PKI will get the changes released in the downstreams (Fedora, CentOS Stream, RHEL, ...), then FreeIPA container builds will automatically pick those packages.

Thank you. Can you pls. point me to the issue tracker there to open a request for new docker image release?
Dogtag has been released in Fedora with that version since some days.

My companys security is highly depending on that fix, as kra won't install there currently.

After i gave opened a request there, we can close this issue here.

Regarding "Dogtag has been released", I do not see fresh releases: https://bodhi.fedoraproject.org/updates/?search=dogtag-pki, the newest one is one month ago (March 9th 2026). Dogtag PKI 11.9.1 is only available in Fedora Rawhide/ELN, 11.9.0 is in Fedora 44. And there is no 11.10 build anywhere in Fedora yet.

freeipa-container builds do not happen on Fedora 44 and I hope your company is not using Fedora Rawhide in production. Even if you were using Fedora Rawhide in production, freeipa-container:fedora-rawhide-4.13.1 is tagged there already and it includes dogtag pki 11.9.1:
https://github.com/freeipa/freeipa-container/actions/runs/24328967872/job/71030212062

#16 7.266  dogtag-pki-base                noarch 0:11.9.1-2.fc45                       rawhide      1.9 MiB

Use https://github.com/freeipa/freeipa-container/issues but until Dotag PKI 11.10 is available in the distribution release you are using, nothing can be done at either FreeIPA or freeipa-container sides.