"ipa cert-find" and "pki cert-find" commands with no additional parameters could be very time consuming if there are too many certificates.
The problem is that the query the commands are doing to the dirsrv instance is not matching any exisiting vlvindex. So, the query is unindexed.
Steps to Reproduce:
do "pki cert-find" and see the access logs. We should find something like: [09/Jun/2015:16:05:09 +0200] conn=7 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [09/Jun/2015:16:05:09 +0200] conn=7 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=admin,cn=users,cn=accounts,dc=example,dc=org" [09/Jun/2015:16:05:09 +0200] conn=7 op=3 SRCH base="cn=ipaconfig,cn=etc,dc=example,dc=org" scope=0 filter="(objectClass=*)" attrs=ALL [09/Jun/2015:16:05:09 +0200] conn=7 op=3 RESULT err=0 tag=101 nentries=1 etime=0 [09/Jun/2015:16:05:09 +0200] conn=7 op=4 SRCH base="cn=masters,cn=ipa,cn=etc,dc=example,dc=org" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL [09/Jun/2015:16:05:09 +0200] conn=7 op=4 RESULT err=0 tag=101 nentries=2 etime=0 [09/Jun/2015:16:05:09 +0200] conn=3 op=7 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=1 filter="(&(serialno=*))" attrs=ALL [09/Jun/2015:16:05:09 +0200] conn=3 op=7 SORT serialno (14) [09/Jun/2015:16:05:09 +0200] conn=3 op=7 VLV 0:10:A 14:14 (0) [09/Jun/2015:16:05:09 +0200] conn=3 op=7 RESULT err=0 tag=101 nentries=1 etime=0 notes=U [09/Jun/2015:16:05:09 +0200] conn=3 op=8 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=1 filter="(&(serialno=*))" attrs=ALL [09/Jun/2015:16:05:09 +0200] conn=3 op=8 SORT serialno (14) [09/Jun/2015:16:05:09 +0200] conn=3 op=8 VLV 0:10:0:14 1:14 (0) [09/Jun/2015:16:05:09 +0200] conn=3 op=8 RESULT err=0 tag=101 nentries=11 etime=0 notes=U [09/Jun/2015:16:05:10 +0200] conn=3 op=9 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=1 filter="(&(serialno=*))" attrs=ALL [09/Jun/2015:16:05:10 +0200] conn=3 op=9 SORT serialno (14) [09/Jun/2015:16:05:10 +0200] conn=3 op=9 VLV 0:10:10:14 11:14 (0) [09/Jun/2015:16:05:10 +0200] conn=3 op=9 RESULT err=0 tag=101 nentries=4 etime=1 notes=U [09/Jun/2015:16:05:10 +0200] conn=7 op=5 UNBIND [09/Jun/2015:16:05:10 +0200] conn=7 op=5 fd=92 closed - U1 all the searches showing "notes=U" The query base="ou=certificateRepository,ou=ca,o=ipaca" scope=1 filter="(&(serialno=*))" is not matching any vlvindex.
Additional info:
Workaround is to add a new vlvindex like this: --------------------------------------------------------- dn: cn=allCertsSerial-pki-tomcat,cn=ipaca,cn=ldbm database,cn=plugins,cn=config objectClass: top objectClass: vlvSearch vlvFilter: (&(serialno=*)) vlvScope: 1 vlvBase: ou=certificateRepository,ou=ca,o=ipaca cn: allCertsSerial-pki-tomcat numSubordinates: 1 dn: cn=allCertsSerial-pki-tomcatIndex,cn=allCertsSerial-pki-tomcat,cn=ipaca,cn=ldbm database,cn=plugins,cn=config vlvUses: 0 vlvEnabled: 0 vlvSort: serialno objectClass: top objectClass: vlvIndex cn: allCertsSerial-pki-tomcatIndex ------------------------------------------------------------- + apply it: /var/lib/dirsrv/scripts-EXAMPLE-ORG/vlvindex -n ipaca -T allCertsSerial-pki-tomcatIndex
Alternatively the pki cert-find command can be modified to match an existing VLV:
dn: cn=allCerts-{instanceId}, cn={database}, cn=ldbm database, cn=plugins, cn=config objectClass: top objectClass: vlvSearch cn: allCerts-{instanceId} vlvBase: ou=certificateRepository,ou=ca,{rootSuffix} vlvScope: 1 vlvFilter: (certstatus=*)
Fixed in master: ac5447a8e0bac5112882be700a17a9274e322adc
Metadata Update from @mharmsen: - Issue assigned to edewata - Issue set to the milestone: 10.2.6
Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.
This issue has been cloned to GitHub and is available here: https://github.com/dogtagpki/pki/issues/2009
If you want to receive further updates on the issue, please navigate to the GitHub issue and click on Subscribe button.
Subscribe
Thank you for understanding, and we apologize for any inconvenience.
Login to comment on this ticket.