After update to Fedora42 LDAP search failes with: java.lang.NullPointerException: Cannot read the array length because "<local9>" is null

[cgrzemba]

Versions:
OS release: Fedora 42 (Server Edition)
OpenJRE 21
Dogtag PKI 11.6
using LDAP repository

Are these versions supported?

If I attempt to list certificates in tomcat https://ca.example.com/ca/agent/ca -- List Certificates

I get the HTTP response

The Certificate System has encountered an unrecoverable error.

Error Message:
java.lang.NullPointerException: Cannot read the array length because "" is null

Please contact your local administrator for assistance.

and in the /var/log/pki/pki-tomcat/ca/debug
2025-06-26 15:06:18 [CertStatusUpdateTask] FINE: LDAPRegistry: attribute is registered
2025-06-26 15:06:18 [CertStatusUpdateTask] INFO: LDAPSession.continuousPagedSearch(): Searching ou=certificateRepository, ou=ca,dc=ca,dc=example,dc=com for (&(certStatus=INVALID)(notBefore<=20250626150618Z))
2025-06-26 15:06:18 [CertStatusUpdateTask] WARNING: CertStatusUpdateTask: Cannot read the array length because "" is null
java.lang.NullPointerException: Cannot read the array length because "" is null
at com.netscape.cmscore.dbs.LDAPPagedSearch.getPage(LDAPPagedSearch.java:114)
at com.netscape.cmscore.dbs.LDAPPagedSearch.getPage(LDAPPagedSearch.java:95)

Who can I fix this problem?

[fmarco76]

@cgrzemba could you verify if the workaround for #5133 solve this problem with paged search?

[cgrzemba]

I added the attribute nsPagedLookThroughLimit=-1 to the pkidbuser, but there are the same error, no change.

[cgrzemba]

The related LDAP query seems to be:

[26/Jun/2025:18:47:46 +0200] conn=129825 op=6 msgId=14 - SRCH base="ou=certificaterepository,ou=ca,dc=ca,dc=example,dc=com" scope=0 filter="(|(objectClass=*)(objectClass=ldapsubentry))" attrs="description"
[26/Jun/2025:18:47:46 +0200] conn=129825 op=6 msgId=14 - RESULT err=0 tag=101 nentries=1 etime=0
[26/Jun/2025:18:47:46 +0200] conn=129825 op=7 msgId=15 - SRCH base="cn=mastercrl,ou=crlissuingpoints,ou=ca,dc=ca,dc=example,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL
[26/Jun/2025:18:47:46 +0200] conn=129825 op=7 msgId=15 - RESULT err=0 tag=101 nentries=1 etime=0
[26/Jun/2025:18:47:47 +0200] conn=129825 op=8 msgId=17 - SRCH base="ou=certificaterepository,ou=ca,dc=ca,dc=example,dc=com" scope=1 filter="(&(certStatus=REVOKED)(|(!(issuerName=*))(issuerName=CN=CA Signing Certificate,O=Example Inc.)))" attrs="serialno revInfo objectClass"
[26/Jun/2025:18:47:47 +0200] conn=129825 op=8 msgId=17 - RESULT err=0 tag=101 nentries=4 etime=0 notes=U
[26/Jun/2025:18:47:50 +0200] conn=129825 op=9 msgId=21 - SRCH base="ou=ca,ou=requests,dc=ca,dc=example,dc=com" scope=1 filter="(&(requestState=approved)(requestId=*))" attrs=ALL
[26/Jun/2025:18:47:50 +0200] conn=129825 op=9 msgId=21 - RESULT err=0 tag=101 nentries=0 etime=0 notes=U
[26/Jun/2025:18:47:57 +0200] conn=129825 op=10 msgId=53 - SRCH base="cn=253,ou=certificaterepository,ou=ca,dc=ca,dc=example,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL
[26/Jun/2025:18:47:57 +0200] conn=129825 op=10 msgId=53 - RESULT err=0 tag=101 nentries=1 etime=0
[26/Jun/2025:18:49:05 +0200] conn=129825 op=11 msgId=61 - SRCH base="ou=certificaterepository,ou=ca,dc=ca,dc=example,dc=com" scope=1 filter="(&(|(certStatus=VALID)(certStatus=REVOKED)))" attrs=ALL
[26/Jun/2025:18:49:05 +0200] conn=129825 op=11 msgId=61 - RESULT err=0 tag=101 nentries=45 etime=0 notes=U
[26/Jun/2025:18:49:05 +0200] conn=129825 op=12 msgId=62 - SRCH base="ou=certificaterepository,ou=ca,dc=ca,dc=example,dc=com" scope=1 filter="(&(|(certStatus=VALID)(certStatus=REVOKED)))" attrs="objectClass"
[26/Jun/2025:18:49:05 +0200] conn=129825 op=12 msgId=62 - RESULT err=0 tag=101 nentries=45 etime=0 notes=U
[26/Jun/2025:18:54:15 +0200] conn=129825 op=13 msgId=67 - SRCH base="cn=253,ou=certificaterepository,ou=ca,dc=ca,dc=example,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL
[26/Jun/2025:18:54:15 +0200] conn=129825 op=13 msgId=67 - RESULT err=0 tag=101 nentries=1 etime=0
[26/Jun/2025:18:54:35 +0200] conn=129825 op=14 msgId=75 - SRCH base="ou=certificaterepository,ou=ca,dc=ca,dc=example,dc=com" scope=1 filter="(&(certStatus=*)(serialno>=012)(serialno<=013))" attrs=ALL
[26/Jun/2025:18:54:35 +0200] conn=129825 op=14 msgId=75 - RESULT err=0 tag=101 nentries=2 etime=0 notes=U

[26/Jun/2025:18:54:35 +0200] conn=129825 op=15 msgId=76 - SRCH base="ou=certificaterepository,ou=ca,dc=ca,dc=example,dc=com" scope=1 filter="(&(certStatus=*)(serialno>=012)(serialno<=013))" attrs="objectClass"
[26/Jun/2025:18:54:35 +0200] conn=129825 op=15 msgId=76 - RESULT err=0 tag=101 nentries=2 etime=0 notes=U

[26/Jun/2025:18:57:46 +0200] conn=129825 op=16 msgId=79 - SRCH base="ou=certificaterepository,ou=ca,dc=ca,dc=example,dc=com" scope=1 filter="(&(certStatus=INVALID)(notBefore<=20250626185744Z))" attrs="objectClass serialno notBefore notAfter duration extension subjectName issuerName userCertificate version algorithmId signingAlgorithmId publicKeyData"
[26/Jun/2025:18:57:46 +0200] conn=129825 op=16 msgId=79 - RESULT err=0 tag=101 nentries=0 etime=0 notes=U
[26/Jun/2025:18:57:46 +0200] conn=129825 op=17 msgId=80 - SRCH base="ou=certificaterepository,ou=ca,dc=ca,dc=example,dc=com" scope=0 filter="(|(objectClass=*)(objectClass=ldapsubentry))" attrs="description"
[26/Jun/2025:18:57:46 +0200] conn=129825 op=17 msgId=80 - RESULT err=0 tag=101 nentries=1 etime=0

[fmarco76]

OK this need to be investigated

[edewata]

@cgrzemba Hi, the /ca/agent/ca is a legacy API that has been deprecated. Could you use this instead?
https://github.com/dogtagpki/pki/wiki/CA-List-Certificates-REST-API
https://github.com/dogtagpki/pki/blob/master/docs/user/tools/Using-PKI-CA-Certificate-CLI.adoc#listing-certificates

[cgrzemba]

This does not work also:

grzemba@oi-sr:~/oi-hipster$ curl -s https://ca.example.com:8443/ca/ee/ca/listCerts



The Certificate System has encountered an unrecoverable error.

Error Message:

java.lang.NullPointerException

Please contact your local administrator for assistance.

[edewata]

@cgrzemba As shown in the first link above, the path should be /ca/rest/certs.

[kimettog]

Ticket Created https://issues.redhat.com/browse/IDM-2285