After update Fedora 42 REST URI is not working anymore

[cgrzemba]

Issue observed on Fedora 42.

The REST API do not work with the old/generic URI syntax:

172.19.99.217 - - [27/Jun/2025:08:22:57 +0200] "GET /pki/rest/info HTTP/1.1" 404 784
172.19.99.217 - - [27/Jun/2025:08:22:57 +0200] "GET /ca/rest/certrequests/profiles HTTP/1.1" 404 804
172.19.99.184 - - [27/Jun/2025:09:47:31 +0200] "GET /pki/rest/apps HTTP/1.1" 404 773
172.19.99.217 - - [27/Jun/2025:10:04:23 +0200] "POST /ca/rest/certs/search HTTP/1.1" 404 795
172.19.99.217 - - [27/Jun/2025:11:47:51 +0200] "GET /ca/rest/account/login HTTP/1.1" 404 796
172.19.99.217 - - [27/Jun/2025:12:00:29 +0200] "GET /ca/rest/admin/users HTTP/1.1" 404 794

But pki-tomcat server works if I replace 'rest' with 'v2', like here:

172.19.99.184 - - [27/Jun/2025:13:33:59 +0200] "GET /pki/v2/info HTTP/1.1" 200 113

I guess 'rest'-URI's should be mapped to 'v2'.

[cgrzemba]

[root@ca]# pki-server upgrade --status
pki-tomcat instance:
  Configuration version: 11.6.0
[root@ca nssdb]# pki-server upgrade --status --verbose
INFO: Loading instance type: pki-tomcatd
INFO: Loading instance: pki-tomcat
INFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf
INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf
INFO: Loading instance Tomcat config: /var/lib/pki/pki-tomcat/conf/tomcat.conf
INFO: Loading password config: /var/lib/pki/pki-tomcat/conf/password.conf
INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg
INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/kra/CS.cfg
INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/kra/registry.cfg
INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/ocsp/CS.cfg
INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/ocsp/registry.cfg
INFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat
INFO: Loading external certs from /var/lib/pki/pki-tomcat/conf/external_certs.conf
INFO: File does not exist: /var/lib/pki/pki-tomcat/conf/external_certs.conf
pki-tomcat instance:
  Configuration version: 11.6.0

[cgrzemba]

It works also with the option '--api v2':

[root@ca pki-tomcat]#  pki --api v2 ca-cert-request-profile-show caServerCert
----------------------------------------------
Enrollment Template for Profile "caServerCert"
----------------------------------------------
  Profile ID: caServerCert
  Renewal: false

  Name: Certificate Request Input
  Class: certReqInputImpl

    Attribute Name: cert_request_type
    Attribute Description: Certificate Request Type
    Attribute Syntax: cert_request_type

    Attribute Name: cert_request
    Attribute Description: Certificate Request
    Attribute Syntax: cert_request

  Name: Requestor Information
  Class: submitterInfoInputImpl

    Attribute Name: requestor_name
    Attribute Description: Requestor Name
    Attribute Syntax: string

    Attribute Name: requestor_email
    Attribute Description: Requestor Email
    Attribute Syntax: string

    Attribute Name: requestor_phone
    Attribute Description: Requestor Phone
    Attribute Syntax: string

[fmarco76]

Could you share details of your configuration and installation steps?

[cgrzemba]

It's a very old installation, updated many times since than. Last updates was from Fedroa38 to Fedora40, Fedora40 to Fedora42. Single server, with LDAP repository. Something else?

[fmarco76]

It could be an update problem with some libraries used for REST API /rest or with rewrite.config rules but it should be verified in the tomcat log.

[cgrzemba]

Does this show the related packages?:

# dnf list --installed | egrep "pki|tomcat|rest"
dogtag-jss-tomcat.x86_64                       5.6.0-1.fc42                           fedora
dogtag-pki.x86_64                              11.6.0-1.fc42                          fedora
dogtag-pki-acme.noarch                         11.6.0-1.fc42                          fedora
dogtag-pki-base.noarch                         11.6.0-1.fc42                          fedora
dogtag-pki-ca.noarch                           11.6.0-1.fc42                          fedora
dogtag-pki-console-theme.noarch                10.10.5-1.fc32                         updates
dogtag-pki-est.noarch                          11.6.0-1.fc42                          fedora
dogtag-pki-java.noarch                         11.6.0-1.fc42                          fedora
dogtag-pki-javadoc.noarch                      11.6.0-1.fc42                          fedora
dogtag-pki-kra.noarch                          11.6.0-1.fc42                          fedora
dogtag-pki-ocsp.noarch                         11.6.0-1.fc42                          fedora
dogtag-pki-server.noarch                       11.6.0-1.fc42                          fedora
dogtag-pki-tests.noarch                        11.6.0-1.fc42                          fedora
dogtag-pki-theme.noarch                        11.6.0-1.fc42                          fedora
dogtag-pki-tks.noarch                          11.6.0-1.fc42                          fedora
dogtag-pki-tools.x86_64                        11.6.0-1.fc42                          fedora
dogtag-pki-tps.noarch                          11.6.0-1.fc42                          fedora
hamcrest.noarch                                3.0-5.fc42                             fedora
krb5-pkinit.x86_64                             1.21.3-6.fc42                          updates
pki-resteasy.noarch                            3.0.26-32.fc42                         fedora
pki-resteasy-client.noarch                     3.0.26-32.fc42                         fedora
pki-resteasy-core.noarch                       3.0.26-32.fc42                         fedora
pki-resteasy-jackson2-provider.noarch          3.0.26-32.fc42                         fedora
pki-resteasy-servlet-initializer.noarch        3.0.26-32.fc42                         fedora
python3-dogtag-pki.noarch                      11.6.0-1.fc42                          fedora
rest.x86_64                                    0.9.1-12.fc42                          fedora
resteasy-atom-provider.noarch                  3.0.26-6.fc32                          updates
resteasy-jaxb-provider.noarch                  3.0.26-6.fc32                          updates
tomcat.noarch                                  1:9.0.105-2.fc42                       updates
tomcat-el-3.0-api.noarch                       1:9.0.105-2.fc42                       updates
tomcat-jsp-2.3-api.noarch                      1:9.0.105-2.fc42                       updates
tomcat-lib.noarch                              1:9.0.105-2.fc42                       updates
tomcat-native.x86_64                           1:1.3.0-9.fc42                         fedora
tomcat-servlet-4.0-api.noarch                  1:9.0.105-2.fc42                       updates

[fmarco76]

Resteasy libraries should be bundled in latest pki version. Could you remove and install the packages following the same approach in the Dockerfile?

[cgrzemba]

This delivers only a partial installation, tomcat is not working and no CLI tools pki, pki-server

[fmarco76]

If I tried to install latest packages in F42 I do not get -resteasy- packages as dependency.

$ sudo dnf install dogtag-pki
[sudo] password for mfargett: 
Updating and loading repositories:
Repositories loaded.
Package                                                                 Arch            Version                                                                 Repository                                    Size
Installing:
 dogtag-pki                                                             x86_64          11.6.0-1.fc42                                                           fedora                                     3.7 KiB
Installing dependencies:
 apache-commons-cli                                                     noarch          1.9.0-5.fc42                                                            fedora                                   129.6 KiB
 apache-commons-codec                                                   noarch          1.17.1-10.fc42                                                          fedora                                   404.0 KiB
 apache-commons-io                                                      noarch          1:2.16.1-11.fc42                                                        fedora                                   638.8 KiB
 apache-commons-lang3                                                   noarch          3.17.0-5.fc42                                                           fedora                                   817.2 KiB
 apache-commons-logging                                                 noarch          1.3.4-6.fc42                                                            fedora                                   237.2 KiB
 apache-commons-net                                                     noarch          3.11.1-9.fc42                                                           fedora                                   378.4 KiB
 dogtag-jss                                                             x86_64          5.6.0-1.fc42                                                            fedora                                     3.2 MiB
 dogtag-jss-tomcat                                                      x86_64          5.6.0-1.fc42                                                            fedora                                    39.4 KiB
 dogtag-ldapjdk                                                         noarch          5.6.0-1.fc42                                                            fedora                                   514.3 KiB
 dogtag-pki-acme                                                        noarch          11.6.0-1.fc42                                                           fedora                                   225.1 KiB
 dogtag-pki-base                                                        noarch          11.6.0-1.fc42                                                           fedora                                     1.8 MiB
 dogtag-pki-ca                                                          noarch          11.6.0-1.fc42                                                           fedora                                     3.9 MiB
 dogtag-pki-est                                                         noarch          11.6.0-1.fc42                                                           fedora                                    43.7 KiB
 dogtag-pki-java                                                        noarch          11.6.0-1.fc42                                                           fedora                                     4.5 MiB
 dogtag-pki-javadoc                                                     noarch          11.6.0-1.fc42                                                           fedora                                    52.1 MiB
 dogtag-pki-kra                                                         noarch          11.6.0-1.fc42                                                           fedora                                   687.5 KiB
 dogtag-pki-ocsp                                                        noarch          11.6.0-1.fc42                                                           fedora                                   348.4 KiB
 dogtag-pki-server                                                      noarch          11.6.0-1.fc42                                                           fedora                                     9.5 MiB
 dogtag-pki-tests                                                       noarch          11.6.0-1.fc42                                                           fedora                                   107.3 KiB
 dogtag-pki-theme                                                       noarch          11.6.0-1.fc42                                                           fedora                                     4.2 MiB
 dogtag-pki-tks                                                         noarch          11.6.0-1.fc42                                                           fedora                                   294.9 KiB
 dogtag-pki-tools                                                       x86_64          11.6.0-1.fc42                                                           fedora                                     1.5 MiB
 dogtag-pki-tps                                                         noarch          11.6.0-1.fc42                                                           fedora                                     1.1 MiB
 ecj                                                                    noarch          1:4.23-12.fc42                                                          fedora                                     2.6 MiB
 esc                                                                    x86_64          1.1.2-21.fc42                                                           fedora                                   590.5 KiB
 fontawesome4-fonts                                                     noarch          1:4.7.0-24.fc42                                                         fedora                                   296.6 KiB
 fontawesome4-fonts-web                                                 noarch          1:4.7.0-24.fc42                                                         fedora                                   988.9 KiB
 freeipa-healthcheck-core                                               noarch          0.18-1.fc42                                                             updates                                  184.0 KiB
 httpcomponents-client                                                  noarch          4.5.14-23.fc42                                                          fedora                                   847.9 KiB
 httpcomponents-core                                                    noarch          4.4.16-23.fc42                                                          fedora                                     1.1 MiB
 javapackages-tools                                                     noarch          6.4.0-5.fc42                                                            fedora                                    71.5 KiB
 openldap-clients                                                       x86_64          2.6.9-3.fc42                                                            fedora                                   663.0 KiB
 publicsuffix-list                                                      noarch          20250616-1.fc42                                                         updates                                  332.8 KiB
 python3-astroid                                                        noarch          3.3.8-2.fc42                                                            fedora                                     2.7 MiB
 python3-dill                                                           noarch          0.4.0-1.fc42                                                            updates                                    1.0 MiB
 python3-dogtag-pki                                                     noarch          11.6.0-1.fc42                                                           fedora                                   877.1 KiB
 python3-flake8                                                         noarch          6.1.0-5.fc42                                                            fedora                                   437.2 KiB
 python3-isort                                                          noarch          6.0.1-1.fc42                                                            fedora                                   732.4 KiB
 python3-mccabe                                                         noarch          0.7.0-11.fc42                                                           fedora                                    38.5 KiB
 python3-platformdirs                                                   noarch          4.2.2-4.fc42                                                            fedora                                   162.0 KiB
 python3-pycodestyle                                                    noarch          2.12.1-3.fc42                                                           fedora                                   364.2 KiB
 python3-pyflakes                                                       noarch          3.1.0-4.fc42                                                            fedora                                   346.4 KiB
 python3-pylint                                                         noarch          3.3.7-1.fc42                                                            updates                                    4.3 MiB
 python3-tomlkit                                                        noarch          0.13.2-2.fc42                                                           fedora                                   447.1 KiB
 slf4j                                                                  noarch          1.7.36-10.fc42                                                          fedora                                    80.2 KiB
 slf4j-jdk14                                                            noarch          1.7.36-10.fc42                                                          fedora                                    11.1 KiB
 tomcat                                                                 noarch          1:9.0.106-1.fc42                                                        updates                                  323.7 KiB
 tomcat-el-3.0-api                                                      noarch          1:9.0.106-1.fc42                                                        updates                                  228.8 KiB
 tomcat-jsp-2.3-api                                                     noarch          1:9.0.106-1.fc42                                                        updates                                  145.3 KiB
 tomcat-lib                                                             noarch          1:9.0.106-1.fc42                                                        updates                                    7.0 MiB
 tomcat-servlet-4.0-api                                                 noarch          1:9.0.106-1.fc42                                                        updates                                  611.6 KiB
 xml-commons-apis                                                       noarch          1.4.01-57.fc42                                                          fedora                                   337.2 KiB
 xml-commons-resolver                                                   noarch          1.2-51.fc42                                                             fedora                                   121.6 KiB
Installing weak dependencies:
 tomcat-native                                                          x86_64          1:1.3.0-9.fc42                                                          fedora                                   208.5 KiB

and they are not installed either:

$ sudo dnf list --installed | egrep "pki|tomcat|rest"
krb5-pkinit.x86_64                                     1.21.3-6.fc42                       updates
rest.x86_64                                            0.9.1-12.fc42                       624cbc92582d4ecfae4c58749abde4f8

There could be a conflict between old and new libraries which is not identified in the dependencies.

[taherrin]

created ticket RHCS-6044

[fmarco76]

@cgrzemba Is the rewrite.config link correct inside the instance configuration?

[root@pki localhost]# pwd
/etc/pki/pki-tomcat/Catalina/localhost
[root@pki localhost]# ll
total 20
-rw-rw----. 1 pkiuser pkiuser 1157 Jul  8 15:48 ROOT.xml
-rw-rw----. 1 pkiuser pkiuser  581 Jul  8 15:59 acme.xml
-rw-rw----. 1 pkiuser pkiuser 1454 Jul  8 15:49 ca.xml
-rw-rw----. 1 pkiuser pkiuser 1156 Jul  8 15:48 pki.xml
lrwxrwxrwx. 1 pkiuser pkiuser   60 Jul  8 15:48 rewrite.config -> /usr/share/pki/server/conf/Catalina/localhost/rewrite.config

[cgrzemba]

there was no link rewrite.config. The content of rewite.config

# ACME
RewriteRule ^/acme/login$ /acme/v1/login
RewriteRule ^/acme/logout$ /acme/v1/logout
RewriteRule ^/acme/enable$ /acme/v1/enable
RewriteRule ^/acme/disable$ /acme/v1/disable
RewriteRule ^/acme/directory$ /acme/v1/directory
RewriteRule ^/acme/new-nonce$ /acme/v1/new-nonce
RewriteRule ^/acme/new-account$ /acme/v1/new-account
RewriteRule ^/acme/new-order$ /acme/v1/new-order
RewriteRule ^/acme/authz/(.*)$ /acme/v1/authz/$1
RewriteRule ^/acme/chall/(.*)$ /acme/v1/chall/$1
RewriteRule ^/acme/order/(.*)$ /acme/v1/order/$1
RewriteRule ^/acme/acct/(.*)$ /acme/v1/acct/$1
RewriteRule ^/acme/cert/(.*)$ /acme/v1/cert/$1
RewriteRule ^/acme/revoke-cert$ /acme/v1/revoke-cert

# EST
RewriteRule ^/.well-known/est/(.*)$ /est/v1/$1

# REST APIs
RewriteRule ^/(pki|ca|tps|tks|ocsp|kra)/rest/(.*)$ /$1/v1/$2

But with this link rewrite.config, there is no change in the behavior of the CLI tool 'pki'