From 9ef17b494570af53f4900f51662c387620fa59d9 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: May 13 2026 13:06:19 +0000
Subject: Fail gracefully if NSS key generation fails


If PK11_GenerateKeyPair() completely fails and returns -1
then quit generation. Nalin has a loop that will retry if
the requested key size doesn't match the actual size
generated. For the case of a complete failure this ended up
re-running key generation in a tight loop and causing
certmonger to effectively hang.

I'm not completely convinced that this test is needed at
all but it's been in here for over a decade so I'll leave
the rest.

Fixes: https://pagure.io/certmonger/issue/305

Signed-off-by: Rob Crittenden <rcritten@redhat.com>

---

diff --git a/src/keygen-n.c b/src/keygen-n.c
index 27c1efc..5b0c5c1 100644
--- a/src/keygen-n.c
+++ b/src/keygen-n.c
@@ -576,6 +576,10 @@ retry_gen:
 				       PR_TRUE, PR_TRUE, NULL);
 	/* Retry with the optimum key size. */
 	if (privkey == NULL) {
+		if (cm_key_size == -1) {
+			cm_log(1, "Error generating key pair.\n");
+			_exit(CM_SUB_STATUS_INTERNAL_ERROR);
+		}
 		cm_key_size = PK11_GetBestKeyLength(slot, pmech);
 		if (cm_key_size != cm_requested_key_size) {
 			cm_log(1,