So with this Debian doesn't need a shared nssdb for certmonger to work properly? If so, I'm willing to test it on our side if you need that before landing it.

Yes, it should work.

I haven't merged this yet because I wonder if this is necessary at all. NSS is fine initializing with no database and since this is just parsing it could work fine. I'm just reluctant to strip out code from 2011 that has otherwise worked fine (assuming /etc/pki/nssdb exists).

If you could test it with certmonger configured with -d3 and look at the journal once the IPA install is done we should see a bunch of:

cm_certread_n_parse: Using NSS database

where foo is either /etc/pki/nssdb, the CA db, the 389-ds db or NoDB_Init.

I think the proposed solution looks fine - using the default database if it exists or initializing with no DB solves pretty much all issues and maintains backwards compatibility on the off chance the default DB has some contents or settings that affect certmonger's operation.

I switched to a much simpler implementation where no DB is required at all. i think this will be far more robust than poking around the FS looking for files. The NSS initialization flags were mostly doing this already, it was just missing the flag to not initialize the PKCS#11 devices (pkcs11.txt/secmod.db). With that no physical database is required at all.

I re-read the parsing code and it already opens the database in a way it doesn't consider any existing content so there is no reason to rely on an existing database at all. Doing so also significantly simplifies the code.

Excellent :)