[Freeipa-devel] [freeipa PR#964][opened] Restore old version of caIPAserviceCert for upgrade only

[frasertweedale]

   URL: https://github.com/freeipa/freeipa/pull/964
Author: frasertweedale
 Title: #964: Restore old version of caIPAserviceCert for upgrade only
Action: opened

PR body:
"""
The latest version of caIPAserviceCert profile includes a feature
that is not available before Dogtag 10.4, and this version of the
profile is intended for new installs only (otherwise, problems will
arise in topologies containing CA replicas at an earlier version).
But IPA versions before v4.2 did not use LDAP-based profiles, so the
new version of the profile gets imported when upgrading from
pre-v4.2 to v4.5 or later.

We do not yet have a proper version- and topology-aware profile
update mechanism, so to resolve this issue, ship the older version
of the profile alongside the newer version, and make sure we use the
older version when importing the profile in an upgrade context.

https://pagure.io/freeipa/issue/7097
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/964/head:pr964
git checkout pr964