[Freeipa-devel] [freeipa PR#5832][opened] Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server

[antoniotorresm]

   URL: https://github.com/freeipa/freeipa/pull/5832
Author: antoniotorresm
 Title: #5832: Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server
Action: opened

PR body:
"""
When upgrading from a server with IPA CA before PKINIT was introduced
(4.5), PKINIT would not be enabled and there wasn't any way to enable it
since upgrade code only issues self-signed certificates when
certificates are missing. With these change there is a way to enable
PKINIT when coming from a IPA server with a pre-PKINIT version (4.4 and
before).

Fixes: https://pagure.io/freeipa/issue/8532
Signed-off-by: Antonio Torres <antorres(a)redhat.com&gt;
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5832/head:pr5832
git checkout pr5832