Title: #2290: Use 4096 RSA key by default for CA signing certificate
Note that we are not making the choice of CA key size configurable yet,
only changing it to a resonable default for 2018.
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2290/head:pr2290
git checkout pr2290