Title: #3316: [WIP] profile-based system cert renewal
Early PR to see what CI has to say about it...
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3316/head:pr3316
git checkout pr3316