[freeipa PR#2706][opened] pkinit enable: use local dogtag only if host has CA

[flo-renaud]

   URL: https://github.com/freeipa/freeipa/pull/2706
Author: flo-renaud
 Title: #2706: pkinit enable: use local dogtag only if host has CA
Action: opened

PR body:
"""
## pkinit enable: use local dogtag only if host has CA

`ipa-pkinit-manage enable` is failing if called on a master that does not have a CA
instance, because it is trying to contact dogtag on the localhost.
The command should rather use certmonger in this case, and let certmonger contact the
right master to request the KDC certificate.

Fixes: https://pagure.io/freeipa/issue/7795

## ipatests: add integration test for pkinit enable on replica

`ipa-pkinit-manage` enable was failing when run on a replica without a CA instance.
Add a test with the following scenario:
- install a replica with `--no-pkinit`
- check that the KDC cert is self signed
- call `ipa-pkinit-manage enable`
- check that the KDC cert is signed by IPA CA

Related to https://pagure.io/freeipa/issue/7795
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2706/head:pr2706
git checkout pr2706