URL: https://github.com/freeipa/freeipa/pull/5832 Author: antoniotorresm Title: #5832: Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server Action: opened

PR body: """ When upgrading from a server with IPA CA before PKINIT was introduced (4.5), PKINIT would not be enabled and there wasn't any way to enable it since upgrade code only issues self-signed certificates when certificates are missing. With these change there is a way to enable PKINIT when coming from a IPA server with a pre-PKINIT version (4.4 and before).

Fixes: https://pagure.io/freeipa/issue/8532 Signed-off-by: Antonio Torres antorres@redhat.com """

To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5832/head:pr5832 git checkout pr5832