Title: #367: Remove nsslib from IPA
* Ticket 5695 is about ```FreeIPA on FIPS enabled systems```. Moving from NSS
to OpenSSL is a big change and should be tracked by its own ticket.
* Are customers fine with the fact that FreeIPA clients will no longer very
CRLs? OpenSSL does not automatically download and verify CRLs. OCSP is not yet
supported by Python's ssl module.
See the full comment at
Manage your subscription for the Freeipa-devel mailing list:
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code