Title: #584: Improve the implementation of PKINIT certificate retrieval
I have reworked the PR quite a bit and added/changed a few checks due to
replication race conditions affecting PKINIT requests from replica to master.
See the full comment at
Manage your subscription for the Freeipa-devel mailing list:
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code