For bug https://bugzilla.redhat.com/show_bug.cgi?id=668899 Where is the code that generates the initial CA and server cert? If I have to do a full ipa install to reproduce I will (btw, is the 2.0 install guide on freeipa.org correct?), but I'd rather have a smaller, easily reproducible test case.