URL: https://github.com/freeipa/freeipa/pull/3508 Author: frasertweedale Title: #3508: [Backport][ipa-4-7] Profile-based system cert renewal Action: opened

PR body: """ Manual backport of https://github.com/freeipa/freeipa/pull/3316 to ipa-4-7. We may need to backport this change all the way to ipa-4-6 to allow us to change the IPA RA certificate profile on older releases. Currently this change is on master and ipa-4-8, so ipa-4-7 is the next step.

There were some trivial conflicts. The only substantive conflicts were in `dogtaginstance.py`. These were resolved by cherry-picking 8686cd3b4b69f725aee05c9cdd3034d7436055d3 ahead of the original patchset.

https://pagure.io/freeipa/issue/7991

Do not rely on CI only; I will have to test this change myself so I'll add WIP label, and remove it when I'm satisfied. """

To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3508/head:pr3508 git checkout pr3508