ipa-server-install with external CA fails to issue pkinit certs. This happens because the installer calls krb = krbinstance.KrbInstance(fstore) then krb.enable_ssl() and in this code path self.config_pkinit is set to None, leading to a wrong code path. The fix initializes the required fields of the krbinstance before calling krb.enable_ssl. https://pagure.io/freeipa/issue/6921 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Abhijeet Kasurde <akasurde@redhat.com>