This patch should make joining a client to the domain and using certmonger to get an initial certificate work.