We were still using the caRAserverCert profile during installation. https://fedorahosted.org/freeipa/ticket/1744