Currently the CA subsystem creates the system certificates locally during installation. At that point the CA is not completely installed yet, so some components inside it may not be running properly, but it is used to generate the system certificates. For this to work the server has to ignore some errors that happen due to the incomplete state (e.g. #1615). The problem is if there are real errors during installation it will be hard to detect and investigate since the proper state of the server at that point is not clearly defined.

It would be better to create the system certificates in pkispawn before the server is started. That way there is no chicken-and-egg problem. When the server is started the server already has the system certificates. This will reduce the code complexity and improve troubleshooting.

This requires moving the "local" certificate generation code from ConfigurationUtils into a reusable library and CLI. This also depends on refactoring the certificate profile processor (#1691).