Description of problem:
We have an externally signed CA cert in IdM, resulting in the following
chain:
1. CN=Red Hat IT Root CA/O=Red Hat, Inc.
2. CN=Intermediate Certificate Authority/O=Red Hat
3. O=IPA.REDHAT.COM/CN=Certificate Authority
This is the chain stored in /etc/ipa/ca.crt.  However, the cert stored
in /usr/share/ipa/html/ca.crt only consists of #3 (the IPA CA cert). As
such, when clients are prompted to download the CA cert during the
ipa-client-install from http://$IPA_SERVER/ipa/config/ca.crt, they fetch
only #3.  This kind of works, but then the install fails at:
======================
Do you want to download the CA cert from
http://$IPA_SERVER/ipa/config/ca.crt?
(this is INSECURE) [no]: yes
Downloading the CA certificate via HTTP, this is INSECURE
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=IPA.REDHAT.COM
    Issuer:      CN=Intermediate Certificate Authority,OU=prod,O=Red Hat
    Valid From:  2017-10-16 19:19:57
    Valid Until: 2037-10-11 19:19:57
Enrolled in IPA realm IPA.REDHAT.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm IPA.REDHAT.COM
trying https://$IPA_SERVER/ipa/json
Connection to https://$IPA_SERVER/ipa/json
failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed
(_ssl.c:579)
[...]
cannot connect to 'any of the configured servers':
https://$IPA_SERVER/ipa/json,
[...]
The ipa-client-install command failed. See
/var/log/ipaclient-install.log for more information