Issue

If the CA or KRA fails to start with ipactl restart this condition is not detected and the command returns 0.

I tested a rather harder to reproduce case where I backed up an HSM installation, uninstalled IPA, removed the keys from the HSM and ran a restore. The restored server appears to start fine, though it takes a while. Of course the result is that there are no CA o KRA services because they failed to launch.

This is a corner case for HSM that would be nice to detect and tell the user that something is wrong, like missing keys (they are probably hosed) but there are other potential use cases as well, like restoring with expired CA certificates.