Request for enhancement

Sequential serial numbers issued by the CA rely on a 389-ds feature named Virtual List View ( VLV).
With the switch in 389-ds to the LMDB backend the performance of VLV has decreased significantly. The PKI team recommends only using random serial numbers with LMDB.
This will also achieve a goal of non-conflicting serial numbers of a series of installation attempts. It is often an issue with browsers when a new IPA server is stood up multiple times during initial deployment where the subject/serial numbers conflict because sequential serial numbers always begin at 1.
Currently to enable random serial numbers in an installation one needs to provide the --random-serial-numbers options to ipa-server-install and/or ipa-ca-install. The value of the serial number protocol is stored in cn=ipa,cn=cas,cn=ca,$SUFFIX in the attribute. ipacarandomserialnumberversion. 0 for sequential and 3 for random.

Several things need to happen.
1. Make the --random-serial-number option redundant and set this value always to True
2. Update the value of ipacarandomserialnumberversion. in LDAP on upgrade to enable RSNv3 for all new replicas. This will not affect existing CA servers though We do not recommend mixing indefinitely.

An upgrade plugin is probably the best place to apply #2 so additional logic can take place. We may pin this to a specific version of PKI, or 389-ds or use other external factors to decide when to force enable RSNv3.