Request for enhancement

The default certificate profile that IPA uses to issue server certificates is set to auto-approve them.

In order to be able to issue CA and KRA subsytem certificates (audit, ocsp, etc) the submit, check, approve workflow needs to be implemented.

The first two calls already exist in cert_status and cert_request so only cert_approve needs to be implemented.

Access control to this API will initially be very strict. A virtual ACI may be required, that is TBD, but at a minimum we can restrict this to only IPA servers. We can also choose to go a step further and only allow the configured CA renewal master to approve requests.

That could be extended in the future to base the approval acceptance based on profile, etc.