mod_nss was the original crypto engine used in Apache with IPA. Support was dropped in IPA release 4.7.0 in 4596674481dbbeb9026f0ff793699479e1cfb09d and looks like it was introduced into Fedora in F28.
I think it's safe to remove this upgrade code.
PR https://github.com/freeipa/freeipa/pull/7671
Metadata Update from @rcritten: - Issue assigned to rcritten
master:
ipa-4-12:
Metadata Update from @rcritten: - Issue close_status updated to: fixed - Issue status updated to: Closed (was: Open)