Description of problem:
A CA-less IPA server installation will fail when using external certificates with UTF8 field values that encapsulate RDN components in double quotes, like this -> 

Subject: C=US, ST=CA, O="EXAMPLE DOT COM", CN=ipa1.example.com

When Apache is configured during installation, this subject is used as the value to the 'NSSNickname' directive in /etc/httpd/conf.d/nss.conf and is written to the file as below -> 

NSSNickname "CN=ipa1.example.com,O=\"EXAMPLE DOT COM\",ST=CA,C=US"

The installer code will encapsulate a value that contains spaces in double quotes as required by mod_nss. The issue here is that the value itself also includes double quotes; this causes Apache to throw an error when it is restarted, and the overall IPA installation fails at this point -> 

[IPA installer log]

2016-03-24T02:41:09Z DEBUG The ipa-server-install command failed, exception: CalledProcessError: Command ''/bin/systemctl' 'restart' 'httpd.service'' returned non-zero exit status 1
2016-03-24T02:41:09Z ERROR Command ''/bin/systemctl' 'restart' 'httpd.service'' returned non-zero exit status 1

[Apache error log]

[Thu Mar 24 10:00:12.309299 2016] [:error] [pid 21470] Certificate not found: 'CN=ipa1.example.com,O="EXAMPLE DOT COM",ST=CA,C=US'


However, Apache starts up just fine when the value is surrounded by single quotes instead in nss.conf. I confirmed this on ipa-server-4.2.0-15.el7_2.6.x86_64. 

The workaround is a slight modification to the installer script /usr/lib/python2.7/site-packages/ipaserver/install/installutils.py ->

 1. Create a back-up of /usr/lib/python2.7/site-packages/ipaserver/install/installutils.py

 2. Edit installutils.py and look for the following code at line 390 ->

    389  if quotes:
    390      newfile.append('%s%s"%s"\n' % (directive,separator, value))

    [Change line 390 to]:

             newfile.append('%s%s\'%s\'\n' % (directive,separator, value))


This will encapsulate the Subject value with single quotes instead of double-quotes. This change allowed my installation to complete when tested and was also verified by a CU -> 

# diff -u /usr/lib/python2.7/site-packages/ipaserver/install/installutils.py.orig /usr/lib/python2.7/site-packages/ipaserver/install/installutils.py 
--- /usr/lib/python2.7/site-packages/ipaserver/install/installutils.py.orig	2016-03-23 16:44:52.627394610 -0700
+++ /usr/lib/python2.7/site-packages/ipaserver/install/installutils.py	2016-03-24 13:20:34.058402844 -0700
@@ -387,7 +387,7 @@
             valueset = True
             if value is not None:
                 if quotes:
-                    newfile.append('%s%s"%s"\n' % (directive, separator, value))
+                    newfile.append('%s%s\'%s\'\n' % (directive, separator, value))
                 else:
                     newfile.append('%s%s%s\n' % (directive, separator, value))
         else:


With the change, 'NSSNickname' in nss.conf now looks like this post-install -> 

# grep NSSNickname /etc/httpd/conf.d/nss.conf 
NSSNickname 'CN=ipa1.example.com,O=\"EXAMPLE DOT COM\",ST=CA,C=US'