Description of problem:
IPA upgrade fails for latest ipa package when upgraded from RHEL 7.1.z to RHEL 7.4.1 (ipa-4.5.0-21.el7_4.1)

Version-Release number of selected component (if applicable):
ipa-4.5.0-21.el7_4.1

How reproducible:
Always

Steps to Reproduce:
1. Setup IPA server on RHEL 7.1.z
2. Configure latest repo to this IPA server.
3. Update this IPA server using command 'yum -y update 'ipa*' sssd'


Actual results:
After step 3, upgrade fails
:: [  BEGIN   ] :: Running 'yum -y update 'ipa*' sssd 'python*''

Cleanup    : nss-softokn-freebl-3.16.2.3-13.el7_1.x86_64     271/271
 
IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
Unexpected error - see /var/log/ipaupgrade.log for details:
HTTPRequestError: Request failed with status 400: Non-2xx response from CA REST API: 400. Invalid profile data
The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information

Verifying  : sssd-krb5-1.15.2-50.el7.x86_64      1/271 

:: [  BEGIN   ] :: Running 'tail -1 /var/log/ipaupgrade.log | grep 'The ipa-server-upgrade command was successful''
:: [   FAIL   ] :: Command 'tail -1 /var/log/ipaupgrade.log | grep 'The ipa-server-upgrade command was successful'' (Expected 0, got 1)


#tail -100 /var/log/ipupgrade.log

2017-08-02T15:02:20Z DEBUG response headers Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Wed, 31 Dec 1969 19:00:00 EST
Set-Cookie: JSESSIONID=F2638D577410A1FB17AE1C20497BA8F1; Path=/ca; Secure; HttpOnly
Content-Type: application/xml
Date: Wed, 02 Aug 2017 15:02:19 GMT

2017-08-02T15:02:20Z DEBUG response body ''
2017-08-02T15:02:20Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2017-08-02T15:02:20Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 46, in run
    server.upgrade()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1913, in upgrade
    upgrade_configuration()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1810, in upgrade_configuration
    ca_import_included_profiles(ca)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 396, in ca_import_included_profiles
    return cainstance.import_included_profiles()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1615, in import_included_profiles
    _create_dogtag_profile(profile_id, profile_data, overwrite=True)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1733, in _create_dogtag_profile
    profile_api.update_profile(profile_id, profile_data)
  File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", line 2079, in update_profile
    body=profile_data
  File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", line 1360, in _ssldo
    % {'status': status, 'explanation': explanation}

2017-08-02T15:02:20Z DEBUG The ipa-server-upgrade command failed, exception: HTTPRequestError: Request failed with status 400: Non-2xx response from CA REST API: 400. Invalid profile data
2017-08-02T15:02:20Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details:
HTTPRequestError: Request failed with status 400: Non-2xx response from CA REST API: 400. Invalid profile data
2017-08-02T15:02:20Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information


Expected results:
IPA upgrade should be successful

Additional info:
This issue is not observed for IPA server upgrade from:
1. RHEL 7.2.z > RHEL 7.4.1
2. RHEL 7.3.z > RHEL 7.4.1
3. RHEL 7.1.z > RHEL 7.4 (4.5.0.21)