Fixed upstream
ipa-4-5:
https://pagure.io/freeipa/c/52853875e298e38a1e5a9a56c02aac9e30916044

IPA-server-version: ipa-server-4.5.0-21.el7_4.2.2.x86_64

Verified the bug with following observations:

In my case upgrade from RHEL 7.3.z > RHEL 7.4

Steps:
1) Setup self-signed IPA at RHEL 7.3.z
2) makepki.sh tool from freeipa-tools to generate an external CA and ldap/http certificates.
3) # ipa-cacert-manage install -t CT,C,C ca1.crt
4) # cd ca1
5) # ipa-server-certinstall -d -w --pin Secret123 --cert-name myextcertforbug --dirman-password Secret123 server.crt server.key
6) # ipactl restart
7) # ipactl status
8) # Use the repo to upgrade RHEL IPA server to
9) # yum -y update 'ipa*' sssd
10) # tail -1 /var/log/ipaupgrade.log 
11) # ipactl restart
12) # ipactl status
13) # kinit admin
14) Check UI login

Observations:

A) RHEL 7.3.z > RHEL 7.4 update1 : FAILED
B) RHEL 7.3.z > RHEL 7.4 update2 : SUCCESS

Thus on the basis of above observations and Comment#9, marking the status of bug to "VERIFIED"

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2935