When proxy ports are enabled for installation (for IPA for example), the proxy ports are used to create the DN for the subsystem in the security domain. The DN looks something like:
cn=<type>-<hostname>-<proxy port>, ...

pkidestroy though currently does not have the logic to support proxy ports, and so invokes updateDomainXML with ports corresponding to the admin/secure port rather than the proxy ports.
As a result, the entry is not removed from the security domain.

We need to fix this so that the pkidestroy logic selects the correct port.

A couple of notes:
1. Its not clear to me whether pkidestroy reads the archived or the current CS.cfg. There is a 10.3 ticket to address this.

1. If someone enables/or disables proxy ports post-installation, and pkidestroy reads the current CS.cfg, then the DN in the security domain will likely differ from what is calculated by pkidestroy. The answer to this is to require that the security domain be updated accordingly when proxy ports are enabled. (And maybe even provide a script for that). That will be the subject of another ticket.