Make certmonger a (pre) requires on server, restart it before upgrading
    
    certmonger may provide new CAs, as in the case from upgrading IPA 2.2
    to 3.x. We need these new CAs available during the upgrade process.
    
    The certmonger package does its own condrestart as part of %postun
    which runs after the %post script of freeipa-server, so we need to
    restart it ourselves before upgrading.
    
    https://fedorahosted.org/freeipa/ticket/3378