ipa-client-install: Publish CA certificate to systemwide store
    
    During the installation, copy the CA certificate to the systemwide
    store (/etc/pki/ca-trust/source/anchors/ipa-ca.crt) and update the
    systemwide CA database.
    
    This allows browsers to access IPA WebUI without warning out of the
    box.
    
    https://fedorahosted.org/freeipa/ticket/3504