Require version of NSS that properly parses base64-encoded certs
    
    There were cases where a base64-encoded cert with no header/footer would
    not be handled properly and rejected. This was causing the CA install
    to fail.
    
    https://fedorahosted.org/freeipa/ticket/3586