Run certupdate after promoting to CA-ful deployment
    
    After installing a CA in a CA-less installations (using
    ipa-ca-install), the new CA certificate is not installed in
    /etc/httpd/alias. This causes communication failure between IPA
    framework and Dogtag (it cannot verify the Dogtag server
    certificate).
    
    Perform a CertUpdate as the final step when promoting a CA-less
    deployment to CA-ful.
    
    Fixes: https://pagure.io/freeipa/issue/7230
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>