During the enrolment there is no check that the server is a legitimate IPA server. Kerberos authentication solves part of the problem but if the attacker managed to put himself in the middle it would be able to pass the client fake certificates and watch the traffic between client and server. We need to implement a way to make sure that the certificates that are used by client are from a real legitimate server.