Description of problem:
When you have your IdM PKI CA certificate signed by an external CA, the
IdM CA certificate contains the full certificate chain. To verify the
full chain, only the Root CA certificate is required.

When you now request a new service certificate from the IdM CA, it only
contains the actual service certificate and not the full chain. The IPA
CA certificate has to be used as a trust anchor to verify the new
service certificate.

People now need to have the Root CA *and* the IPA CA certificate in
their trust store to verify the chain.

We should either include the full trust chain into certificates issued
by the IPA CA by default or provide a config option for this so that
IPA admins can decide on their own if they wanna trust the upstream CA
for all sort of certificates.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info: