After running pkisilent to configure the CA (which succeeds) it calls
"/sbin/service pki-cad status" which correctly emits the message
"Although 'pki-ca' has been CONFIGURED, it must still be RESTARTED!" and
correctly returns an exit status of 4 (because it isn't configured yet).
The non-zero exit status causes an exception to be raised and which then
executes:

logging.critical("failed to restart ca instance %s" % e)
raise RuntimeError('Configuration of CA failed')

Note, the logging.critical message is wrong.

It calls "/sbin/service pki-cad status" because of this comment:

pkisilent doesn't return 1 on error so look at the output of

/sbin/service pki-cad status. It will tell us if the instance

still needs to be configured.

But pkisilent does in fact return an exit status of 0 for success and
255 for failure.

It should instead call "/sbin/service pki-cad restart" after pkisilent,
a call to "/sbin/service pki-cad status" should then return zero.