In current Fedora 27 and Rawhide, after standard FreeIPA deployment via
rolekit, visiting the FreeIPA web UI with firefox results in a 'Your connection
is not secure' screen:

https://openqa.stg.fedoraproject.org/tests/159242#step/freeipa_webui/4

The funny thing is, this didn't happen 6 days ago when running tests on the
FreeIPA update we pushed stable:

https://openqa.stg.fedoraproject.org/tests/155282

I haven't figured out what changed between the two runs yet, but so far it
doesn't seem to be obvious - not FreeIPA, not Firefox, and not NSS. I'll look
into it some more soon, if no-one else gets to it first.

Proposing as a blocker bug per Alpha criterion "The core functional
requirements for all Featured Server Roles must be met, but it is acceptable if
moderate workarounds are necessary to achieve this" - 'domain controller' is a
release-blocking role, and one of its core requirements is "The FreeIPA
configuration web UI must be available and allow at least basic configuration
of user accounts and permissions" (per
https://fedoraproject.org/wiki/Domain_controller_role_requirements ).