https://bugzilla.redhat.com/show_bug.cgi?id=712931 - CS requires too
many ports to be opened in firewall.

This patch provides configuration to run the ca behind an apache proxy.

For IPA, once you apply the patch, you will need to update pki-ca,
pki-common, pki-setup, pki-selinux, pki-common-javadoc.  The UI changes
are just to remove some annoying 404's in the httpd logs.

Then, you need to call pkicreate with the additional option
-enable_proxy.  This will configure the system to run behind a proxy
with ajp port 9447, proxy secure port 443 and proxy unsecure port 80.

Pkisilent can run as before.  After pkisilent is complete, the
file /etc/<instance_name/conf/proxy.conf will exist.

Make a symbolic link of this file to /etc/httpd/conf.d/dogtag.conf
Restart httpd and you should be able to browse from httpd.

Adam, please test IPA install and also install of a replica.  Remember
that the replica security domain should be at port 443.

Ade