Please review the attached patch which addresses:

The patch was tested by installing a 'pki-tomcat' CA master:

    ==========================================================================
                                INSTALLATION SUMMARY
    ==========================================================================

      Administrator's username:             caadmin
      Administrator's PKCS #12 file:
            /root/.dogtag/pki-tomcat/ca_admin_cert.p12
      Administrator's certificate database:
            /root/.dogtag/pki-tomcat/ca/alias

      To check the status of the subsystem:
            systemctl status pki-tomcatd@pki-tomcat.service

      To restart the subsystem:
            systemctl restart pki-tomcatd@pki-tomcat.service

      The URL for the subsystem is:
            https://pki.example.com:8443/ca

      PKI instances will be enabled upon system boot

    ==========================================================================
and a 'pki-tomcat-ca-clone' CA clone on the same machine ('pki.example.com'):
    ==========================================================================
                                INSTALLATION SUMMARY
    ==========================================================================

      Administrator's username:             caadmin

      This CA subsystem of the 'pki-tomcat-ca-clone' instance
      is a clone.

      To check the status of the subsystem:
            systemctl status pki-tomcatd@pki-tomcat-ca-clone.service

      To restart the subsystem:
            systemctl restart pki-tomcatd@pki-tomcat-ca-clone.service

      The URL for the subsystem is:
            https://pki.example.com:17443/ca

      PKI instances will be enabled upon system boot

    ==========================================================================