FIPS mode: openssl pkcs12 command needs -nomacver option

In FIPS mode, ipa server installation fails in a call to
openssl pkcs12 command because the PKCS12 MAC requires PKCS12KDF
which is not an approved FIPS algo.
The fix consists in passing the additional option -nomacver

Fixes: https://pagure.io/freeipa/issue/9878
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>

ipaserver/install/certs.py

@@ -749,6 +749,12 @@ class CertDB:
             '-nokeys',
             '-password', 'file:{pk12pwfile}'.format(pk12pwfile=pk12pwfile.name),
         ]
+        # the PKCS12 MAC requires PKCS12KDF which is not an approved FIPS
+        # algorithm and cannot be supported by the FIPS provider.
+        # Do not require mac verification in FIPS mode
+        fips_enabled = tasks.is_fips_enabled()
+        if fips_enabled:
+            cmd.append('-nomacver')
         ipautil.run(cmd)
 
         cmd = [
@@ -759,6 +765,8 @@ class CertDB:
             '-noenc',
             '-password', 'file:{pk12pwfile}'.format(pk12pwfile=pk12pwfile.name),
         ]
+        if fips_enabled:
+            cmd.append('-nomacver')
         ipautil.run(cmd)
 
         pki_client = pki.client.PKIClient(