Fix service-disable in CA-less install.

https://fedorahosted.org/freeipa/ticket/3886

ipalib/plugins/service.py

@@ -624,6 +624,7 @@ class service_disable(LDAPQuery):
         done_work = False
 
         if 'usercertificate' in entry_attrs:
+            if self.api.env.enable_ra:
                 cert = x509.normalize_certificate(entry_attrs.get('usercertificate')[0])
                 try:
                     serial = unicode(x509.get_serial_number(cert, x509.DER))