server upgrade: fix upgrade in CA-less

Use /etc/httpd/alias instead of /var/lib/ipa/radb in upload_cacrt, as
/var/lib/ipa/radb is not populated in CA-less.

Do not migrate ipaCert from /etc/httpd/alias to /var/lib/ipa/radb in
CA-less, as it might be an incorrect certificate from previous CA-ful
install, and is not necessary anyway.

https://fedorahosted.org/freeipa/ticket/5959

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>

ipaserver/install/plugins/update_ra_cert_store.py

@@ -22,6 +22,10 @@ class update_ra_cert_store(Updater):
     """
 
     def execute(self, **options):
+        ca_enabled = self.api.Command.ca_is_enabled()['result']
+        if not ca_enabled:
+            return False, []
+
         olddb = certdb.NSSDatabase(nssdir=paths.HTTPD_ALIAS_DIR)
         if not olddb.has_nickname('ipaCert'):
             # Nothign to do

ipaserver/install/plugins/upload_cacrt.py

@@ -18,6 +18,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from ipalib.install import certstore
+from ipaplatform.paths import paths
 from ipaserver.install import certs
 from ipalib import Registry, errors
 from ipalib import Updater
@@ -34,7 +35,7 @@ class update_upload_cacrt(Updater):
     """
 
     def execute(self, **options):
-        db = certs.CertDB(self.api.env.realm)
+        db = certs.CertDB(self.api.env.realm, paths.HTTPD_ALIAS_DIR)
         ca_cert = None
 
         ca_enabled = self.api.Command.ca_is_enabled()['result']