IdM client unable to obtain CA certificate from IdM server when enrolling using OTP

Issue

• IdM client fails to install when using One-time-password (OTP):

  # ipa-client-install -w <...> --unattended
  
  Discovery was successful!
  Client hostname: idm-client.idm.example.com
  Realm: IDM.EXAMPLE.COM
  DNS Domain: idm.example.com
  IPA Server: idm-server.idm.example.com
  BaseDN: dc=idm,dc=example,dc=com
  
  Downloading the CA certificate via HTTP, this is INSECURE
  Cannot obtain CA certificate
  'http://idm-server.idm.example.com/ipa/config/ca.crt' doesn't have a certificate.
  Installation failed. Rolling back changes.
  

• Installation finished successfully when admin principal was supplied:

  # ipa-client-install -p admin -w <...> --unattended