f048794
Don't ignore --ignore-last-of-role for last CA Use a handler created for the purpose of deciding whether to raise exception or not. https://fedorahosted.org/freeipa/ticket/6259 Reviewed-By: Oleg Fayans <ofayans@redhat.com>