IPA Server installation with --subject parameter other than default realm fails.

Version-Release number of selected component (if applicable):
ipa-server-3.2.1-1
pki-base-10.0.3-2

Steps to Reproduce:
1.Install IPA with --subject other than default realm

Actual results:
Installation failed.

[root@ipa-master ~]# ipa-server-install --setup-dns
--forwarder=10.65.201.89 -r TESTRELM.COM -p xxxxxxx -P xxxxxxx -a xxxxxxx
--subject=O=CUPCAKE -U

The log file for this installation can be found in
/var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.

This includes:
- Configure a stand-alone CA (dogtag) for certificate management
- Configure the Network Time Daemon (ntpd)
- Create and configure an instance of Directory Server
- Create and configure a Kerberos Key Distribution Center (KDC)
- Configure Apache (httpd)
- Configure DNS (bind)

Warning: skipping DNS resolution of host ipa-master.testrelm.com
The domain name has been determined based on the host name.

Using reverse zone 207.65.10.in-addr.arpa.

The IPA Master Server will be configured with:
Hostname: ipa-master.testrelm.com
IP address: 10.65.207.14
Domain name: testrelm.com
Realm name: TESTRELM.COM

BIND DNS server will be configured to serve IPA domain with:
Forwarders: 10.65.201.89
Reverse zone: 207.65.10.in-addr.arpa.

Configuring NTP daemon (ntpd)
[1/4]: stopping ntpd
[2/4]: writing configuration
[3/4]: configuring ntpd to start on boot
[4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server (dirsrv): Estimated time 31 minutes
[1/37]: creating directory server user
[2/37]: creating directory server instance
[3/37]: adding default schema
[4/37]: enabling memberof plugin
[5/37]: enabling winsync plugin
[6/37]: configuring replication version plugin
[7/37]: enabling IPA enrollment plugin
[8/37]: enabling ldapi
[9/37]: configuring uniqueness plugin
[10/37]: configuring uuid plugin
[11/37]: configuring modrdn plugin
[12/37]: configuring DNS plugin
[13/37]: enabling entryUSN plugin
[14/37]: configuring lockout plugin
[15/37]: creating indices
[16/37]: enabling referential integrity plugin
[17/37]: configuring certmap.conf
[18/37]: configure autobind for root
[19/37]: configure new location for managed entries
[20/37]: configure dirsrv ccache
[21/37]: restarting directory server
[22/37]: adding default layout
[23/37]: adding delegation layout
[24/37]: creating container for managed entries
[25/37]: configuring user private groups
[26/37]: configuring netgroups from hostgroups
[27/37]: creating default Sudo bind user
[28/37]: creating default Auto Member layout
[29/37]: adding range check plugin
[30/37]: creating default HBAC rule allow_all
[31/37]: initializing group membership
[32/37]: adding master entry
[33/37]: configuring Posix uid/gid generation
[34/37]: adding replication acis
[35/37]: enabling compatibility plugin
[36/37]: tuning directory server
[37/37]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring certificate server (pki-tomcatd): Estimated time 33 minutes 30
seconds
[1/20]: creating certificate server user
[2/20]: configuring certificate server instance
[3/20]: disabling nonces
[4/20]: creating RA agent certificate database
[5/20]: importing CA chain to RA certificate database
[6/20]: fixing RA database permissions
[7/20]: setting up signing cert profile
[8/20]: set up CRL publishing
[9/20]: set certificate subject base
[10/20]: enabling Subject Key Identifier
[11/20]: enabling CRL and OCSP extensions for certificates
[12/20]: setting audit signing renewal to 2 years
[13/20]: configuring certificate server to start on boot
[14/20]: restarting certificate server
[15/20]: requesting RA certificate from CA
[16/20]: issuing RA agent certificate
[17/20]: adding RA agent as a trusted user
[18/20]: configure certificate renewals
[19/20]: configure Server-Cert certificate renewal
[20/20]: Configure HTTP to proxy connections
Done configuring certificate server (pki-tomcatd).
Configuring Kerberos KDC (krb5kdc): Estimated time 30 minutes 30 seconds
[1/10]: adding sasl mappings to the directory
[2/10]: adding kerberos container to the directory
[3/10]: configuring KDC
[4/10]: initialize kerberos container
[5/10]: adding default ACIs
[6/10]: creating a keytab for the directory
[7/10]: creating a keytab for the machine
[8/10]: adding the password extension to the directory
[9/10]: starting the KDC
[10/10]: configuring KDC to start on boot
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
[1/2]: starting kadmin
[2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring ipa_memcached
[1/2]: starting ipa_memcached
[2/2]: configuring ipa_memcached to start on boot
Done configuring ipa_memcached.
Configuring ipa-otpd
[1/2]: starting ipa-otpd
[2/2]: configuring ipa-otpd to start on boot
Done configuring ipa-otpd.
Configuring the web interface (httpd): Estimated time 31 minutes
[1/15]: disabling mod_ssl in httpd
[2/15]: setting mod_nss port to 443
[3/15]: setting mod_nss password file
[4/15]: enabling mod_nss renegotiate
[5/15]: adding URL rewriting rules
[6/15]: configuring httpd
[7/15]: setting up ssl
Unexpected error - see /var/log/ipaserver-install.log for details:
CertificateOperationError: Certificate operation cannot be completed: Unable to
communicate with CMS (Internal Server Error)
[root@ipa-master ~]#

Expected results:
Installation should be successful.