This is an interim solution for supporting HSM failover by automatically
shutting down the server when signing key becomes inaccessible.
At auto-shutdown, a crumb fiile will be left in the instance directory
for an external daemon to detect and restart, if necessary.
Due to limitation of the watch dog (nuxwdog) at present time,
the restart option currently only works if started with watch dog (nuxwdog),
and it will prompt for passwords on the terminals.
The restart counter is to prevent the server from going into an infinite restart
loop. Administrator will have to reset autoShutdown.restart.count to 0 when max
is reached.

(cherry picked from commit 5a9ecad9172f76ca1b94b40aedcdd49d009aceb1)

Related to ticket #1575 Internet Explorer 11: caUserCert request submission fails using the EE page.

This patch will only do the following:

Detect IE when IE11 is being used. Before this IE11 was mistaken for Firefox.
Detect IE11 specifically and warn the user that there is no support.

This ticket will live to se we can fix this properly by porting the current
VBS script to Javascript to support cert enrollment on IE 11.

(cherry picked from commit 0baf14ad496d18991a83f211b4b60d1811e21fb3)

It appears that the PortalEnroll plugin was never converted to work in the
Profile Framework.
This patch takes out the following line from CS.cfg:
auths.impl.PortalEnroll.class=com.netscape.cms.authentication.PortalEnroll

so that it cannot be instantiated from the console, nor manually in CS.cfg,
unless explicitly put back in.
While in CS.cfg.in, I found the NSSAuth auths.impl line having no real
implementation, so I remove that too.

(cherry picked from commit a62ab357eb759ea59ea5204a046d0cab99126000)

The ListCerts servlet and the templates have been fixed to pass
the skipRevoked and skipNonValid parameters to the subsequent page.

Some debugging messages have been cleaned up as well.

https://fedorahosted.org/pki/ticket/1538
(cherry picked from commit 24d7d88bd0d8b79fe5b8b6dfd84238399bc1433c)

This patch changes the relevant CA enrollment admin profiles so that they accept
requests for EC certs. The issue actually not just affected KRA, it also affected
other non-CA subsystems.

(cherry picked from commit 017f4f9d4b3c6051f082b8c2b49d5143fd8450e9)

- PKI TRAC Ticket #1522 - CA UI adds extra space in Base 64 encoded
  certificate display

When setting up a clone, indexes are added before the
replication agreements are set up and the consumer is initialized.
Thus, as data is replicated and added to the clone db, the
data is indexed.

When cloning is done with the replication agreements already set
up and the data replicated, the existing data is not indexed and
cannot be accessed in searches.  The data needs to be reindexed.

Related to ticket 1414

Ticket #1523

Move the dire warning about the crypto object to sections where it applies.

Also slightly changed the message due to context.

Ticket # 1466 .

Also remove some needless copies of server.xml from the code.

Ticket #1446:

Without the crypto object, the user is now presented with a very bared bones
keygen tag powered UI. ONe can only select a key strength and only use RSA.

This fix adds simple UI to make better use of the keygen tag:

1. Allows the use of ECC.
2. Gives simple info on how the key strengths map to RSA key size and
ECC curves.

When the user selects High, they get RSA 2043, and ECC nistp384.
When the user selects Medium, they get RSA 1024, and ECC nistp256.