389: denial of service when using certificate groups

see https://bugzilla.redhat.com/showbug.cgi?id=781519...