Comment 7 for bug 1428796

So it's freeipa-server apache config that causes it, not mod_nss. Turns out it's mod_wsgi, this is enough to reproduce the failure:

WSGISocketPrefix /run/apache2/wsgi
WSGIDaemonProcess ipa processes=6 threads=1 maximum-requests=500
WSGIProcessGroup ipa
WSGIApplicationGroup ipa
WSGIImportScript /usr/share/ipa/ process-group=ipa application-group=ipa

put it in conf-enabled/mock-ipa.conf and grab from freeipa-server. Processes is normally =2, and that's enough to reproduce the bug when the full ipa server is installed, but for demonstration purposed this config will do (plus a2enmod wsgi of course).