I just added a new replica in Centos 7.3. IPA should have been 4.4, but it upgraded itself to 4.5.

Install was done with

ipa-client-install
ipa-replica-install --dirsrv-cert-file combined --dirsrv-cert-file krb4_cs_rutgers_edu.key --http-cert-file combined --http-cert-file krb4_cs_rutgers_edu.key --no-pkinit

The existing servers were actually or faked to be CA-less.

There were two issues:

1) some of the data wasn't put on the old servers. I compared dumps of the LDAP data, and found I had to do the following:

dn: cn=krb4.cs.rutgers.edu,cn=masters,cn=ipa,cn=etc,dc=cs,dc=rutgers,dc=edu
changetype:modify
add:objectclass
objectClass: nsContainer
objectClass: ipaReplTopoManagedServer
objectClass: ipaConfigObject
objectClass: ipaSupportedDomainLevelConfig
-
add:ipaReplTopoManagedSuffix
ipaReplTopoManagedSuffix: dc=cs,dc=rutgers,dc=edu
-
add:ipaMinDomainLevel
ipaMinDomainLevel: 0
-
add:ipaMaxDomainLevel
ipaMaxDomainLevel: 1

dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=cs,dc=rutgers,dc=edu
changetype:modify
add:memberprincipal
memberPrincipal: HTTP/krb4.cs.rutgers.edu@CS.RUTGERS.EDU

dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=cs,dc=rutgers,dc=edu
changetype:modify
add:memberprincipal
memberPrincipal: ldap/krb4.cs.rutgers.edu@CS.RUTGERS.EDU

2) "ipa topologysegment-find domain" showed that the link to krb4 was one-way. I later realized that the replication agreement was actually there, so it was just the topology property that was wrong. I could have fixed it to changing the attribute from left-to-right to both, using ldapmodify. What I did was to delete the topology segment and put it back. But that ended up with two replication agreements from krb2 to krb4. So I deleted the topology segment, then manually deleted "cn=meTokrb4.cs.rutgers.edu,cn=replica,cn=dc\3Dcs\2Cdc\3Drutgers\2Cdc\3Dedu,cn=mapping tree,cn=config changetype:delete" and added back the topology segment. That resulted in a configuration that seems right.