Description of problem:
ipa-healthcheck should report if the configured CA renewal master is reachable.
Version-Release number of selected component (if applicable):
# rpm -qa | grep ipa-server
ipa-server-common-4.8.0-11.module+el8.1.0+4247+9f3fd721.noarch
ipa-server-4.8.0-11.module+el8.1.0+4247+9f3fd721.x86_64
#
How reproducible:
Always.
Steps to Reproduce:
1. Change the RDN of the LDAP entry cn=<CA_RENEWAL_MASTER>,cn=masters,cn=ipa,cn=etc,dc=<DOMAIN> to a value that points to a non-existing server.
2. Run the command
# ipa-healthcheck  --source ipahealthcheck.ipa.roles --check IPARenewalMasterCheck
Actual results:
The command shows that the server is not a CA renewal master. 
# ipa-healthcheck  --source ipahealthcheck.ipa.roles --check IPARenewalMasterCheck
[
  {
    "source": "ipahealthcheck.ipa.roles",
    "check": "IPARenewalMasterCheck",
    "result": "SUCCESS",
    "uuid": "29ef3a25-81bb-4a9b-aa56-dd27743936b1",
    "when": "20191205175059Z",
    "duration": "0.156789",
    "kw": {
      "key": "renewal_master",
      "master": false
    }
  }
]
#  
Expected results:
It would be nice to also show if there is a reachable CA renewal master.
Eg:
# ipa-healthcheck  --source ipahealthcheck.ipa.roles --check IPARenewalMasterCheck
[
  {
    "source": "ipahealthcheck.ipa.roles",
    "check": "IPARenewalMasterCheck",
    "result": "SUCCESS",
    "uuid": "3431e60b-c98a-4633-a7f9-249747b1a1b8",
    "when": "20191205175326Z",
    "duration": "0.161224",
    "kw": {
      "key": "renewal_master",
      "master": false,
      "current_master": "unreachable_master.example.com",
      "current_master_reachable": false
    }
  }
]
Additional info:

Hi Rob,
This RFE is actually to request a couple of additional information that could be useful for customers and Support.
1 - The first one is to provide the  FQDN of the CA renewal master ( in case it is not the host on which the ipa-healthcheck command is run )
2 - The second one is to let the user know if the CA renewal master is reachable.
It may happen it is not reachable due to mistakes.
For instance:
    * wrong DNS configuration ( this might be checked in the DNS plugin [1] )
    * decommission of a VM that is hosting the renewal master
IMHO, it would be nice to get the FQDN of the CA renewal master ( it is already provided with "ipa config-show" ).
Knowing whether it is reachable is less important but might be useful for Support folks.
Regards,
Têko.
[1] https://www.freeipa.org/page/V4/Healthcheck#DNS

I can do the first request since it is stored in configuration.
But not the second. It is not an error to be not reachable and could lead to false positives.