Request for enhancement

As an admin , I want to specify server I am updating certificates from, so that in case of disaster recovery (full CA expiry, etc.) or replication issues I will be sure the server/client would get correct set of certificates.

Issue

If the certificates are expired on the whole topology, we usually need to fix renewal master first, then get renewed certificates, starting with CA ones, to the replicas, then to the clients.

For the replicas, I need to have a out-of-the-box option to specify a server that has correct data to fetch from. We can do it via editing /etc/ipa/default.conf, but this is error-prone, we don't need this config to have errors or leftovers from a manual intervention.

For the replicas, the process will be:
- fix the renewal master, e.g. with ipa-cert-fix;
- scp /etc/ipa/ca.crt to all the replicas;
- distribute new CA certificates to the replicas with

# ipa-certupdate --force-server=renewal.master.fqdn

• proceed to fixing the replicas, now that CA certificates are updated.