Issue

Calling ipa-pkinit-manage enable on a replica without a CA instance fails.

Reproduced with the test test_integration/test_pkinit_manage.py::TestPkinitManage::test_pkinit_on_replica, logs in https://$ARTIFACTS_SERVER/idm-ci/freeipa_upstream_nightly/Nightly-rawhide/master/2025-11-22_19-30/rawhide/test_pkinit_manage/2/report.html?sort=result

Steps to Reproduce

1. Enable the copr repo @freeipa/freeipa-master-nightly on master and replica: dnf copr enable -y @freeipa/freeipa-master-nightly, install freeipa-server-dns package
2. Install the master with pkinit disabled: ipa-server-install -n ipa.test -r IPA.TEST -p Secret123 -a Secret123 -U --setup-dns --forwarder 10.11.5.160 --no-pkinit then enable pkinit ipa-pkinit-manage enable
3. Install the replica without CA and without Pkinit: ipa-replica-install --admin-password Secret123 --password Secret123 -U --no-pkinit --realm IPA.TEST --domain ipa.test
4. call ipa-pkinit-manage enable on the replica

Actual behavior

ipa-pkinit-manage enable fails on the replica:

RUN ['ipa-pkinit-manage', 'enable']
Configuring Kerberos KDC (krb5kdc)
  [1/1]: installing X509 Certificate for PKINIT
  [error] ConnectionError: HTTPSConnectionPool(host='localhost', port=8443): Max retries exceeded with url: /pki/v2/info (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f7077383770>: Failed to establish a new connection: [Errno 111] Connection refused'))
HTTPSConnectionPool(host='localhost', port=8443): Max retries exceeded with url: /pki/v2/info (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f7077383770>: Failed to establish a new connection: [Errno 111] Connection refused'))
The ipa-pkinit-manage command failed.
Exit code: 1

Expected behavior

The command should succeeed.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
freeipa-server-4.13.0.dev202511211100+git0aced7392-0.fc43.x86_64
freeipa-client-4.13.0.dev202511211100+git0aced7392-0.fc43.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-3.1.3-10.fc43.x86_64
package pki-ca is not installed
krb5-server-1.21.3-7.fc43.x86_64

Additional info:

The error happens because the command tries to connect to the localhost for getting the PKINIT certificate but the CA instance is present on the master only, not on the replica.