On Thu, 2 Jan 2020, Rob Foehl via FreeIPA-users wrote:
The question remains: how do I get rid of the self-signed CA
entirely?
Best hint toward this I've managed to find thus far is in the comments on
https://pagure.io/freeipa/issue/7283 , with got me as far as the
cACertificate and ipaCertIssuerSerial entries corresponding to the
extraneous self-signed cert... If I remove those and the cert from the
NSSDBs, then what? Reissue all dependent certs in the IPA CA chain?
What do I do about the rest of the mess it's created, and/or preventing
future problems? Bug ticket for the erroneous self-signed renewal?
-Rob