When I create a custom certificate and then use it at replica preparation, or new server install with the incorrect password, the operation fails with the error message "Failed to load ". It should be something more meaningful, like "incorrect password for pkcs!#12 file ".[[BR]]
How to reproduce:
1. Install master
2. Generate a certificate

# echo p@s$w0rd > passfile
# noise="$(mktemp)"
# head -c 20 /dev/urandom >"$noise"
# certutil -N -d nssdb -f passfile
# csr="$(mktemp)"
# crt="$(mktemp)"
# options="-t CT,C,C -v 120 -x -m 1"
# request_options="-1 -2 -4"
# request_input="\$'0\n1\n5\n6\n9\ny\ny\n\ny\n1\n7\nfile://'\$(readlink -f \$dbdir)/\$ca.crl\$'\n-1\n-1\n-1\nn\nn\n'"
# subject="CN=server.pesen.net,O=Self-signed"
# certutil -R -d nssdb -s "$subject" -f passfile -z "$noise" -o "$csr" "${request_options}" >/dev/null <<<"$request_input"
# certutil -C -d nssdb -f passfile -m 1 -i "$csr" -o "$crt" "${options[@]}" "$@"
# certutil -A -d nssdb -n "$nick" -f passfile -i "$crt" "${options[@]}"

1. Export a certificate:

   pk12util -o replica.p12 -n ca1 -d nssdb -K 'p@s$w0rd' -W 'p@s$w0rd'

2. Use the exported key during replica preparation with incorrect key password:

   ipa-replica-prepare --ip-address 192.168.122.171 -p '' --http-cert-file replica.p12 --dirsrv-cert-file replica.p12 --http-pin 'badpass' --dirsrv-pin 'p@s$w0rd' f22replica1.pesen.net

Use the same approach at new server installation.