Works for me. Steps I used :

1. [master] # dnf install freeipa-{server,client,admintools,python} (built from master branch)
2. [master] # ipa-server-install -a Secret123 -p Secret123 -r EXAMPLE.TEST --external-ca -U
3. [master] sign /root/ipa.csr with CA of your choice.
4. [master] # ipa-server-install -p Secret123 --external-cert-file --external-cert-file
5. [replica] # dnf install freeipa-{server,client,admintools,python} (built from master branch)
6. [replica] # ipa-client-install -p admin -w Secret123 --domain --server -U
7. [replica] # ipa-replica-install -p Secret123 -w Secret123 --setup-ca -U

Thanks David.

Replica creation with master with externally signed CA cert is a use case which is often neglected in manual testing, therefore it needs a test - moving to test component.

Not a blocker for 4.3 release.