Currently, the subject CN for the CA created by dogtag is hardcoded to Certificate Authority. Since only the CN shows up in the collapsed view of a certificate, the default display for most OSs and browsers is very generic. Also, if there are multiple FreeIPA domains a machine is used in there will be several CA certs with the same label.

At a minimum, the CN should be configurable at install time. Ideally, it could also be changed via ipa-cacert-manage renew arguments, or via override when signed by an external CA.