The ipa-cacert-manage --help differs from its man page.

The --help displays which options are available for which subcommand, the man page shows all options for both subcommands (although some of the options are not taken into account during renew action, neither are some during install).

Also, neither help nor man page expresses the need to add the certificate file as an argument to the script for the install subcommand.