Why do people want to change the CA Subject DN?  Every explanation I
have heard amounts to *"we don't like the one we have"*, or
occasionally *"it doesn't meet out organisation's guidelines"*.  For 
FreeIPA this usually means that the default CA Subject DN was used
during installation, and now they wish for something different.
To be fair, the FreeIPA installer does not prompt for a CA Subject
DN but rather uses the default form unless explicitly told otherwise
via options.  Furthermore, prior to FreeIPA version 4.5, the CA
Subject DN was only partially customisable (specifically, the DN
always started with ``CN=Certificate Authority``).  So in most cases
where an administrator wants to change the CA Subject DN, it is not 
because they chose the wrong one, but rather they were *not given
the opportunity to choose the right one*.