We had multiple cases in which either the Dogtag NSS DB on the master or replica had incorrect certs, private key assignment, or trust flags. In order to detect such issues early, FreeIPA should validate the NSS DB:

• create master with KRA
• create replica with CA and KRA
• verify presence of system certs on both machines (same hash)
• verify presence of private keys on both machines (correctly assigned to certs)
• verify trust flags
• create a sub CA on each master and replica
• verify that sub CA certs and keys have been replicated and trust flags are correct

See https://pagure.io/freeipa/issue/7590 and https://pagure.io/freeipa/issue/7589

PR https://github.com/freeipa/freeipa/pull/2050 is a start. PR depends on new build of JSS (4.4.5?).