Thanks for filing the issue. In general we are not planning any extension of ipa-replica-install/ipa-server-install options as there are too many already and we want to reduce their count instead.

Could you please explain what do you mean by

You have to do a lot of certutil/getcert commands to change the certificate after the fact.

can you demonstrate that by providing the commands?

Our typical approach to service availability is to allow clients to switch over. I guess you are talking about those LDAP applications that do not support a fail-over and want to use a single LDAP host reference. Could you please confirm this is the case?

These are the commands I had to run on a test-instance to accomplish this on an ipa-server:

ipa dnsrecord-add domain.com ldap --a-ip-address=10.1.1.1 # Fake ip
ipa host-add ldap.domain.com
ipa service-add ldap/ldap.domain.com
cd /etc/dirsrv/slapd-DOMAIN-COM/
certutil -R -k Server-Cert 0 -d ./ -a -s "CN=ipa1.domain.com,O=DOMAIN.COM" -8 \
ipa1.domain.com,ldap.domain.com -f ./pwdfile.txt -z /dev/random -o /tmp/file

ipa cert-request /tmp/file --principal='ldap/ipa1.domain.com' --certificate-out=/tmp/file2
certutil -D -n Server-Cert -n Server-Cert -d ./ -f ./pwdfile.txt
certutil -A -i /tmp/file2 -n Server-Cert -d ./ -f ./pwdfile.txt -t ",,"
systemctl stop certmonger
systemctl start certmonger
ipa dnsrecord-add domain.com ldap --a-ip-address=10.2.2.2 # Real ip
ipa dnsrecord-del domain.com ldap --a-rec='10.1.1.1' # Delete Fake
ipactl restart

Yes, I am confirming that when using something such as openvpn, or mediawiki, or dokuwiki, pfsense or something similar, they often do not support a failover. it would be nice to have an ldap record, kind of like there is ipa-ca.domain.com record for pointing certificate revocation at. http is less of an issue because you can easily use a proxy. in an ideal world, all applications that use ldap could figure out what to connect to using srv records.

At the very least it would be nice if this were documented somewhere possible to find.

OCSP and CRL do not need TLS so the name of the responding server doesn't matter. The contents are signed so the traffic does not need to be encrypted.

Whereas for TLS the name is everything.

This will remove all the certutil steps.

Make sure there is a host and it has a service entry and that the host you are requesting the cert on has write access to it:

ipa host-add ldap.domain.com
ipa service-add ldap/ldap.domain.com
ipa service-add-host --hosts ipa1.domain.com ldap/ldap.domain.com

Get a new cert with new DNS subject-alt names

ipa-getcert resubmit -d /etc/dirsrv/slapd-DOMAIN-COM -n Server-Cert -D ldap.domain.com -D ipa1.domain.com

No need to restart certmonger or IPA.

Oh, that's not bad at all then. Is there a good way to get this into documentation? I guess if this issue stays around forever and google finds it that could be good enough.

Be sure to have a very short DNS TTL on that generic ldap entry.

I'm going to go ahead and mark this as closed.