[description of the issue]
kra install fails after ipa cert renewed

Steps to Reproduce

1. Install ipa master
2. get expiration date from /root/ca-agent.p12
3. openssl pkcs12 -in ca-agent.p12 -out ca-agent.pem -nodes

4. cat ca-agent.pem | openssl x509 -noout -enddate

5. move date forward to 20 days before ca-agent.p12 expires

6. wait for certs to be renewed (watch with getcert list)

7. move date to 3 days after ca-agent.p12 expired (i.e 3 days after date from step2).

8. ipa-kra-install

Actual behavior

(what happens)

500 Server Error: for url: https://master.testrelm.test:8443/ca/rest/securityDomain/domainInfo
The ipa-kra-install command failed. See /var/log/ipaserver-kra-install.log for more information

Expected behavior

(what do you expect to happen)
kra install success

Version/Release/Distribution

freeipa-server-4.7.90.dev201810161235+git5466eca04-0.fc28.x86_64
freeipa-client-4.7.90.dev201810161235+git5466eca04-0.fc28.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-1.4.0.16-1.fc28.x86_64
pki-ca-10.6.6-1.fc28.noarch
krb5-server-1.16.1-21.fc28.x86_64

Additional info:
$ cat /var/log/ipaserver-kra-install.log

2020-10-08T18:15:25Z DEBUG Logging to /var/log/ipaserver-kra-install.log
2020-10-08T18:15:25Z DEBUG ipa-kra-install was invoked with arguments [] and options: {'verbose': False, 'quiet': False, 'log_file': None, 'no_host_dns': False, 'unattended': True, 'uninstall': False}
2020-10-08T18:15:25Z DEBUG IPA version 4.7.90.dev201810161235+git5466eca04-0.fc28
2020-10-08T18:15:25Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2020-10-08T18:15:25Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
2020-10-08T18:15:25Z DEBUG Starting new HTTPS connection (1): master.testrelm.test
2020-10-08T18:15:26Z DEBUG https://master.testrelm.test:8443 "GET /ca/rest/securityDomain/domainInfo HTTP/1.1" 500 7385
2020-10-08T18:15:26Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 179, in execute
return_value = self.run()
File "/usr/lib/python3.6/site-packages/ipaserver/install/ipa_kra_install.py", line 155, in run
self.installing_replica = dogtaginstance.is_installing_replica("KRA")
File "/usr/lib/python3.6/site-packages/ipaserver/install/dogtaginstance.py", line 74, in is_installing_replica
info = get_security_domain()
File "/usr/lib/python3.6/site-packages/ipaserver/install/dogtaginstance.py", line 63, in get_security_domain
info = domain_client.get_security_domain_info()
File "/usr/lib/python3.6/site-packages/pki/system.py", line 188, in get_security_domain_info
response = self.connection.get('/rest/securityDomain/domainInfo')
File "/usr/lib/python3.6/site-packages/pki/client.py", line 46, in wrapper
return func(self, args, *kwargs)
File "/usr/lib/python3.6/site-packages/pki/client.py", line 162, in get
r.raise_for_status()
File "/usr/lib/python3.6/site-packages/requests/models.py", line 935, in raise_for_status
raise HTTPError(http_error_msg, response=self)

2020-10-08T18:15:26Z DEBUG The ipa-kra-install command failed, exception: HTTPError: 500 Server Error: for url: https://master.testrelm.test:8443/ca/rest/securityDomain/domainInfo
2020-10-08T18:15:26Z ERROR 500 Server Error: for url: https://master.testrelm.test:8443/ca/rest/securityDomain/domainInfo
2020-10-08T18:15:26Z ERROR The ipa-kra-install command failed. See /var/log/ipaserver-kra-install.log for more information