Now GC branch is adding option for ipa-adtrust-install to specify certificate to be used in CA-less mode: --gc-cert-file and--gc-pin. As discussed with Alexander GC instance could reuse certificate provided during IPA server installation using options --dirsrv-cert-file and --dirsrv-pin
ipa-adtrust-install
--gc-cert-file
--gc-pin
--dirsrv-cert-file
--dirsrv-pin