Hello!
We have FreeIPA cluster with 3 replicas:
1) ipa.example.com (just reinstall to Oracle Linux Server, IPA VERSION: 4.9.11, API_VERSION: 2.251)
2) iparep.example.com (just reinstall to Oracle Linux Server, IPA VERSION: 4.9.11, API_VERSION: 2.251)
3) ipa-rep-ret.example.com (CentOS Linux 7, IPA VERSION: 4.6.4, API_VERSION: 2.230)

All servers: master, ca, dns.

I need to upgrade third server to same version as 1 and 2.
For this I installed iparep3.example.com server and tried to connect it to cluster.
ipa-replica-install --principal admin --admin-password 'pass' command was succesfull and iparep3.example.com join to cluster.

After that I ran ipa-ca-install command and it failed on step 5:

[root@iparep3 ~]# ipa-ca-install
Directory Manager (existing master) password:

Run connection check to master
Connection check OK
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
[1/28]: creating certificate server db
[2/28]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 11 seconds elapsed
Update succeeded

[3/28]: creating ACIs for admin
[4/28]: creating installation admin user
[5/28]: configuring certificate server instance
ipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance
ipaserver.install.dogtaginstance: CRITICAL See the installation logs and the following files/directories for more information:
ipaserver.install.dogtaginstance: CRITICAL /var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.

Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

CA configuration failed.

At ipareplica-ca-install.log I saw message:

INFO: Searching for iparep.example.com:443
INFO: - ipa-rep-rt.example.com:443
INFO: - ipa.example.com:443
Exception: Unable to find security domain host: iparep.example.com:443
File "/usr/lib/python3.6/site-packages/pki/server/pkispawn.py", line 575, in main
scriptlet.spawn(deployer)
File "/usr/lib/python3.6/site-packages/pki/server/deployment/scriptlets/configuration.py", line 475, in spawn
deployer.join_security_domain()
File "/usr/lib/python3.6/site-packages/pki/server/deployment/init.py", line 680, in join_security_domain
self.sd_host = sd_subsystem.get_host(sd_hostname, sd_port)
File "/usr/lib/python3.6/site-packages/pki/system.py", line 117, in get_host
(hostname, secure_port))

But! If ca-installation choose for master ipa-rep-rt.example.com on old Centos 7 CA installs good with no problem.

Also I see difference between CS.cfg at old replica (ipa-rep-rt.example.com):

securitydomain.checkIP=false
securitydomain.checkinterval=300000
securitydomain.flushinterval=86400000
securitydomain.host=ipa-rep-rt.example.com
securitydomain.httpport=80
securitydomain.httpsadminport=443
securitydomain.httpsagentport=443
securitydomain.httpseeport=443
securitydomain.name=IPA
securitydomain.select=new
securitydomain.source=ldap
securitydomain.store=ldap

And new replica (iparep.example.com):

securitydomain.checkIP=false
securitydomain.checkinterval=300000
securitydomain.flushinterval=86400000
securitydomain.host=iparep.example.com
securitydomain.httpport=8080
securitydomain.httpsadminport=8443
securitydomain.httpsagentport=8443
securitydomain.httpseeport=8443
securitydomain.name=IPA
securitydomain.select=new
securitydomain.source=ldap

What's wrong with my installation? And how I can install ca with --master 'iparep.example.com' ?
8443 port is accesible.
I can attach CS.cfg and logs if necessary. Thanks!