Issue

After installing IPA with KRA the /root/.dogtag/pki-tomcat/ca_admin.cert contains a Base64 cert instead of PEM or DER cert so it cannot be parsed by OpenSSL.

Steps to Reproduce

1. Install IPA server with CA
2. Check /root/.dogtag/pki-tomcat/ca_admin.cert
3. Install KRA
4. Check /root/.dogtag/pki-tomcat/ca_admin.cert again

Actual behavior

In step 2 the ca_admin.cert contains a valid PEM cert:
https://github.com/edewata/pki/actions/runs/12957621930/job/36146535330#step:7:24

In step 4 the file now contains Base64 cert:
https://github.com/edewata/pki/actions/runs/12957621930/job/36146535330#step:11:15

Expected behavior

In step 4 the file should contain a valid PEM or DER cert.

Version/Release/Distribution

freeipa-server-4.13.0.dev202501211625+git-0.fc41

Additional info:

The Base64 cert is apparently created by this code:
https://github.com/freeipa/freeipa/blob/master/ipaserver/install/krainstance.py#L235

It's possible that when the code was written 8 years ago PKI was also using Base64 format:
https://github.com/freeipa/freeipa/commit/5a44ca638310913ab6b0c239374f4b0ddeeedeb3

However, this file resides in PKI-owned folder and PKI is now creating the file with PEM format and PKI code might assume/enforce that the file (if exists) will have a valid cert format, so if IPA is creating this file it should be using a valid cert format as well.

Alternatively, IPA probably could reuse the original ca_admin.cert created when installing IPA with CA instead of creating a new one.