When RSN is missing, then this behaviour can be observed:

[root@master ~]# rpm -qa ipa-server ;ipa ca-show ipa --all | grep RSN
ipa-server-4.12.2-22.el9_7.4.x86_64
  RSN Version: 0
[root@master ~]#
Older Version
[root@master ~]# rpm -qa ipa-server ;ipa ca-show ipa --all | grep RSN
ipa-server-4.13.1-3.el9.x86_64
[root@master ~]# echo $?
1

The entry cn=ipa,cn=cas,cn=ca,$BASE_DN stores the data for the ipa CA. It looks like the following:

dn: cn=ipa,cn=cas,cn=ca,dc=testrelm,dc=test
objectClass: top
objectClass: ipaca
cn: ipa
description: IPA CA
ipaCaId: 9267e7d8-0d13-4eb3-b4a5-29128ba0940b
ipaCaIssuerDN: CN=Certificate Authority,O=TESTRELM.TEST
ipaCaSubjectDN: CN=Certificate Authority,O=TESTRELM.TEST

With IPA 4.13, random serial numbers are enabled by default when the backend is LDB (i.e. in RHEL 10.2) and enabled only if ipa-server-install is called with --random-serial-numbers when the backend is BDB (i.e. RHEL 9.8).

Here the backend is BDB and the installation is a default installation, meaning it uses sequential numbers.

The code switching to RSN by default with LDB was added with a commit that has a flaw: when the server is installed, it should store the value ipaCaRandomSerialNumberVersion = 0 (no RSN) or ipaCaRandomSerialNumberVersion = 3 (RSN enabled) by calling the method __store_random_serial_number_state, but the code fails to append the attribute

def __store_random_serial_number_state(self):
    """
    Save the Random Serial Number (RSN) version.
    This is intended to add flexibility in case RSN bumps
    another version in dogtag. For now we only support v3
    or no randomization (0).
    """
    if self.random_serial_numbers:
        value = 3
    else:
        value = 0
    dn = DN(('cn', ipalib.constants.IPA_CA_CN), api.env.container_ca,
            api.env.basedn)
    entry_attrs = api.Backend.ldap2.get_entry(dn)
    version = entry_attrs.single_value.get(
        "ipaCaRandomSerialNumberVersion", "0"
    )
    if str(version) == str(value):
        return
    entry_attrs['ipaCaRandomSerialNumberVersion'] = value
    api.Backend.ldap2.update_entry(entry_attrs)

When RSN is not enabled, entry_attrs.single_value.get("ipaCaRandomSerialNumberVersion", "0") returns 0 even if the attribute is not present and the entry is not updated because the method returns immediately after the check if str(version) == str(value).

A simple fix would be to replace entry_attrs.single_value.get("ipaCaRandomSerialNumberVersion", "0") with entry_attrs.single_value.get("ipaCaRandomSerialNumberVersion", "-") to make sure the value is always written.