Bryan Fang via FreeIPA-users wrote:
After adding certificates and chain of *.domain.com to /etc/ipa/ca.crt in master freeipa, then copy the ca.crt file to client machine, and rename it to ca.pem with mv ca.crt ca.pem this ca.pem includes all required certificates for both ipa server and https server, then run ipa-client-install command like below, it will work for new client machine
ipa-client-install --mkhomedir --domain=domain2.com --server=ipa.domain.com --realm=DOMAIN.COM --force-ntpd --hostname=ipa.domain2.com -d --ca-cert-file=/home/ec2-user/ca.pem
If you use ipa-cacert-manage to load the external CA certificates onto the IPA server then using a custom ca-cert-file shouldn't be necessary as the entire cert chain will be pulled down as part of the installation.
Note that when you add custom certificates you should run ipa-certupdate on all IPA hosts, clients and servers, to pull in the new chain.
rob