Hm, it looks like on one of the IPA servers I have a copy of /etc/pki/pki-tomcat/alias
from 2019. I'm not sure if I can use this somehow to get back to normal by restoring
then setting the time back and trying to renew the certs.
I guess I don't know for sure if this has the correctly named certificates in them, so
if there is a way to determine that.