It isn't stored anywhere.
I can't explain why cacert.p12 would be updated other than generating a
domain level 0 replica installation file which wouldn't make sense with
this version of IPA.
I'd see if you have any backups or other copies of these missing
certificates somewhere.
Actually, I've been rooting around and I found that there is also
/root/cacert.p12.bkp that dates from the original install. The two files
are identical and similarly cacert.p12.bkp produces the same error.
I did actually attempt to bring up a replica in May 2019 but it failed.
I still had it sitting around as a virtual machine so I spun it up and
it was very empty.
After looking at the instructions for changing the Directory Manager
password here:
https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password I
noticed /root/dm_password which *does* match my Directory Manager password.
There error message also says the file could be corrupt, but I'm
assuming if that was the case, I wouldn't get any output from pk12util
at all...
So the only other thing I can think of (and am about to explore) is that
like with pyasn1, it's updates are causing the problem... does that
bring up anything for you?
The only other thing that I noticed is that
/etc/pki/pki-tomcat/alias/pwdfile.txt (which does match /root/keydb_pin
like I think it's supposed to) is the only password/pin file I've seen
that has an EOL... It seems like a stretch that that could have somehow
impacted cacert.p12, but I still don't really understand how or when any
of these are being used.
Cheers,
Sean