I have an external CA that I need to renew due to the root CA expiring soon
and they grumbled at the CA subject last time and I suggested I would look
into changing it. I don't see any route via the ipa-cacert-manage renew to
change the subject but I'd be up for investigating if you have any general
guidance on what may be involved to get it to work. I don't know if there
are a lot of things tied to the CA subject in the inner workings of the
system that may result in unexpected results but I can work through that
also and provide feedback.