I have an external CA that I need to renew due to the root CA expiring soon and they grumbled at the CA subject last time and I suggested I would look into changing it. I don't see any route via the ipa-cacert-manage renew to change the subject but I'd be up for investigating if you have any general guidance on what may be involved to get it to work. I don't know if there are a lot of things tied to the CA subject in the inner workings of the system that may result in unexpected results but I can work through that also and provide feedback.