Hi,
I did not have time to report here that I was already able to update the certificates.
You are right, the certificate in LDAP must match the certificate from
/var/lib/ipa/ra-agent.pem.
I replaced the agent certificate in LDAP as described in this article:
https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom...
I am very thankful for your help.
Have a great day.