Why doesn’t terminating SSL on the proxy work with LDAPS? Because it should, and says so
too here:
https://www.mail-archive.com/haproxy@formilux.org/msg21657.html
Though, I’m looking into the same thing to add SAN to the server certificate and wondering
about similar questions. When you look at “ipa-getcert list” you should see the current
certificates already, including their settings, so I was thinking to just stop tracking
those old ones and create new ones like you did, except with the exact same options as the
old ones (+ SAN). But yeah, I’m not sure if there is anything else involved, or if there
is a better way. I only started using freeipa recently.