Hi,
start by checking the certificates stored in the LDAP database (replace $SUFFIX with your actual suffix):
# ldapsearch -D "cn=directory manager" -W -b cn=certificates,cn=ipa,cn=etc,$SUFFIX
You will get a list of entries, one for each CA cert, each entry may contain multiple values for the attribute "cACertificate;binary".
You need to make sure that the expected certs are present, and the conflicting one (the cross-signed) is absent (otherwise it will get re-added by ipa-certupdate on the other places).
Then look at the file /etc/ipa/ca.crt. You should make a backup copy of this file and then edit it in order to remove the wrong CA cert and add the right one. The file must contain the whole certificate chain.
The other places where the CA chain is needed are NSS databases, /etc/ipa/nssdb, /etc/httpd/alias, /etc/dirsrv/slapd-$DOMAIN but IIRC they can be updated later by re-running ipa-certupdate once the /etc/ipa/ca.crt file is fixed.
Let me know if it solves your issue.
flo