diff --git a/.freeipa-pr-ci.yaml b/.freeipa-pr-ci.yaml
index 5b0254174..21f1c004d 100644
--- a/.freeipa-pr-ci.yaml
+++ b/.freeipa-pr-ci.yaml
@@ -61,7 +61,7 @@ jobs:
         test_suite: test_integration/test_external_ca.py::TestExternalCA test_integration/test_external_ca.py::TestSelfExternalSelf test_integration/test_external_ca.py::TestExternalCAInstall
         template: *ci-master-f28
         timeout: 3600
-        topology: *master_1repl
+        topology: *master_1repl_1client
 
   fedora-28/test_topologies:
     requires: [fedora-28/build]
diff --git a/ipatests/test_integration/test_external_ca.py b/ipatests/test_integration/test_external_ca.py
index cc7e7d60e..2030ae706 100644
--- a/ipatests/test_integration/test_external_ca.py
+++ b/ipatests/test_integration/test_external_ca.py
@@ -109,11 +109,11 @@ def service_control_dirsrv(host, function):
 
 class TestExternalCA(IntegrationTest):
     """
-    Test of FreeIPA server installation with exernal CA
+    Test of FreeIPA server installation with external CA
     """
     num_replicas = 1
+    num_clients = 1
 
-    @tasks.collect_logs
     def test_external_ca(self):
         # Step 1 of ipa-server-install.
         result = install_server_external_ca_step1(self.master)
@@ -136,6 +136,30 @@ class TestExternalCA(IntegrationTest):
         # check that we can also install replica
         tasks.install_replica(self.master, self.replicas[0])
 
+    def test_client_installation_with_otp(self):
+        # Test for issue 7526: client installation fails with one-time
+        # password when the master is installed with an externally signed
+        # CA because the whole cert chain is not published in
+        # /usr/share/ipa/html/ca.crt
+
+        # Create a random password for the client
+        client = self.clients[0]
+        client_pwd = 'Secret123'
+        args = ['ipa',
+                'host-add', client.hostname,
+                '--ip-address', client.ip,
+                '--no-reverse',
+                '--password', client_pwd]
+        self.master.run_command(args)
+
+        # Enroll the client with the client_pwd
+        client.run_command(
+            ['ipa-client-install',
+             '--domain', self.master.domain.name,
+             '--server', self.master.hostname,
+             '-w', client_pwd,
+             '-U'])
+
 
 class TestSelfExternalSelf(IntegrationTest):
     """