`ipa config-mod` gained '--ca-renewal-master' options which can be used to set CA renewal master to a different server. Obviously, this server has to have CA role enabled. https://fedorahosted.org/freeipa/ticket/5689 http://www.freeipa.org/page/V4/Server_Roles Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>