When renewing externally-signed CA or when switching from externally-signed to self-signed CA, the Issuer DN can change. Update the ipaCaIssuerDn field of the IPA CA entry upon renewal, to keep it in sync. Fixes: https://pagure.io/freeipa/issue/7316 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>