ipa-server-certinstall goes through a slightly different code path if the replacement certificate is issued by IPA. This was setting the subject using cert.subject which is a Name object and not the string representation of that object. This was failing in the dbus call to certmonger. https://pagure.io/freeipa/issue/8204 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>