Ticket #3074 introduced in FreeIPA 3.1 updated pki-ca IPA certificate profile to issue certificates with 2 URIs:
- one URI pointing at the issuer: https://server.example.com
- one URI pointing at general DNS name which would redirect the requesting party to any FreeIPA CA: https://ipa-ca.example.com

However, there are 2 issues with this approach:

1. Using HTTPS for OCSP and CRL distribution points is unnecessary, as it does not add any extra security, because both OSCP responses and CRLs are signed (see RFC 2560 and RFC 5280). It also makes things more complicated, because the certificate presented by those service must be checked for validity itself (see #3547).

2. Client certificate libraries may not handle multiple OCSP/CRL distribution points and use just one, thus for failing to validate FreeIPA certificate if the original issuer was decommissioned. This issue is likely to not improve in soon future (see discussion in NSS Bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=797815)

We decided to keep only one OCSP/CRL URI using HTTP protocol, pointing only at the general ipa-ca.$IPA_DOMAIN name.

Existing certificates with incorrect OCSP/CRL URIs will need to be reissued manually to use the correct URL.