The CLI options for ipa-server-certinstall are not ideal. We should:

• Add a --pin option that replaces --dirsrv_pin (used with -d) and --http_pin (used with -w; -d and -w are mutually exclusive). The old options will remain as deprecated aliases.

• Add a -p, --dirman-password option to specify the directory manager password (necessary for replacing the DS cert).

• Mention in the usage string that

  • a PKCS#``12 cert argument is required
  • either -d or -w is required

ipa-server-certinstall is now being rewritten for #3641, the change can be included in that devel effort.