If you run ipa-client-install and it fails for some reason after creating
/etc/ipa/ca.crt , then it does not remove that file when it tries to clean up
after itself before quitting. This results in all subsequent runs failing to
auto-discover the server, with a rather cryptic error:

Error checking LDAP: Connect error: TLS error -8157:Certificate extension not
found.

it was just impossible to debug this without the very much appreciated help of
ab and mkosek in #freeipa. Suggestions: the 'clean up process' for failed
ipa-client-install runs should wipe that file, and perhaps (I don't know enough
to know if this makes sense) ipa-client-install should check if that file
exists if its auto-discovery process fails, and warn the user that its presence
might be the problem.