Description of problem:
If externally signed CA cert is expired, the ipa-cert-fix will proceed with issuing new service and shared certificates using it, that produces certificates with very short validity periods. If that's the case, the situation gets worse than before ipa-cert-fix - we can't return in time to operate normally in this case.

Version-Release number of selected component (if applicable):
ipa-server-4.9.11-5

How reproducible:
always, if you have expired externally signed CA

Steps to Reproduce:
1. expire your externally-signed CA cert
2. run ipa-cert-fix

Actual results:
system is broken and requires manual search for previous certs in LDAP repository in order to get operational again

Expected results:
check is run if CA is externally signed and if it is expired, and if that's the case - ipa-cert-fix doesn't perform any action (renewal not possible until new CA cert is signed)

Additional info: