manage role
From IPA mailing list :
All IPA servers are masters, and equals. Some are just more equal than others.
There are two things that are only done on one IPA master with a CA: generating the CRL and managing renewal of the CA subsystem certificates.
Two actions are required to change role from simple master to master with a CA :