Just looking at this test, is there a case here for testing other FreeIPA types in the way we are doing above ^^? I mean ... did the user hit a problem with private keys, then fail - and is there any other gotchas we should be aware of later on with FreeIPA style private keys, certificates perhaps even the way they present a CA?

I guess if the user (or someone else with FreeIPA) has tested it with this patch that would confirm.