If you run ipa-client-install and it fails for some reason after creating /etc/ipa/ca.crt , then it does not remove that file when it tries to clean up after itself before quitting. This results in all subsequent runs failing to auto-discover the server, with a rather cryptic error: Error checking LDAP: Connect error: TLS error -8157:Certificate extension not found. it was just impossible to debug this without the very much appreciated help of ab and mkosek in #freeipa. Suggestions: the 'clean up process' for failed ipa-client-install runs should wipe that file, and perhaps (I don't know enough to know if this makes sense) ipa-client-install should check if that file exists if its auto-discovery process fails, and warn the user that its presence might be the problem.
Upstream ticket: https://fedorahosted.org/freeipa/ticket/3944
Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/c49cf9572addb2e773108e4530e023385f8c2180
Fixed upstream: ipa-3-3: https://fedorahosted.org/freeipa/changeset/00a4ad2c34c6203ee058b71a4c25d22d2f333b09
freeipa-3.3.4-1.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/freeipa-3.3.4-1.fc19
Package freeipa-3.3.4-2.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing freeipa-3.3.4-2.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-1696/freeipa-3.3.4-2.fc19 then log in and leave karma (feedback).
Package freeipa-3.3.4-3.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing freeipa-3.3.4-3.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-1696/freeipa-3.3.4-3.fc19 then log in and leave karma (feedback).
freeipa-3.3.4-3.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.