Description of problem:

healthcheck for KRA sslserver/subsystem certs failing.

[root@master ~]# ipa-healthcheck --output-type json --failures-only
[
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "KRADogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "b7fdb770-6c7d-4275-ab9a-6a928ce5966a",
    "when": "20200821131201Z",
    "duration": "0.053942",
    "kw": {
      "key": "kra_sslserver",
      "nickname": "Server-Cert cert-pki-ca",
      "directive": "kra.sslserver.cert",
      "configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg",
      "msg": "Certificate 'Server-Cert cert-pki-ca' does not match the value of kra.sslserver.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "KRADogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "c5c9a5c0-9972-4dd6-a879-1ecd22284398",
    "when": "20200821131201Z",
    "duration": "0.099739",
    "kw": {
      "key": "kra_subsystem",
      "nickname": "subsystemCert cert-pki-ca",
      "directive": "kra.subsystem.cert",
      "configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg",
      "msg": "Certificate 'subsystemCert cert-pki-ca' does not match the value of kra.subsystem.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg"
    }
  }
]
[root@master ~]# 

Version-Release number of selected component (if applicable):
[root@master ~]# rpm -q ipa-server ipa-healthcheck
ipa-server-4.8.7-9.module+el8.3.0+7664+fa35cfe6.x86_64
ipa-healthcheck-0.4-4.module+el8.2.0+5489+95477d9f.noarch
[root@master ~]#

How reproducible:
Always

Steps to Reproduce:
1. Install KAR on IPA Server.
2. Run ipa-healthcheck 
3.

Actual results:
Checks for KRA certs failed

Expected results:
Checks for KRA certs should not fail

Additional info: