This bug is created as a clone of upstream ticket:
https://pagure.io/freeipa/issue/8397

### Request for enhancement
As admin , I want remove the first master server with KRA installed to complete the fail over the new master.

### Issue
Recently, Hard disk drive on the first master failed ( not recoverable), I was able to switch  CA renewal to a new replica master server. And while trying to remove the old master from replication topology i encounter the following error 

 root@tobor-new:280 # ipa-replica-manage del first-master.sample.com -v --force
ipa: WARNING: Lookup failed: Preferred host new-master.sample.com does not provide KRA.
ipa: INFO: Starting new HTTPS connection (1): first-master.sample.com
ipa: INFO: Starting new HTTPS connection (2): first-master.sample.com
('Connection aborted.', error(111, 'Connection refused'))

This error render me from removing first-master.sample.com  and also causing new replication to fail trying Search DNS from first-master.sample.com dns server . 

is anyone aware of this issue?  



#### Steps to Reproduce
1. Installed IPA server with KRA on first master
2. Create a replica of the First master instance
3. Poweroff first master. 
4. Promote replica master to CA renewal and cert generation. 
5. Try to remove first master 

#### Actual behavior
Error trying to remove first master. 
root@new-master:381 # ipa server-del first-master.sample.com --ignore-last-of-role --force
Removing first-master.sample.com from replication topology, please wait...
ipa: ERROR: an internal error has occurred

 root@first-master:280 # ipa-replica-manage del first-master.sample.com -v --force
ipa: WARNING: Lookup failed: Preferred host new-master.sample.com does not provide KRA.
ipa: INFO: Starting new HTTPS connection (1): first-master.sample.com
ipa: INFO: Starting new HTTPS connection (2): first-master.sample.com
('Connection aborted.', error(111, 'Connection refused'))

#### Expected behavior
(what do you expect to happen)

#### Version/Release/Distribution
   $ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

#### Additional info:
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.6.6-11.el7.centos.x86_64
ipa-client-4.6.6-11.el7.centos.x86_64
389-ds-base-1.3.10.1-5.el7.x86_64
pki-ca-10.5.17-6.el7.noarch
krb5-server-1.15.1-46.el7.x86_64

DOmain level 
-----------------------
Current domain level: 1
-----------------------



Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting