Bug 2211380

Description of problem:
On latest d/s compose (RHOS-17.1-RHEL-9-20230525.n.1) the certification request for etcd service in TLS-E deployment of RHOS fails. The etcd is used for Cinder A/A management on a site of Multisite DCN topology. I've been getting CA_REJECTED with error msg: ca-error: Server at https://site-freeipa-0.redhat.local/ipa/json denied our request, giving up: 3009 (invalid 'csr': PTR record for SAN IP (172.25.2.250) does not match A/AAAA records).
The getcert commandline is:
/bin/getcert request -N CN=dcn1-computehci-0.internalapi.redhat.local -c IPA -w -k /etc/pki/tls/private/etcd.key -f /etc/pki/tls/certs/etcd.crt -D dcn1-computehci-0.internalapi.redhat.local -D overcloud.internalapi.redhat.local -D '' -A 172.25.2.250 -A '' -E '' -r -g 2048 -K etcd/dcn1-computehci-0.internalapi.redhat.local -K '' -u keyEncipherment -u digitalSignature -U 1.3.6.1.5.5.7.3.1 -U 1.3.6.1.5.5.7.3.2 -U '' -B '' -C /etc/certmonger/post-scripts/etcd-1185323.sh (The cert requires SAN IP because afaik etcd uses directly the IP for establishing connections)

The PTR record for 172.25.2.250 looks like:
# ipa dnsrecord-show
Record name: 250
Zone name: 2.25.172.in-addr.arpa.
  Record name: 250
  PTR record: dcn1-computehci-0.redhat.local, dcn1-computehci-0.internalapi.redhat.local

If I changed it to:
  Record name: 250
  PTR record: dcn1-computehci-0.internalapi.redhat.local
Then the cert request is successful.

The recent changes/refactor from https://review.opendev.org/c/x/tripleo-ipa/+/880721 might changed the behavior. It may make no sense to have multiple PTR records for a single IP

Version-Release number of selected component (if applicable):
ansible-tripleo-ipsec-11.0.1-1.20220727105329.b5559c8.el9ost.noarch
ansible-tripleo-ipa-0.3.1-1.20230519140956.d172570.el9ost.noarch
ansible-role-tripleo-modify-image-1.5.1-1.20230211112201.b6eedb6.el9ost.noarch
puppet-tripleo-14.2.3-1.20230517011016.20a162c.el9ost.noarch
python3-tripleo-common-15.4.1-1.20230518211050.cbb03c0.el9ost.noarch
tripleo-ansible-3.3.1-1.20230518201531.358f3c3.el9ost.noarch
openstack-tripleo-validations-14.3.2-1.20230421031001.c768acb.el9ost.noarch
openstack-tripleo-common-containers-15.4.1-1.20230518211050.cbb03c0.el9ost.noarch
openstack-tripleo-common-15.4.1-1.20230518211050.cbb03c0.el9ost.noarch
openstack-tripleo-heat-templates-14.3.1-1.20230519151004.f602c2b.el9ost.noarch
python3-tripleoclient-16.5.1-1.20230505010953.534fe49.el9ost.noarch

How reproducible:
Always

Steps to Reproduce:
1. The setup requires Cinder A/A which is used in DCN topology for deploying Cinder on a DCN site which is managed by etcd.

Actual results:
status: CA_REJECTED
	ca-error: Server at https://site-freeipa-0.redhat.local/ipa/json denied our request, giving up: 3009 (invalid 'csr': PTR record for SAN IP (172.25.2.250) does not match A/AAAA records).

Expected results:
Successful cert creation and DCN site deployment with Cinder A/A managed by etcd

Additional info: