As requested by dkupka - https://www.redhat.com/archives/freeipa-users/2015-September/msg00302.html

We frequently create and destroy IPA managed environments. Currently we use self-signed standalone IPA CAs.

We would like to switch to internally-signed IPA CA certs - which IPA does support. However, the install process is two step, which isn't great for automated use.

Since certmonger is being used for the CSR generation process, it should be possible to use it to submit the CSR to a remote server (Dogtag in my case), and have it handle the certificate request process automatically - no 2 step necessary.