# ipa-server-install -a Secret123 -p Secret123 -r EXAMPLE.TEST -U
# echo Secret123 | kinit admin
# ipa host-add host.example.test --ip-address <IP>
# ipa host-add-managedby host.example.test --host $( hostname -f )
# ipa-getcert request -k /etc/ssl/certs/host.example.test.key -f /etc/ssl/certs/host.example.test.cert -N host.example.test -K host/host.example.test
# kinit -kt /etc/krb5.keytab
# ipa host-show host.example.test
  ...
  Serial Number: 12
  ...
# ipa cert-revoke 12

ipa: ERROR: Insufficient access: not allowed to perform operation: retrieve certificate

  Revoked: True

...
611         try:
612             self.check_access()
613         except errors.ACIError as acierr:
614             self.debug("Not granted by ACI to retrieve certificate, looking at principal")
615             bind_principal = getattr(context, 'principal')
616             if not bind_principal.startswith('host/'):
617                 raise acierr
618             hostname = get_host_from_principal(bind_principal)
...
628         if hostname:
629             # If we have a hostname we want to verify that the subject                                            
630             # of the certificate matches it, otherwise raise an error                                             
631             if hostname != cert.subject.common_name:    #pylint: disable=E1101                                    
632                 raise acierr
...