Yesterday I did end up just manually editing the /etc/ipa/ca.crt and the /etc/letsencrypt/archive full chain files- removing the DST chunk from both. I was able to get things working after that but it's hacky and I'm not sure it will persist. I intend to do more testing today. And that probably means removing it from the source, as you mention.
2 Likes