ipa-getcert shows a misleading error message when a certificate is
requested with the -D option but without -K option.

{{{
# ipa-getcert request -d /etc/httpd/alias -n 'Server-Cert' -t 'NSS
Certificate DB' -T caIPAserviceCert -D fileserver.ipa.example -C
/usr/libexec/ipa/certmonger/restart_httpd
The IPA backend requires the use of the -K option (principal name) when
the -N option (subject name) is used.
}}}

A better error message would be:
{{{
The IPA backend requires the use of the -K option (principal name) when
the -N option (subject name) or -D option (DNS name) is used.
}}}