RHEL-6 IPA-3 How to renew "auditSigningCert cert-pki-ca", "ocspSigningCert cert-pki-ca", "subsystemCert cert-pki-ca" certificates in replica?

Issue

• IPA: How to renew auditSigningCert cert-pki-ca, ocspSigningCert cert-pki-ca, subsystemCert cert-pki-ca certificates in replica?
• Certificate's auditSigningCert cert-pki-ca, ocspSigningCert cert-pki-ca, subsystemCert cert-pki-ca has expired.
• Certificate information is not present in IPA master and replica server in ldap under path cn=ipa,cn=etc,$SUFFIX

ldapsearch -h localhost -p 389 -D 'cn=Directory Manager' -W -b "cn=ipa,cn=etc,$SUFFIX"  -x -LLL