FreeIPA does not have a method to update hostnames. Hosts must be un-enrolled and re-enrolled. I ran into a Kerberos authentication error when re-enrolling due to an expired password. Resetting the password via the FreeIPA web UI forces it to expire immediately on the subsequent login–resulting in the same authentication error!