subprocess still work in subinterpreters in Python 3.8 if posix_spawn() can be used, but posix_spawn() is only used under some conditions:
https://docs.python.org/dev/whatsnew/3.8.html#optimizations

"The subprocess module can now use the os.posix_spawn() function in some cases for better performance. Currently, it is only used on macOS and Linux (using glibc 2.24 or newer) if all these conditions are met:

* close_fds is false;
* preexec_fn, pass_fds, cwd and start_new_session parameters are not set;
* the executable path contains a directory."

--

It seems like FreeIPA uses ctypes and ctypes calls subprocess.Popen(['/sbin/ldconfig', '-p'], ...) to locale libcrypto.

I see different options:

* modify FreeIPA / ctypes to ensure that posix_spawn() can be used
* avoid subinterpreters to deploy FreeIPA
* revert the change to allow again fork in subprocesses: see bpo-34651 for the rationale why it was denied

I understand that FreeIPA is run as WSGI using mod_wsgi in Apache.