Scott Reed via FreeIPA-users wrote:
Found the answer to my own problem. Yay me!
Certmonger is not running by default on a FreeIPA installation.
Start it with the following command:
sudo systemctl enable --now certmonger
certmonger is enabled by default on IPA systems. I don't know how it
would become disabled.
rob