We have been working to solve an expired certificate issue in IPA.  There is an open ticket in Red Hat support CASE 02438518.  We have tried many things but so far have had no luck getting the certs to update.  Currently the system is running RHEL 8.0 and IPA 4.7.1.   

pki-server cert-fix -n 'subsystemCert cert-pki-ca' -d /var/lib/pki/pki-tomcat/alias/ -C /root/passwd -vvv
INFO: Loading instance: pki-tomcat
INFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat
INFO: Loading password config: /etc/pki/pki-tomcat/password.conf
INFO: Loading subsystem: ca
INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg
INFO: Getting signing cert info for ca from CS.cfg
INFO: Getting signing cert info for ca from NSS database
INFO: Getting ocsp_signing cert info for ca from CS.cfg
INFO: Getting ocsp_signing cert info for ca from NSS database
INFO: Getting sslserver cert info for ca from CS.cfg
INFO: Getting sslserver cert info for ca from NSS database
INFO: Getting subsystem cert info for ca from CS.cfg
INFO: Getting subsystem cert info for ca from NSS database
INFO: Getting audit_signing cert info for ca from CS.cfg
INFO: Getting audit_signing cert info for ca from NSS database
INFO: Fixing the following certs: ['ca_ocsp_signing', 'sslserver', 'subsystem', 'ca_audit_signing']
INFO: Stopping the instance to proceed with system cert renewal
INFO: Selftests disabled for subsystems: ca
INFO: Getting sslserver cert info for ca from CS.cfg
INFO: Getting sslserver cert info for ca from NSS database
INFO: Trying to create a new temp cert for sslserver.
INFO: Generate temp SSL certificate
INFO: Getting sslserver cert info for ca from CS.cfg
INFO: Getting sslserver cert info for ca from NSS database
INFO: CSR for sslserver has been written to /tmp/tmpg_738l5a/sslserver.csr
INFO: Getting signing cert info for ca from CS.cfg
INFO: Getting signing cert info for ca from NSS database
INFO: CA cert written to /tmp/tmpg_738l5a/ca_certificate.crt
INFO: AKI: 0x1D0F356A3E7A6968A231723231EB22DA5A01F542
INFO: Temp cert for sslserver is available at /etc/pki/pki-tomcat/certs/sslserver.crt.
INFO: Getting sslserver cert info for ca from CS.cfg
INFO: Getting sslserver cert info for ca from NSS database
INFO: Getting sslserver cert info for ca from CS.cfg
INFO: Getting sslserver cert info for ca from NSS database
INFO: Updating CS.cfg with the new certificate
INFO: Getting ocsp_signing cert info for ca from CS.cfg
INFO: Getting ocsp_signing cert info for ca from NSS database
INFO: Trying to setup a secure connection to CA subsystem.
INFO: Secure connection with CA is established.
INFO: Placing cert creation request for serial: 49
Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 600, in urlopen
    chunked=chunked)
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 343, in _make_request
    self._validate_conn(conn)
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 849, in _validate_conn
    conn.connect()
  File "/usr/lib/python3.6/site-packages/urllib3/connection.py", line 356, in connect
    ssl_context=context)
  File "/usr/lib/python3.6/site-packages/urllib3/util/ssl_.py", line 350, in ssl_wrap_socket
    context.load_cert_chain(certfile, keyfile)
ssl.SSLError: [X509: KEY_VALUES_MISMATCH] key values mismatch (_ssl.c:3550)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/requests/adapters.py", line 449, in send
    timeout=timeout
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 638, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/lib/python3.6/site-packages/urllib3/util/retry.py", line 398, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='ipa2.chem.byu.edu', port=8443): Max retries exceeded with url: /ca/rest/certrequests/profiles/caManualRenewal (Caused by SSLError(SSLError(185073780, '[X509: KEY_VALUES_MISMATCH] key values mismatch (_ssl.c:3550)'),))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/pki/server/pkiserver.py", line 119, in <module>
    cli.execute(sys.argv)
  File "/usr/lib/python3.6/site-packages/pki/server/pkiserver.py", line 111, in execute
    super(PKIServerCLI, self).execute(args)
  File "/usr/lib/python3.6/site-packages/pki/cli/__init__.py", line 204, in execute
    module.execute(module_args)
  File "/usr/lib/python3.6/site-packages/pki/cli/__init__.py", line 204, in execute
    module.execute(module_args)
  File "/usr/lib/python3.6/site-packages/pki/server/cli/cert.py", line 1154, in execute
    renew=True)
  File "/usr/lib/python3.6/site-packages/pki/server/__init__.py", line 1709, in cert_create
    PKIServer.renew_certificate(connection, new_cert_file, serial)
  File "/usr/lib/python3.6/site-packages/pki/server/__init__.py", line 202, in renew_certificate
    ret = cert_client.enroll_cert(inputs=inputs, profile_id='caManualRenewal')
  File "/usr/lib/python3.6/site-packages/pki/__init__.py", line 442, in handler
    return fn_call(inst, *args, **kwargs)
  File "/usr/lib/python3.6/site-packages/pki/cert.py", line 1011, in enroll_cert
    enroll_request = self.create_enrollment_request(profile_id, inputs)
  File "/usr/lib/python3.6/site-packages/pki/__init__.py", line 442, in handler
    return fn_call(inst, *args, **kwargs)
  File "/usr/lib/python3.6/site-packages/pki/cert.py", line 962, in create_enrollment_request
    enrollment_template = self.get_enrollment_template(profile_id)
  File "/usr/lib/python3.6/site-packages/pki/__init__.py", line 442, in handler
    return fn_call(inst, *args, **kwargs)
  File "/usr/lib/python3.6/site-packages/pki/cert.py", line 942, in get_enrollment_template
    r = self.connection.get(url, self.headers)
  File "/usr/lib/python3.6/site-packages/pki/client.py", line 46, in wrapper
    return func(self, *args, **kwargs)
  File "/usr/lib/python3.6/site-packages/pki/client.py", line 160, in get
    timeout=timeout,
  File "/usr/lib/python3.6/site-packages/requests/sessions.py", line 537, in get
    return self.request('GET', url, **kwargs)
  File "/usr/lib/python3.6/site-packages/requests/sessions.py", line 524, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3.6/site-packages/requests/sessions.py", line 637, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3.6/site-packages/requests/adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='ipa2.chem.byu.edu', port=8443): Max retries exceeded with url: /ca/rest/certrequests/profiles/caManualRenewal (Caused by SSLError(SSLError(185073780, '[X509: KEY_VALUES_MISMATCH] key values mismatch (_ssl.c:3550)'),))
ERROR: HTTPSConnectionPool(host='ipa2.chem.byu.edu', port=8443): Max retries exceeded with url: /ca/rest/certrequests/profiles/caManualRenewal (Caused by SSLError(SSLError(185073780, '[X509: KEY_VALUES_MISMATCH] key values mismatch (_ssl.c:3550)'),))