I was so hoping the story to end but nope.

ipa-cert-fix managed to renew one of the certs

but failed on the following ones

Enter "yes" to proceed: yes
Proceeding.
ipapython.ipautil: DEBUG: Starting external process
ipapython.ipautil: DEBUG: args=pki-server cert-fix --ldapi-socket /var/run/slapd-...socket --agent-uid ipara --cert subsystem --cert ca_ocsp_signing --extra-cert 268304408 --extra-cert 268304410
ipapython.ipautil: DEBUG: Process finished, return code=1
ipapython.ipautil: DEBUG: stdout=ERROR: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:618)

ipapython.ipautil: DEBUG: stderr=INFO: Loading password config: /etc/pki/pki-tomcat/password.conf
INFO: Fixing the following system certs: ['subsystem', 'ca_ocsp_signing']
INFO: Renewing the following additional certs: ['268304408', '268304410']
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
INFO: Stopping the instance to proceed with system cert renewal
INFO: Configuring LDAP password authentication
INFO: Setting pkidbuser password via ldappasswd
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
INFO: Selftests disabled for subsystems: ca
INFO: Resetting password for uid=ipara,ou=people,o=ipaca
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
INFO: Starting the instance
INFO: Sleeping for 10 seconds to allow server time to start...
INFO: Requesting new cert for subsystem
INFO: Getting subsystem cert info for ca
INFO: Trying to setup a secure connection to CA subsystem.
INFO: Starting new HTTPS connection (1): myhost.com
INFO: Stopping the instance
INFO: Selftests enabled for subsystems: ca
INFO: Restoring previous LDAP configuration

ipapython.admintool: DEBUG:   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_cert_fix.py", line 128, in run
    replicate_dogtag_certs(subject_base, ca_subject_dn, certs)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_cert_fix.py", line 251, in replicate_dogtag_certs
    cert = x509.load_certificate_from_file(cert_path)
  File "/usr/lib/python2.7/site-packages/ipalib/x509.py", line 425, in load_certificate_from_file
    with open(filename, mode='rb') as f:

ipapython.admintool: DEBUG: The ipa-cert-fix command failed, exception: IOError: [Errno 2] No such file or directory: '/etc/pki/pki-tomcat/certs/subsystem.crt'
ipapython.admintool: ERROR: [Errno 2] No such file or directory: '/etc/pki/pki-tomcat/certs/subsystem.crt'
ipapython.admintool: ERROR: The ipa-cert-fix command failed.

The csr for subsystem was added according to https://access.redhat.com/solutions/4852721

At the time of the above failure in /var/log/pki/pki-tomcat/ca/debug:

[20/May/2022:07:43:59][localhost-startStop-1]: Certutils.verifySystemCertValidityByNickname:  failed : java.lang.Exception: Certutils.verifySystemCertValidityByNickname:  failed: nickname: ocspSigningCert
 cert-pki-ca
[20/May/2022:07:43:59][localhost-startStop-1]: CertUtils: verifySystemCertsByTag() failed: java.lang.Exception: Certutils.verifySystemCertValidityByNickname:  faliled: nickname: ocspSigningCert cert-pki-c
acause: java.lang.Exception: Certutils.verifySystemCertValidityByNickname:  failed: nickname: ocspSigningCert cert-pki-ca
[20/May/2022:07:43:59][localhost-startStop-1]: SignedAuditLogger: event CIMC_CERT_VERIFICATION
[20/May/2022:07:43:59][localhost-startStop-1]: SignedAuditLogger: event CIMC_CERT_VERIFICATION
java.lang.Exception: Certutils.verifySystemCertValidityByNickname:  faliled: nickname: ocspSigningCert cert-pki-cacause: java.lang.Exception: Certutils.verifySystemCertValidityByNickname:  failed: nicknam
e: ocspSigningCert cert-pki-ca
        at com.netscape.cmscore.cert.CertUtils.verifySystemCertValidityByNickname(CertUtils.java:839)

Kindly assist