IPA dogtag-ipa-ca-renew-agent certs status are CA_WORKING

Issue

When manually renewing IPA certs auditSigningCert, ocspSigningCert, subsystemCert and ra-agent cert with getcert resubmit on IPA replica, all the status of those 4 certs becomes CA_WORKING while there is no error observed in /var/log/pki/pki-tomcat/ca/debug log of either IPA replica or IPA renewal master. IPA integrated CA is being used here without any external CA cert.

[root@ipareplica ~]# getcert list
Number of certificates and requests being tracked: 9.
Request ID '20210220130601':
        status: MONITORING
        stuck: no
        key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
        certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
        CA: IPA
        issuer: CN=Certificate Authority,O=EXAMPLE.COM
        subject: CN=ipareplica.example.com,O=EXAMPLE.COM
        issued: 2023-02-10 04:05:17 PST
        expires: 2025-02-10 04:05:17 PST
        principal name: krbtgt/EXAMPLE.COM@EXAMPLE.COM
        key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
        eku: id-kp-serverAuth,id-pkinit-KPKdc
        profile: KDCs_PKINIT_Certs
        pre-save command:
        post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
        track: yes
        auto-renew: yes
Request ID '20211127063656':
        status: CA_WORKING  <<<========= auditsigning cert status
        stuck: no
        key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
        certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
        CA: dogtag-ipa-ca-renew-agent
        issuer: CN=Certificate Authority,O=EXAMPLE.COM
        subject: CN=CA Audit,O=EXAMPLE.COM
        issued: 2022-10-05 03:35:31 PDT
        expires: 2024-09-24 03:35:31 PDT
        key usage: digitalSignature,nonRepudiation
        profile: caSignedLogCert
        pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
        post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"
        track: yes
        auto-renew: yes
Request ID '20211127063657':
        status: CA_WORKING  <<<============= OCSP cert status
        stuck: no
        key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
        certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
        CA: dogtag-ipa-ca-renew-agent
        issuer: CN=Certificate Authority,O=EXAMPLE.COM
        subject: CN=OCSP Subsystem,O=EXAMPLE.COM
        issued: 2022-10-05 03:34:22 PDT
        expires: 2024-09-24 03:34:22 PDT
        eku: id-kp-OCSPSigning
        profile: caOCSPCert
        pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
        post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"
        track: yes
        auto-renew: yes
Request ID '20211127063658':
        status: CA_WORKING  <<<<<============ subsystem cert status
        stuck: no
        key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set
        certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
        CA: dogtag-ipa-ca-renew-agent
        issuer: CN=Certificate Authority,O=EXAMPLE.COM
        subject: CN=CA Subsystem,O=EXAMPLE.COM
        issued: 2022-10-05 03:34:52 PDT
        expires: 2024-09-24 03:34:52 PDT
        key usage: digitalSignature,keyEncipherment,dataEncipherment
        eku: id-kp-clientAuth
        profile: caSubsystemCert
        pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
        post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"
        track: yes
        auto-renew: yes
Request ID '20211127063659':
        status: MONITORING
        stuck: no
        key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
        certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
        CA: dogtag-ipa-ca-renew-agent
        issuer: CN=Certificate Authority,O=EXAMPLE.COM
        subject: CN=Certificate Authority,O=EXAMPLE.COM
        issued: 2015-03-26 15:40:01 PDT
        expires: 2035-03-26 15:40:01 PDT
        key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
        profile: caCACert
        pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
        post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca"
        track: yes
        auto-renew: yes
Request ID '20211127063700':
        status: MONITORING
        stuck: no
        key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
        certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
        CA: dogtag-ipa-ca-renew-agent
        issuer: CN=Certificate Authority,O=EXAMPLE.COM
        subject: CN=ipareplica.example.com,O=EXAMPLE.COM
        issued: 2023-02-10 04:04:38 PST
        expires: 2025-01-30 04:04:38 PST
        dns: ipareplica.example.com
        key usage: digitalSignature,keyEncipherment,dataEncipherment
        eku: id-kp-serverAuth,id-kp-clientAuth
        profile: caServerCert
        pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
        post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca"
        track: yes
        auto-renew: yes
Request ID '20211127063701':
        status: CA_WORKING  <<<<============= RA cert status
        stuck: no
        key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
        certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
        CA: dogtag-ipa-ca-renew-agent
        issuer: CN=Certificate Authority,O=EXAMPLE.COM
        subject: CN=IPA RA,O=EXAMPLE.COM
        issued: 2022-10-05 03:35:22 PDT
        expires: 2024-09-24 03:35:22 PDT
        key usage: digitalSignature,keyEncipherment,dataEncipherment
        eku: id-kp-clientAuth
        profile: caSubsystemCert
        pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
        post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
        track: yes
        auto-renew: yes
Request ID '20211127063702':
        status: MONITORING
        stuck: no
        key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-CORP-NETAPP-COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-CORP-NETAPP-COM/pwdfile.txt'
        certificate: type=NSSDB,location='/etc/dirsrv/slapd-CORP-NETAPP-COM',nickname='Server-Cert',token='NSS Certificate DB'
        CA: IPA
        issuer: CN=Certificate Authority,O=EXAMPLE.COM
        subject: CN=ipareplica.example.com,O=EXAMPLE.COM
        issued: 2023-02-10 04:04:12 PST
        expires: 2025-02-10 04:04:12 PST
        dns: ipareplica.example.com
        principal name: ldap/ipareplica.example.com@EXAMPLE.COM
        key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
        eku: id-kp-serverAuth,id-kp-clientAuth
        profile: caIPAserviceCert
        pre-save command:
        post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv CORP-NETAPP-COM
        track: yes
        auto-renew: yes
Request ID '20211127063703':
        status: MONITORING
        stuck: no
        key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key',pinfile='/var/lib/ipa/passwds/ipareplica.example.com-443-RSA'
        certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt'
        CA: IPA
        issuer: CN=Certificate Authority,O=EXAMPLE.COM
        subject: CN=ipareplica.example.com,O=EXAMPLE.COM
        issued: 2023-02-10 04:03:46 PST
        expires: 2025-02-10 04:03:46 PST
        dns: ipareplica.example.com,ipa-ca.EXAMPLE.COM
        principal name: HTTP/ipareplica.example.com@EXAMPLE.COM
        key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
        eku: id-kp-serverAuth,id-kp-clientAuth
        profile: caIPAserviceCert
        pre-save command:
        post-save command: /usr/libexec/ipa/certmonger/restart_httpd
        track: yes
        auto-renew: yes