This bug is created as a clone of upstream ticket:
https://fedorahosted.org/pki/ticket/816

I tried to install ipa replica (from fedora 19 -> fedora 20)
with command 
**ipa-replica-install --setup-ca --setup-dns --no-forwarders /var/lib/ipa/replica-info-vm-171.idm.lab.example.com.gpg**
but installation of replica failed, because certificate server instance could not be started
{{{
Configuring certificate server (pki-tomcatd): Estimated time 3 minutes 30 seconds
  [1/19]: creating certificate server user
  [2/19]: configuring certificate server instance
  [3/19]: stopping certificate server instance to update CS.cfg
  [4/19]: disabling nonces
  [5/19]: set up CRL publishing
  [6/19]: starting certificate server instance

Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

CA did not start in 240s
}}}

I think that the most important part from log files is:
{{{
bash# cat pki/pki-tomcat/ca/system
0.localhost-startStop-1 - [11/Dec/2013:17:42:55 CET] [3] [3] Cannot build CA chain. Error java.security.cert.CertificateException: Certificate is not a PKCS #11 certificate
0.localhost-startStop-1 - [11/Dec/2013:17:42:56 CET] [13] [3] authz instance DirAclAuthz initialization failed and skipped, error=Property internaldb.ldapconn.port missing value
}}}


Version of installed software:
{{{
bash# rpm -q freeipa-server pki-ca
freeipa-server-3.3.3-2.fc20.x86_64
pki-ca-10.1.0-1.fc20.noarch
}}}

Additional informations:
I was able to install ipa replica with ca (from fedora 19 -> fedora 19)
{{{
bash# rpm -q freeipa-server pki-ca
freeipa-server-3.3.3-2.fc19.x86_64
pki-ca-10.0.6-1.fc19.noarch
}}}

I will attach all log files and I can provide any other information to fix this bug.