Description of problem:
I'm trying to change the ca cert from external signed to self-signed. But its failing and error can be shown as below:

[root@ipa-master ~]# ipa-cacert-manage renew --self-signed
Renewing CA certificate, please wait
Error resubmitting certmonger request '20170630120302', please check the request manually
The ipa-cacert-manage command failed.

[root@ipa-master ~]#  getcert list -i 20170630120302
Number of certificates and requests being tracked: 9.
Request ID '20170630120302':
        status: MONITORING
        ca-error: Updated certificate not available
        stuck: no
        key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
        certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
        CA: dogtag-ipa-ca-renew-agent
        issuer: CN=External CA,O=EXTERNAL
        subject: CN=Certificate Authority,O=TESTRELM.TEST
        expires: 2017-09-30 12:00:32 UTC
        key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
        pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
        post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca"
        track: yes
        auto-renew: yes

Version-Release number of selected component (if applicable):
ipa-server-4.5.0-20.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1. Install IPA with externally signed CA cert

ipa-server-install --ip-address ${IP} -r ${RELM} -p ${PASSWORD} -a ${PASSWORD} --setup-dns --forwarder ${FORWARDER} -U --external-ca

2.  Setup nssdb for external CA

    mkdir nssdb

    echo Secret.123 > nssdb/password.txt

    certutil -N -d nssdb -f nssdb/password.txt

3. Setup external ca

    openssl rand -out nssdb/noise.bin 2048

    ROOTCA_SKID="0x`openssl rand -hex 20`"

    echo -e "y\n\ny\n${ROOTCA_SKID}\n\n" |  certutil -S  -d nssdb  -f  nssdb/password.txt  -z nssdb/noise.bin  -n "External CA"  -s "CN=External CA,O=EXTERNAL"  -x  -t "CTu,CTu,CTu"  -m $RANDOM -2  --extSKID  --keyUsage digitalSignature,nonRepudiation,certSigning,crlSigning,critical

4.  export external CA chain
    
    certutil -L -d nssdb -n "External CA" -a > /tmp/external.crt

5. Sign the ipa.csr from external ca

    SUBCA_SKID="0x`openssl rand -hex 20`"

    SUBCA_OCSP="http://$HOSTNAME:8080/ca/ocsp"

    echo -e "y\n\ny\ny\n${ROOTCA_SKID}\n\n\n\n${SUBCA_SKID}\n\n2\n7\n${SUBCA_OCSP}\n\n\n\n" |  certutil -C  -d nssdb  -f nssdb/password.txt  -m $RANDOM  -a -i /root/ipa.csr  -o /tmp/ca_signing.crt  -c "External CA"  -2 -3  --keyUsage digitalSignature,nonRepudiation,certSigning,crlSigning,critical  --extAIA  --extSKID

6. Start Install and get Certificate Signing Request for externally signed CA

    ipa-server-install --ip-address ${IP} -r ${RELM} -p ${PASSWORD} -a ${PASSWORD} --setup-dns --forwarder ${FORWARDER} -U --external_cert_file=/tmp/ca_signing.crt  --external_ca_file=/tmp/external.crt

7. Check cert status for certs:
    
    getcert list | egrep "status|expires|Request|subject|ca-error"

8. renew the ca cert and change it to self-signed
  
    ipa-cacert-manage renew --self-signed

    
Actual results:

CA cert renewal is failing.


Expected results:
CA should renew successfully and changed to self-signed

Additional info:
error in /var/log/message  is attached.