Jason,
I've seen this caused by a replication conflict that prevents the CA certificate
profiles from loading completely during start-up. Can you double-check that there are
really no conflicts in ou=certificateprofiles,ou=ca,o=ipaca, just to confirm?
Try this:
1. Check for replication conflicts in ou=certificateprofiles,ou=ca,o=ipaca:
# ldapsearch -xLLL -D "cn=Directory Manager" -W -b
ou=certificateprofiles,ou=ca,o=ipaca
'(|(objectclass=*)(&(objectclass=ldapsubentry)(nsds5ReplConflict=*))'
2. If any objects are found, remove them and then try starting IPA:
# ldapdelete -x -D "cn=Directory Manager" -W <dn of replication conflict
object>