This is resolved by "
----
getcert modify-ca -c dogtag-ipa-ca-renew-agent -e
'/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit -N'
----
and start-tracking....
The reason is that once certmonger renews a certificate, it would use old certificate
request information to geneate a new one. But the old one may not work out.
-N tells certmonger to discard the old stuff and just create a new one.