Thanks, Rob. Here are the outputs:
certutil -L -d /etc/pki/pki-tomcat/alias/
Certificate Nickname Trust Attributes
Server-Cert cert-pki-ca u,u,u
subsystemCert cert-pki-ca u,u,u
auditSigningCert cert-pki-ca u,u,Pu
ocspSigningCert cert-pki-ca u,u,u
caSigningCert cert-pki-ca CTu,Cu,CuDOMAIN.COM
IPA CA CTu,Cu,Cu
getcert list -d /etc/pki/pki-tomcat/alias/ -n 'caSigningCert cert-pki-ca'
Number of certificates and requests being tracked: 9.
Request ID '20201221144720':
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
issuer: CN=Certificate Authority,O=DOMAIN.COM
subject: CN=Certificate Authority,O=DOMAIN.COM
expires: 2040-12-21 06:51:45 EST
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca"
The other thing I tried was ipa-server-upgrade, which does resolve the 2nd failure. It adds the missing tracking. However, if I run ipa-certupdate after that, the error appears again. It appears that ipa-certupdate clears it. One thing worth mentioning is that I had run ipa-cacert-manage renew earlier. Is this related to it somehow ? I'm not entirely sure why there are two certificates with two serial numbers. They both have the same validity dates, only different times. One is off by 1 hour.