journal seems empty for certmonger. I just see some stuff in messages:
# grep certmonger /var/log/messages*
/var/log/messages-20191215:Dec 8 08:21:11 ipa certmonger: Certificate named "subsystemCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-tomcat/alias" will not be valid after 20200104123512.
/var/log/messages-20191215:Dec 8 08:21:11 ipa certmonger: Certificate named "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-tomcat/alias" will not be valid after 20200104123512.
/var/log/messages-20191215:Dec 8 08:21:11 ipa certmonger: Certificate named "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-tomcat/alias" will not be valid after 20200104123511.
/var/log/messages-20191215:Dec 8 08:21:11 ipa certmonger: Certificate in file "/var/lib/ipa/ra-agent.pem" will not be valid after 20200104123538.
/var/log/messages-20191215:Dec 8 08:21:35 ipa certmonger: Certificate named "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-tomcat/alias" issued by CA and saved.
/var/log/messages-20191215:Dec 8 16:21:39 ipa certmonger: 2019-12-08 16:21:39 [15599] Invalid cookie: u''
/var/log/messages-20191215:Dec 8 16:21:49 ipa certmonger: 2019-12-08 16:21:49 [15599] Invalid cookie: u''
/var/log/messages-20191215:Dec 8 16:21:59 ipa certmonger: 2019-12-08 16:21:59 [15599] Invalid cookie: u''
, which is weird; 20200104123511 is in the future...