I removed everything including the original CA from /etc/dirsrv/slap-XXX,
And I replaced it with Comodo's CA.
When pki-tomcat try to authenticate dirsrv, it would use certificate singed by orginal CA,
while there is NO CA for dirsrv to valid it( pki-tomcat).
This is the root cause of this error.
QED.