Thanks so much Rob, it was the secret mismatch. I swear I checked that, but must not have
been paying attention.
Once the secrets in "/etc/pki/pki-tomcat/server.xml" and
"/etc/httpd/conf.d/ipa-pki-proxy.conf" matched, and services restarted all is
well now.
--Russ