Hi,
the directory manager password provided to ipa-ca-install is validated by doing a simple bind to the LDAP URI defined in /etc/ipa/default.conf. It should contain something similar to
ldap_uri = ldapi://%2Frun%2Fslapd-DOMAIN-COM.socket
and you can try manually with (replace DOMAIN-COM with your own domain)
ldapsearch -D "cn=directory manager" -w $DMP -H ldapi://%2Frun%2Fslapd-DOMAIN-COM.socket -s base -b ""
I would check if the ldapi socket is enabled (nsslapd-ldapilisten: on is defined in /etc/dirsrv/slapd-DOMAIN-COM/dse.ldif), and if the ldap_uri is properly defined in /etc/ipa/default.conf. The ipa-ca-install also provides a --debug option that would allow to gather more information.
flo