I have this exact same error on ipa-certupdate, after deleting certs that expired on May
30. Were you able to find any leads in the time since this post?
ipa-certupdate is needed after "ipa-cacert-manage install" commands, prior to
ipa-server-certinstall.