I'm not great with Debian-based systems but apt show python-pyasn1 should provide the version of pyasn1 that is installed. IPA 4.6.x is python2-based. The problem isn't the request it's an ASN.1 parsing error. I'm guessing that the CA is issuing the new cert ok but because of the parsing issue it is blow up inside IPA so it can't be further processed. So solving the python-pyasn1 issue could just fix everything. You might try downgrading it. RHEL-7, which has IPA 4.6.6 uses python2-pyasn1-0.1.9-7.el7.
Inferring from the logs and
getcert list, I believe they are the certs in:
/var/lib/krb5kdc and
/etc/dirsrv/
Are each of those being stored in the back end some where they might be exported? Or are they lost because they are not being written to disk?
Is there a way I can just generate new certificates or somehow manually bypass certmonger?
Thanks,
Sean