Rob,
Fraser did answer my question, but...
As the initial email topic notes, this is FreeIPA 4.5.0. And yes, I was trying to convert from CA-less to CA-full install.
And Fraser found the exact problem I was running into.

On Tue, Mar 6, 2018 at 11:58 AM Rob Crittenden <rcritten@redhat.com> wrote:
John Seekins via FreeIPA-users wrote:
> On a RHEL 7 box, I installed the ipa-server package and set up a server without a CA successfully. Then I tried to manually add the CA functionality afterwards and, while the install appeared to work, the server can't properly access the dogtag instance through the proxy, which breaks a lot of functionality.
>
> Logs here:
> https://gist.github.com/johnseekins/d1a117c568f7895ec0e7fa588aba745d
>
> What am I doing wrong here?

What version of IPA is this? Are you trying to do a CA-less install and
converting it to a CA-ful install?


rob