...
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
  [1/26]: creating certificate server db
  [2/26]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 3 seconds elapsed
Update succeeded
  [3/26]: creating installation admin user
  [4/26]: configuring certificate server instance
ipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance: CalledProcessError(Command ['/usr/sbin/pkispawn', '-s', 'CA', '-f', '/tmp/tmpfp85l6ml'] returned non-zero exit status 1: 'NoSuchItemOnTokenException: Expected user cert but no matching key?: (-8157) Certificate extension not found.\n')
ipaserver.install.dogtaginstance: CRITICAL See the installation logs and the following files/directories for more information:
ipaserver.install.dogtaginstance: CRITICAL   /var/log/pki/pki-tomcat
  [error] RuntimeError: CA configuration failed.
Your system may be partly configured.

2018-03-28 16:34:18 pkispawn    : INFO     ... generating 'pki.server.deployment.scriptlets.security_databases'
2018-03-28 16:34:18 pkispawn    : INFO     ....... generating '/etc/pki/pki-tomcat/password.conf'
2018-03-28 16:34:18 pkispawn    : INFO     ....... generating '/etc/pki/pki-tomcat/pfile'
2018-03-28 16:34:18 pkispawn    : INFO     ....... modifying '/etc/pki/pki-tomcat/password.conf'
2018-03-28 16:34:18 pkispawn    : DEBUG    ........... chmod 660 /etc/pki/pki-tomcat/password.conf
2018-03-28 16:34:18 pkispawn    : DEBUG    ........... chown 17:17 /etc/pki/pki-tomcat/password.conf
2018-03-28 16:34:18 pkispawn    : INFO     ....... executing 'certutil -N -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/pfile'
2018-03-28 16:34:21 pki.nssdb   : DEBUG    Command: pki -d /etc/pki/pki-tomcat/alias -C /etc/pki/pki-tomcat/pfile pkcs12-import --pkcs12-file /tmp/ca.p12 --pkcs12-password-file /tmp/tmpw5t6rdr0/password.txt
2018-03-28 16:34:23 pkispawn    : DEBUG    ....... Error Type: CalledProcessError
2018-03-28 16:34:23 pkispawn    : DEBUG    ....... Error Message: Command '['pki', '-d', '/etc/pki/pki-tomcat/alias', '-C', '/etc/pki/pki-tomcat/pfile', 'pkcs12-import', '--pkcs12-file', '/tmp/ca.p12', '--pkcs12-password-file', '/tmp/tmpw5t6rdr0/password.txt']' returned non-zero exit status 255.
2018-03-28 16:34:23 pkispawn    : DEBUG    .......   File "/usr/lib/python3.6/site-packages/pki/server/pkispawn.py", line 534, in main
    scriptlet.spawn(deployer)
  File "/usr/lib/python3.6/site-packages/pki/server/deployment/scriptlets/security_databases.py", line 154, in spawn
    pkcs12_password=pki_clone_pkcs12_password)
  File "/usr/lib/python3.6/site-packages/pki/nssdb.py", line 1172, in import_pkcs12
    subprocess.check_call(cmd)
  File "/usr/lib64/python3.6/subprocess.py", line 291, in check_call
    raise CalledProcessError(retcode, cmd)