[Freeipa-users] Re: CA errors after update, server.xml desync?

[Dirk Silkenbaeumer]

I ran into similar issues after upgrading from FreeIPA 4.9.3 to 4.9.6 on Centos Stream 8 last week.

You could check /var/log/httpd/error_log - I had trouble with TLS 1.3 (leading to error "Request failed with status 403: Non-2xx response from CA REST API: 403.") which could be solved by disabling SSLProtocol in /etc/httpd/conf.d/ssl.conf. 
There were other issues with disabling TLS 1.3 (see https://bugzilla.redhat.com/show_bug.cgi?id=1775158) and due to lack of time, finally I recovered from backup.