I'm trying to promote a new client to a replica. I install the client first then run ipa-replica-install. The client install goes OK but the ipa-replica-install command fails with

RuntimeError: Certificate issuance failed (CA_UNREACHABLE)

Seems the client was able to reach the CA so I'm puzzled why the replica cannot.