I've got a situation where I have 4 FreeIPA peer servers, with 2 of them being CAs with replication configured. These are split into 2 physical locations with 1 CA per site. I was testing renewal of the "nickname='subsystemCert cert-pki-ca" certificate in one of my sites by issuing ipa-getcert resubmit -i [cert ID#]. Now this certificate seems to be stuck with a status of CA_Working. Since its been over 4 hours since I submitted the request I'm wondering if something went wrong and where I can begin looking to troubleshoot. I tried running ipa-certupdate to sync from the other CA master and it completed successfully. The original certificate was not expired and other than the "CA Working" status there are no apparent problems. The server is version 4.6.4 running on Centos 7.4. Do I have reason to be concerned or is this expected behavior?