To reproduce:

Stop dogtag

Create ca file in /var/lib/certmonger/cas/dogtag-ipa with the contents:

id=dogtag-ipa
ca_is_default=0
ca_type=EXTERNAL
ca_external_helper=/usr/libexec/certmonger/dogtag-ipa-renew-agent-submit -E http://ipa.cloudlab.freeipa.org:8080/ca/ee/ca -A https://ipa.cloudlab.freeipa.org:8443/ca/agent/ca/ -i /etc/ipa/ca.crt -T caSimpleCMCUserCert

restart dogtag

request a cert

getcert request -c dogtag-ipa -s -f /etc/pki/ayoung-traced.cert.pem -k /etc/.pki/ayoung-traced.key.pem -N "uid=ayoung"

Manually approve the cert on dogtag

Re-request the cert from dogtag with
getcert resubmit -i (id from getcert request)

Result: Keys is created in /etc/pki but cert is not.

Restart certmonger and certfile will be saved.