1. CA and KRA instances are configured with HSM and RHEL 7.4 in FIPS mode.
2. I followed the procedure to archive the key using the profile
    aSigningUserCert as described in
    http://pki.fedoraproject.org/wiki/Certificate_Key_Archival

# pki -d /opt/rhqa_pki/certs_db  -c SECret.123 -p 8080 client-cert-request
cn=FooUser345 --profile caSigningUserCert --type crmf --transport
/opt/rhqa_pki/kra_transport.txt
-----------------------------
Submitted certificate request
-----------------------------
  Request ID: 20
  Type: enrollment
  Request Status: pending
  Operation Result: success

# pki -d /opt/rhqa_pki/admin_cert_db  -c SECret.123 -n "PKI CA Administrator
   for Non-TMS-CA" -p 8080 ca-cert-request-review --action approve 20
   PKIException: Internal Server Error

CA debug log has this:
[05/May/2017:18:09:30][http-bio-8443-exec-22]: SignedAuditEventFactory:
create() message created for eventType=PRIVATE_KEY_ARCHIVE_REQUEST

[05/May/2017:18:09:30][http-bio-8443-exec-22]: SignedAuditEventFactory:
create() message created for eventType=CERT_REQUEST_PROCESSED

[05/May/2017:18:09:30][http-bio-8443-exec-22]: CertRequestExecutor: about to
throw EProfileException because of bad profile execute.

KRA debug log has this:
[05/May/2017:18:09:30][http-bio-31042-exec-5]: SignedAuditEventFactory:
create() message created for eventType=PRIVATE_KEY_ARCHIVE_REQUEST

[05/May/2017:18:09:30][http-bio-31042-exec-5]: KRAService serviceRequest
EBaseException:Invalid Private Key

Certificate request should be approved and the key should be archived in KRA.