During a review of PR https://github.com/freeipa/freeipa/pull/355 that fixes #6226 (which has to be fixed before it's possible to encounter this bug) I encountered the following issue.

After installing CA-less master and CA-less replica, install a CA on one of the servers. The installation should succeed. Afterwards, attempt to install CA on the other server. The installation will end with an error message "CA did not start in 300 seconds." Please note that it does not matter whether you first install the CA on master or replica - the first installation always succeeds, while the second one fails.

The relevant logs show that pki-tomcat fails to connect to LDAPS on port 636, which is actually running and listening for connections. There is probably an issue with the propagation of CA certificate to other servers during ipa-ca-install, because running ipa-certupdate seems to fix the problem.

/var/log/pki/pki-tomcat/ca/debug

[21/Dec/2016:12:43:46][localhost-startStop-1]: SSL handshake happened
Could not connect to LDAP server host vm-058-045.example.com port 636 Error netscape.ldap.LDAPException: Authentication failed (48)

/var/log/dirsrv/slapd-DOM-058-045-EXAMPLE-COM/access

[21/Dec/2016:12:43:46.640540945 +0100] conn=4 fd=66 slot=66 SSL connection from 10.34.58.45 to 10.34.58.45
[21/Dec/2016:12:43:46.653170560 +0100] conn=4 TLS1.2 128-bit AES
[21/Dec/2016:12:43:46.665708312 +0100] conn=4 op=0 BIND dn="" method=sasl version=3 mech=EXTERNAL