I'm not sure when this started happening...

ipa-replica-prepare generates two certificates.

For dogtag we use /etc/httpd/alias as our certdb so we can use the RA agent cert to generate certs. This was failing in two ways.

The first pass nss_shutdown() failed because the NSS database wasn't initialized even though nss_is_initialized() returned True

The second pass failed because the NSS database had something open.

I'm ignoring the errors for now but we need to figure out what changed.