getcert modify-ca -c dogtag-ipa-retrieve-agent-submit -e /usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit
fixed for me, see helper lines in /var/lib/certmonger/cas/*