При запуске скрипта ipa-server-install
(По инструкции https://www.altlinux.org/FreeIPA)

Configuring NTP daemon (ntpd)
  [1/5]: stopping ntpd
  [2/5]: writing configuration
  [3/5]: configuring ntpd to start on boot
  [4/5]: set ntpd mode to server
  [5/5]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server (dirsrv). Estimated time: 1 minute
  [1/46]: creating directory server user
  [2/46]: creating directory server instance
  [3/46]: restarting directory server
  [4/46]: adding default schema
  [5/46]: enabling memberof plugin
  [6/46]: enabling winsync plugin
  [7/46]: configuring replication version plugin
  [8/46]: enabling IPA enrollment plugin
  [9/46]: enabling ldapi
  [10/46]: configuring uniqueness plugin
  [11/46]: configuring uuid plugin
  [12/46]: configuring modrdn plugin
  [13/46]: configuring DNS plugin
  [14/46]: enabling entryUSN plugin
  [15/46]: configuring lockout plugin
  [16/46]: configuring topology plugin
  [17/46]: creating indices
  [18/46]: enabling referential integrity plugin
  [19/46]: configuring certmap.conf
  [20/46]: configure autobind for root
  [21/46]: configure new location for managed entries
  [22/46]: configure dirsrv ccache
  [23/46]: enabling SASL mapping fallback
  [24/46]: restarting directory server
  [25/46]: adding sasl mappings to the directory
  [26/46]: adding default layout
  [27/46]: adding delegation layout
  [28/46]: creating container for managed entries
  [29/46]: configuring user private groups
  [30/46]: configuring netgroups from hostgroups
  [31/46]: creating default Sudo bind user
  [32/46]: creating default Auto Member layout
  [33/46]: adding range check plugin
  [34/46]: creating default HBAC rule allow_all
  [35/46]: adding sasl mappings to the directory
  [36/46]: adding entries for topology management
  [37/46]: initializing group membership
  [38/46]: adding master entry
  [39/46]: initializing domain level
  [40/46]: configuring Posix uid/gid generation
  [41/46]: adding replication acis
  [42/46]: enabling compatibility plugin
  [43/46]: activating sidgen plugin
  [44/46]: activating extdom plugin
  [45/46]: tuning directory server
  [46/46]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds
  [1/28]: creating certificate server user
  [2/28]: configuring certificate server instance
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/.private/root/tmpE9Accd' returned non-zero exit status 1
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more information:
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL   /var/log/pki/pki-tomcat
  [error] RuntimeError: CA configuration failed.
ipa.ipapython.install.cli.install_tool(Server): ERROR    CA configuration failed.
ipa.ipapython.install.cli.install_tool(Server): ERROR    The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

ipa при этом не запускается.

P.S. При попытке установить через GUI alterator Также была ошибка. C альтератором позже можно разобраться.