dogtag broken after IPA upgrade on Oracle Linux 8.5

ipa-healthcheck
ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)
ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)
ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)
ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)
ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)
ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)
ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)
ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)
ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)
ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)
[
  {
    "source": "ipahealthcheck.dogtag.ca",
    "check": "DogtagCertsConnectivityCheck",
    "result": "ERROR",
    "uuid": "adde834a-67d6-415e-9025-55ff89508248",
    "when": "20211217155153Z",
    "duration": "0.341901",
    "kw": {
      "msg": "Request for certificate failed, Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)"
    }
  },
  {
    "source": "ipahealthcheck.ipa.certs",
    "check": "IPACertRevocation",
    "result": "ERROR",
    "uuid": "10ddd67e-01ac-4999-a072-d3be3afca400",
    "when": "20211217155202Z",
    "duration": "0.797478",
    "kw": {
      "key": "20210818233922",
      "serial": 7,
      "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)",
      "msg": "Request for certificate serial number {serial} in request {key} failed: {error}"
    }
  },
  {
    "source": "ipahealthcheck.ipa.certs",
    "check": "IPACertRevocation",
    "result": "ERROR",
    "uuid": "a5b22de1-445d-45b6-b6c7-78d71da488c0",
    "when": "20211217155202Z",
    "duration": "0.968682",
    "kw": {
      "key": "20210818233929",
      "serial": 5,
      "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)",
      "msg": "Request for certificate serial number {serial} in request {key} failed: {error}"
    }
  },
  {
    "source": "ipahealthcheck.ipa.certs",
    "check": "IPACertRevocation",
    "result": "ERROR",
    "uuid": "b2e10c88-90ea-4f9e-aded-951dd270e1bb",
    "when": "20211217155202Z",
    "duration": "1.134077",
    "kw": {
      "key": "20210818233930",
      "serial": 2,
      "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)",
      "msg": "Request for certificate serial number {serial} in request {key} failed: {error}"
    }
  },
  {
    "source": "ipahealthcheck.ipa.certs",
    "check": "IPACertRevocation",
    "result": "ERROR",
    "uuid": "933def39-bd79-49fb-b130-7317a1c4c782",
    "when": "20211217155202Z",
    "duration": "1.301348",
    "kw": {
      "key": "20210818233931",
      "serial": 4,
      "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)",
      "msg": "Request for certificate serial number {serial} in request {key} failed: {error}"
    }
  },
  {
    "source": "ipahealthcheck.ipa.certs",
    "check": "IPACertRevocation",
    "result": "ERROR",
    "uuid": "e3a2aa4c-c3e7-4603-a80a-fcc9f1623ad0",
    "when": "20211217155202Z",
    "duration": "1.468537",
    "kw": {
      "key": "20210818233932",
      "serial": 1,
      "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)",
      "msg": "Request for certificate serial number {serial} in request {key} failed: {error}"
    }
  },
  {
    "source": "ipahealthcheck.ipa.certs",
    "check": "IPACertRevocation",
    "result": "ERROR",
    "uuid": "29016094-3a1e-4f70-8d02-0a88f725c51c",
    "when": "20211217155203Z",
    "duration": "1.636062",
    "kw": {
      "key": "20210818233933",
      "serial": 3,
      "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)",
      "msg": "Request for certificate serial number {serial} in request {key} failed: {error}"
    }
  },
  {
    "source": "ipahealthcheck.ipa.certs",
    "check": "IPACertRevocation",
    "result": "ERROR",
    "uuid": "e164918f-7b51-4b45-87e3-bf13b842f511",
    "when": "20211217155203Z",
    "duration": "1.713946",
    "kw": {
      "key": "20210818234046",
      "serial": 9,
      "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)",
      "msg": "Request for certificate serial number {serial} in request {key} failed: {error}"
    }
  },
  {
    "source": "ipahealthcheck.ipa.certs",
    "check": "IPACertRevocation",
    "result": "ERROR",
    "uuid": "da7438c6-28fb-4f6c-8664-8d82b031069d",
    "when": "20211217155203Z",
    "duration": "1.881151",
    "kw": {
      "key": "20210818233938",
      "serial": 8,
      "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)",
      "msg": "Request for certificate serial number {serial} in request {key} failed: {error}"
    }
  },
  {
    "source": "ipahealthcheck.ipa.certs",
    "check": "IPACertRevocation",
    "result": "ERROR",
    "uuid": "9c9a487a-a857-4fa7-9d65-1c44a693a8a8",
    "when": "20211217155203Z",
    "duration": "1.962001",
    "kw": {
      "key": "20210818234054",
      "serial": 10,
      "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403.  (403)",
      "msg": "Request for certificate serial number {serial} in request {key} failed: {error}"
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "WARNING",
    "uuid": "ced4b11b-3040-4792-8aed-3fd304fbac5d",
    "when": "20211217155203Z",
    "duration": "0.037489",
    "kw": {
      "msg": "Got {count} ipa-ca A records, expected {expected}",
      "count": 6,
      "expected": 1
    }
  },
  {
    "source": "ipahealthcheck.ipa.files",
    "check": "IPAFileCheck",
    "result": "WARNING",
    "uuid": "e3d740de-69de-4866-abce-5f29fb44cd39",
    "when": "20211217155203Z",
    "duration": "0.005457",
    "kw": {
      "key": "_var_log_ipaupgrade.log_mode",
      "path": "/var/log/ipaupgrade.log",
      "type": "mode",
      "expected": "0600",
      "got": "0644",
      "msg": "Permissions of /var/log/ipaupgrade.log are too permissive: 0644 and should be 0600"
    }
  }
]