Turned to the #Dogtag-PKI IRC chanel and got it resolved! posting here for anyone else having this issue(s) (turned out the problem was 2 fold)
First off - starting the instance manually:
# systemctl restart pki-tomcatd@<instance_name>.service
If you used default settings, your instance name would be pki-tomcat, and the command would be:
# systemctl restart pki-tomcatd@pki-tomcat.service
It seems that pkispawn doesn't set the instance to restart at boot time. To acheive this:
# systemctl enable pki-tomcatd@<instance_name>.service
There is now a trac ticket open to have this (how to start / stop manually, and start at boot) added to the man page: (I was going to provide a link to trac, but apparently my karma is "insufficient")
The other issue is that there is a bug in SELinux policy that mislabels /root/.java as systemu:objectr:adminhomet:s0 - it should be mozillahomet. This will prevent the instance from starting. There is an issue open for this now as well, and the SELinux team is working on a fix that should release today-ish. (same deal here - can't post the link unfortunately... darn karma)
As a temporary fix you can just re-label it real quick (which doesn't survive a reboot mind you!)
# chcon -R -t mozilla_home_t /root/.java
Special thanks to alee in #dogtag-pki for walking me through all this!
