please note that package tomcat-8.0.32-3.fc23.noarch  messes with
symlinks to Catalina classes used by Dogtag. This makes CA deployment
blow up spectacularly during FreeIPA server/replica/etc installation. A
bugzilla exists for this issue and also mentions a workaround which
makes the symlinks point to correct files.
An alternative is to downgrade tomcat to version 8.0.32-2.fc23  or
older. That should make Dogtag work again.
If you already encountered this issue give negative karma to the package
Manage your subscription for the Freeipa-devel mailing list:
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code