I would check to ensure that your tree CA has not expired, or that it is assigned to a server. Sometimes the server that was assigned as the CA gets removed from the tree (upgrade, migration, etc), and the CA never gets reassigned to another server. This would cause problems when trying to create a cert.