Move ca-certificates configs to puppet files for maintainability.