ca-certificates configuration is now handled by puppet