ca-certificates setup is now done by puppet