which means that the file ca.crt is stored in
/usr/share/ipa/html/ca.crt.
This file is updated by ipa-certupdate when a new CA is added, but it
should only contain CA certificates, not the RA cert or a server cert.
Thanks, I've checked the location and corrected the files - last modified date was
2014 so not sure if it was an unintended change by a staff member, or a bug during an
upgrade.
Thanks for the assistance, I'm now happy that the behaviour of our old and new servers
is consistent, so the decomissioning should be uneventful.
Adam