There are several things which should be improved in the documentation abotu BYO certificates (https://strimzi.io/docs/0.9.0/full.html#installing-your-own-ca-certificates-str). In particular:

• Prerequisites say A Kafka resource within OpenShift or Kubernetes. I'm not sure what does that mean. But we recommend to do this before the deployment. So we should probably remove this as it might be interpreted as if the cluster should be already deployed.
• We should add docs which will explain how to do it when the AMQ Streams / Strimzi CA is signed by one or more another CAs (i.e. has a chain of one or more other certificates). This is important but not clear from the docs.