Description of problem:

See https://github.com/theforeman/puppet-certs/issues/456 for all the details. It was fixed in https://github.com/theforeman/puppet-certs/commit/15a3cc2c81ecf976380f99143d83741e565d95f0. This was broken since https://github.com/theforeman/puppet-certs/commit/433dadc5ec41c2477fc6a04e056ca061fd818980 which landed in Foreman 3.11.

Luckily this was found in the upstream community, but the big question is why this wasn't caught in Stream or even 6.16 snap testing.

How reproducible:

Always

Is this issue a regression from an earlier version:

Yes.

Steps to Reproduce:

1. Install Satellite with custom certificates
2. Install Capsule with custom certificates

Actual behavior:

/root/ssl-build/katello-server-ca.crt gets overwritten with the contents of /root/ssl-build/katello-default-ca.crt instead of the user provided custom certificate

Expected behavior:

User provided custom certificate is used

Business Impact / Additional info:
 
This is a primary workflow and we should have noticed this very quickly in Stream.