[freeipa PR#4102][opened] [WIP] Debian: write out only one CA certificate per file

[yrro]

   URL: https://github.com/freeipa/freeipa/pull/4102
Author: yrro
 Title: #4102: [WIP] Debian: write out only one CA certificate per file
Action: opened

PR body:
"""
ca-certificates populates /etc/ssl/certs with symlinks to its input
files and then runs 'openssl rehash' to create the symlinks that libssl
uses to look up a CA certificate to see if it is trused.

'openssl rehash' ignores any files that contain more than one
certificate: <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=945274>;.

With this change, we write out trusted CA certificates to
/usr/local/share/ipa-ca, one certificate per file.

Fixes: https://pagure.io/freeipa/issue/8106
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/4102/head:pr4102
git checkout pr4102