[New: openFATE 315592] retire /etc/ssl/certs as r/w for admins