cloud-init's ca_certs ran update-ca-certificates on Rocky and failed, so those machines never trusted the Rollcall CA. The CA is now written into both trust-anchor directories and a bootcmd rebuilds the store with update-ca-trust or update-ca-certificates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>