certs' privkey type doesn't require parent paths
puppet-certs' privkey type (and others that inherit from common) have a path parameter and autorequire a file with that path, but don't require the parent. When it tries to write the file without the parent, it fails even it the catalog does include the parent. The log shows this (note the timestamps):
[ERROR 2019-09-14T04:58:09 main] Could not set 'present' on ensure: No such file or directory @ rb_sysopen - /etc/pki/katello/private/katello-apache.key (file: /usr/share/foreman-installer/modules/certs/manifests/keypair.pp, line: 18)
[ WARN 2019-09-14T04:58:25 main] /Stage[main]/Certs::Config/File[/etc/pki/katello/private]/ensure: created
Autorequiring all parents all the way to the root should solve this.