Currently to refresh CA certs, people are using the /pub/katello-ca-consumer rpm to update the certs. Now that the rpm is deprecated, we need to have a native way to refresh those certificates.

1. We need to have a script that will be downloadable without authentication and via HTTP (not HTTPS). Running this script will refresh CA certs on the host
2. We need to have a REX job that will refresh the certificates as regular SSH script
3. We need to have a REX job that will refresh the certificates as ansible playbook