ca_trust is not updated correctly on Debian/Ubuntu by the ca_registration snippet, because the Debian command update-ca-certificates only looks at cert-files with extension crt, while the snippet creates katello-server-ca.pem.