New CA on controller

[sierra-tango-echo]

include ssl/alces-software/sub.class1.server.2015.ca.pem on the controller

[sierra-tango-echo]

until this is fixed, workaround:
after running all installers copy the new CA over /etc/certs/ca_crt
then re-run the fixup cmds:

#Fixup Certs
cp -f /etc/certs/nova_crt.pem /etc/certs/apache_crt.pem
cp -f /etc/certs/nova_crt.pem /etc/certs/nginx_crt.pem
cat /etc/certs/ca_crt >> /etc/certs/apache_crt.pem
cat /etc/certs/ca_crt >> /etc/certs/nginx_crt.pem
cp -fpav /etc/certs/nova_key.pem /etc/certs/apache_key.pem
cp -fpav /etc/certs/nova_key.pem /etc/certs/nginx_key.pem
chown nova:nova /etc/certs/nova*
chown nginx:nginx /etc/certs/nginx*
chmod 600 /etc/certs/*