Include the new CA somewhere in the cacert bundle
The cznic-cacert-bundle
should provide a file with our private CA, so other packages may use it.
Also, we may want to have compound one for the current CA (startcom) and our private one, for the migration time.