# Placeholder — replace with the actual FreeIPA CA certificate before deploying.
#
# Retrieve from the IPA server (it is a public certificate, safe to commit):
#   curl -o certs/ipa-ca.crt http://<ipa-server>/ipa/config/ca.crt
#
# This file must contain a valid PEM certificate for SSSD to authenticate
# against FreeIPA over TLS.  The Nix build succeeds with a placeholder, but
# the deployed host will not be able to join the domain until the real cert
# is committed and the system is rebuilt.