[ptman]

FreeIPA sets up a CA by default and AD can do it as well (not sure if it's done by default).