Description of problem:
System Engine generates its own CA Cert during install and uses it for the Web UI and signing other certs used for communication between pulp, candlepin, and AMQP.

Issues with this, outlined at https://fedorahosted.org/katello/wiki/CertsRedesign, along with a lot more detail are:

    all server certs are signed by Candlepin CA
    Candlepin CA serves as both server cert and CA cert
        its key is not password protected
        its key is accessible by three system users 
    certs are not trusted
    no multihome support 

Version-Release number of selected component (if applicable):
System Engine 1.1 Beta

Thus far https://bugzilla.redhat.com/show_bug.cgi?id=754728 to document the process for replacing the CA with a subordinate CA signed by our CA has not been completed, and I have been told that the process will not be supported until 2.0.

How reproducible:
Always

Steps to Reproduce:
1. Install System Engine
  
Actual results:
See that the CA Cert created during install is used as the server cert and the CA Cert for signing  other certs. Look for documentation on replacing the CA Cert with a subordinate CA signed by your organizations CA and see that there is none. 

Expected results:
We should be able to replace the cert for the Web UI with a standard SSL cert signed by our CA. We should also have the option of replacing the CA Cert created during install with a subordinate CA cert signed by our CA Cert.

Additional info: