Be wary of T150058 and Elastic's use of this CA

And also of T111654 for MariaDB's usage of this CA. Adding DBA

There are other systems using this CA, namely etcd.

I would suggest the right course of action for all apps is:

1. create a new CA key/cert
2. Install it as a trusted CA on all live systems
3. Audit how applications use the puppet cert, most will just need a rolling restart once we're done
4. Do the CA rollout for puppet. We did this in the past, details on how it was done here https://wikitech.wikimedia.org/wiki/Puppet_CA_replacement but I think there are simpler ways to do it
5. Once puppet has run everywhere, new signed certs will be available; we should check which applications will need a restart and which will not. Since both the old and the new CA will be trusted, nothing should stop working.
6. Remove the old CA once we're done

Also re: the rollover, we should switch to deploying multiple CA certificates. This would also avoid refresh problems during rollover (e.g. /etc/ssl/certs not being updated in T150058 and T145609)