- move CA directories to _sysconfdir/pki/CA - patch the CA script and the default config so it points to the CA directories