Correct a bug where the variable to determine if the certificate should
be a ca-certificate was incorrectly named @ca instead of @is_ca in the
certtool.cfg template.