chown root:root on generated CA.