Expost ca_location parameter

It's important enough that it should be at the top level. Applies to at
least three roles.