```release-note:bug
ca: fix a masked bug in leaf cert generation that would not be notified of root cert rotation after the first one
```