Comment 1 for bug 1655167

That's true.
We could also assume that the cacert is located at {{ horizon_ssl_ca_cert }}, which is uploaded if user provided, from deploy node path {{ horizon_user_ssl_ca_cert }}.

I think it's safe to assume it's gonna be the same CA chain :p