Comment 3 for bug 1655167

It is not necessarily true.
In general case horizon endpoint may be different from keystone pub endpoing.
Say, Horizon access is provided at "https://cloud.domain.tld", while keystone is at "https://keystone.domain.tld".
In this case there may be 2 different CA certs issued with the servers certificates.