Comment 3 for bug 399260

You are pointing me towards the function -- tell me how to duplicate the error you are receiving.

All certificates are generated with a .crt extension. If the primary server's certificate carries a .pem extension then that needs to be changed. It would be simpler to simply symlink here (as it offers an easy upgrade path for existing installations as well) and update the installer to write a .crt extension for the public certificate.

Also: in regards to point 1, I have added the CA and Package module / plugin & service map. I have also updated the core schemas to carry probed hardware details correctly. The DNS, Kerberos, NTP and OpenLDAP modules cannot be added as the server object falls into recursion when following defined service maps and loading computer objects (which in the case of the master system, is itself).