openvox 8x: document custom CA for HTTPS-inspecting proxies

[miharp]

Summary

• Adds a new doc page covering how to add a custom CA to OpenVox's vendored cert bundle for environments using HTTPS-inspecting proxies (Squid SSL Bump, etc.)
• Explains why OpenVox ignores the OS trust store (it uses its own DEFAULT_CERT_FILE at /opt/puppetlabs/puppet/ssl/cert.pem and DEFAULT_CERT_DIR at /opt/puppetlabs/puppet/ssl/certs/)
• Covers three approaches: certs/ + openssl rehash (recommended — survives upgrades), ssl_trust_store (module downloads only), and SSL_CERT_FILE with a merged bundle (universal, including gem installs and Windows)
• Puppet management example: file + exec rehash for the certs/ approach, with a symlink variant for nodes where the cert is already deployed by puppet/trusted_ca
• Adds nav entry under "SSL and certificates"

Motivation

Reported by a community member: gem installs and puppet module install fail behind Squid SSL Bump even when the proxy CA is in the system trust store.

Source verification

Claims verified against the OpenVox source:

• OpenSSL::X509::DEFAULT_CERT_FILE = /opt/puppetlabs/puppet/ssl/cert.pem and DEFAULT_CERT_DIR = /opt/puppetlabs/puppet/ssl/certs/ confirmed on a live openvox-agent-8.27.0 install
• puppet module install uses Puppet::SSL::SSLProvider#create_system_context → create_x509_store(include_system_store: true) → store.set_default_paths, which respects both DEFAULT_CERT_FILE and DEFAULT_CERT_DIR (ssl_provider.rb:258)
• ssl_trust_store scope confirmed via defaults.rb:1020 — applies to forge/https only, not gem subprocesses
• puppet_gem provider runs gem as a subprocess (puppet_gem.rb), so only inherits SSL_CERT_FILE from the service environment

Test results

Tested on openvox-agent-8.27.0 (CentOS Stream 9, aarch64) via Vagrant. Generated a self-signed test CA, started a Python HTTPS server using that CA, and verified each approach:

=== TEST 1: Default cert.pem (should FAIL) ===
ERROR: OpenSSL::SSL::SSLError: certificate verify failed (unable to get local issuer certificate)

=== TEST 2: certs/ + openssl rehash ===
OK

=== TEST 3: SSL_CERT_FILE merged bundle ===
OK

=== TEST 4: Docs verification command ===
OK

Puppet file + exec rehash approach also verified — idempotent, hash symlink created, Ruby connects without SSL_CERT_FILE:

Notice: /File[...proxy-ca.pem]/ensure: defined content as '{sha256}cda6...'
Notice: /Exec[rehash-puppet-ssl-certs]: Triggered 'refresh' from 1 event
# second run:
Notice: Applied catalog in 0.02 seconds  ← no changes

Test plan

• Review doc prose for accuracy
• Confirm nav link resolves correctly on built site