bootstrap: ensure ca config exists before continuing