The certificate form of the CA has to be crt to be sure it is manageable by the Debian update-ca-certificates executable. Also, added option to force the copy of the certificates, also if the local files did not change.