Technically, a more correct name for an SSL certificate is a "PKI (public key infrastructure) certificate using the TLS protocol"
On a Satellite,
/etc/pki/katello/certs
contains all of the Katello's certs, including server and CA/etc/rhsm/ca/katello-server-ca.pem
can be ignored - this is on the system if it is a client of another katello #KatelloInception
On a Katello client,
/etc/rhsm/ca/katello-default-ca.pem
contains the pki certificate from Katello downloaded with