describe where fixture CA comes from; also indent

Author: Tom Maher

script/install-openldap

@@ -52,21 +52,19 @@ export CA_CERT="/etc/ssl/certs/cacert.pem"
 export CA_KEY="/etc/ssl/private/cakey.pem"
 export CA_INFO="/etc/ssl/ca.info"
 
-# If you ever need to regenerate these...
-# certtool --generate-privkey > /path/to/cakey.pem
-# certtool --generate-self-signed \
-#  --load-privkey /path/to/cakey.pem
-#  --template /path/to/ca.info
-#  --outfile /path/to/cacert.pem
+# The self-signed fixture CA cert & key are generated by
+# `script/generate-fiuxture-ca` and checked into version control.
+# You shouldn't need to muck with these unless you're writing more
+# TLS/SSL integration tests, and need special magic values in the cert.
 
 cp "${SEED_PATH}/ca/cacert.pem" "${CA_CERT}"
 cp "${SEED_PATH}/ca/cakey.pem"  "${CA_KEY}"
 cp "${SEED_PATH}/ca/ca.info"    "${CA_INFO}"
 
 # Make a private key for the server:
 certtool --generate-privkey \
---bits 1024 \
---outfile /etc/ssl/private/ldap01_slapd_key.pem
+  --bits 1024 \
+  --outfile /etc/ssl/private/ldap01_slapd_key.pem
 
 sh -c "cat > /etc/ssl/ldap01.info <<EOF
 organization = Example Company