Something like `/etc/pki/CA/certs/external_root.crt` has:
```
---BEGIN CERTIFICATE---
root_CA_A
---END CERTIFICATE---
---BEGIN CERTIFICATE---
intermediate_CA_B (old expired)
---END CERTIFICATE---
---BEGIN CERTIFICATE---
intermediate_CA_B (new one)
---END CERTIFICATE---
```