You'll notice
The CA bundle fetch now retries with backoff on 5xx, 408 and 429 responses before writing it to disk.
A new helper fetches the CA certificate bundle from a CCR agent-proxy /ca-cert endpoint with retry and backoff on 5xx, 408, and 429 responses, writing the resulting bundle to disk. Write failures are classified as retryable or fatal.