Function write_ca_export 

pub fn write_ca_export(path: &Path, pem: &str) -> Result<()>

Write the CA certificate to ca_export_path without destroying anything else.

ca_export_path is a startup parameter, so the model can set it through open_server, and a wrong path must cost nothing:

• A path that does not exist is created with create_new, so a file that appears there in the meantime is never truncated.
• A symlink is refused, never followed: on Unix every open carries O_NOFOLLOW (and create_new does not follow one either); elsewhere symlink_metadata refuses it first.
• An existing file is replaced only when it is an earlier NetGet export: a regular file holding exactly one PEM certificate, and nothing else, whose subject is CA_COMMON_NAME — what a restart finds, since the CA is regenerated per start. The check and the rewrite go through the same handle, so there is no window between them. Any other file — a PEM certificate or CA bundle included — is refused by name and left untouched.