Automatic merge from submit-queue (batch tested with PRs 48702, 48965, 48740, 48974, 48232)

aggr: don't write empty CA files

write now if the metadata is not supplied, we write an empty file for
these certs. we should just fail.

Notice the removal of the ":-"s