When using SSL client authentication, if the user does not have a ~/.koji/serverca.crt file, the Koji client does not use the system-wide certificate store to verify the hub's HTTPS cert. The user must always explicitly configure a serverca setting.

In cli/koji_cli/lib.py's read_defaults() method, there is this section where we configure a default serverca:

    # special handling for cert defaults
    cert_defaults = {
        'cert': '~/.koji/client.crt',
        'serverca': '~/.koji/serverca.crt',
        }
    ...

We loop over that dict, and if those paths do not exist, then we set result[name] = ''

This empty string ends up going into ssl_login() here as options.serverca:

session.ssl_login(options.cert, None, options.serverca, proxyuser=runas)

And we raise with a confusing message about this empty string:

raise AuthError("Server CA %s doesn't exist or is not accessible" % serverca)

It would be great to make Koji always default to using the system-wide CA store instead of defaulting to ~/.koji/serverca.crt. This would match the way Koji behaves for GSSAPI authentication.