/etc/chef/certificates/ is in chef-server-api 10.12.0-1.
This file is owned by root:root, with mode 0o755.