The self-signed bootstrap cert has no CA bundle, so newly created tenants with ca_applied_at=NULL are not actually stale. Skip the count when the active cert has hasCa=false. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>