The CS.cfg is owned/updated by the Dogtag server, but sometimes people are advised to modify the file directly, and maybe some other systems interoperate with Dogtag that way too, which may lead to corruption if they happpen simultaneously.

Possible solutions:

1. Require Dogtag to be shutdown before changing CS.cfg directly.
2. Prohibit direct access to the file and require the use of tools that send the changes to the server (e.g. via CLI/REST).
3. Break CS.cfg into user-owned and server-owned parameters, and move mostly-static parameters into a separate default file that can be overwritten as needed.
4. Replace CS.cfg with LDAP-based configuration.

Option #1 can be documented in 10.2.x. Other options probably can only be implemented in 10.3.x at the earliest.