There is no certified/documented way of changing file permissions to all the files under /opt/CA
The /opt/CA contains files with different file permissions, some of them having sticky bits and few of them having 777 permissions. Never touch these files else it leads to another issues. Refer below KBArticle that lists few of them:
Take "ls -lrt" of /opt/CA as it is to have a record of the existing permissions, then start changing permissions in parts followed by testing.
Note: This is never tested by Broadcom.