only need ca file for TLS socket