Add provider's ca validation (TOFU). Closes #3227.