ca_protect: (no)|(other==yes)