add 3rd ca cert