use both server and CA certificates