Install root CAs
Add dry-run flag (-dry)

This will not execute any dyn commands but just show which
records it would add.