Only use root CA in agent