add note about CA certs