add comments on making self-signed rootCA work