allow custom ca bundle on tls tunnel

We would like the pass a custom `ca` bundle into the tunneled *tls* connection.

This is the simplest idea I could think of, and it works for us. Thoughts?