add ca option to ssl/tls config