update ca.crt to only contain needed certs