read ca_certs from config