added config option for root ca certificate