default should be CA only