CA certificates (also known as peer certificates) are part of a chain of authority used to verify a remote server or endpoint. SSL-enabled applications can consult the following to find a suitable CA certificate:
Public CA bundle: The appliance has an internal bundle of well-known trusted CA certificates distributed by Mozilla. They serve as root CA certificates for HTTP servers that have publicly issued certificates.
Supplemental CA list: Some SSL-enabled applications connect to HTTPS servers that have privately issued certificates. Examples may include the email server used to send system event notifications, the LDAP server used to authenticate users, the server used to transfer files, and the server used to post malware alert notifications.
You must add the trusted private root certificate and intermediate certificates (if needed) as supplemental CA certificates to validate against the certificates on these servers. Supplemental CA certificates are stored in the default CA list, which is empty until supplemental CA certificates are added. The default CA list supplements the well-known bundle; it does not replace it.
Note
A server with a publicly issued certificate could start using a new certificate that is not yet part of the well-known bundle. In this case, you must add the new certificate to the default CA list as a supplemental certificate.
By default, most SSL-enabled applications refer to the well-known bundle first, and then look for a certificate in the default CA list. You can configure some applications to use only the well-known bundle. For details, see the email ssl ca-list, ldap ssl ca-list, and web client ssl ca-list commands in the CLI Reference. An exception is malware event notifications, where the appliance automatically refers to the default CA list to verify the identity of the server to which it posts the notifications. Another exception is email forwarding, where the Email Security — Server appliance automatically refers to the default CA list to verify the identity of the mail server to which it forwards the emails.
Operator or Admin access