> > > > also how to add a CA cert to ca_root_nss file? > > If in PEM format then just append it. In DER format it is not possible. ok. it's in pem. but for each cert my ca-root-nss.crt has a bunch of other sections - like date, signature algorithm,etc - wheres the company-root-ca.crt has only whats in-between the begin and end lines. does that matter? thanks…