# Additional CA (e.g. for TLS/SSL Interception/Inspection)

It is possible to accept other trusted root CAs.

You can add them in Hiera by first defining them with a specific `base::trusted_ca::$CA_NAME` key:

```
base::trusted_ca::my_own_ca: |
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----
```

and then select them by name where required in the `base::trusted_cas` list:

```
base::trusted_cas:
    - my_own_ca
```

There is already a predefined CA `psi_ssl_interception` which is used by the PSI firewall for SSL interception. So if your systems is treated by the firewall with SSL interception then you simply can do

```
base::trusted_cas:
    - psi_ssl_interception
```