documentation/docs/admin-guide/configuration/basic/tls_ca.md

Additional CA (e.g. for TLS/SSL Interception/Inspection)

It is possible to accept other trusted root CAs.

You can add them in Hiera by first defining them with a specific base::trusted_ca::$CA_NAME key:

base::trusted_ca::my_own_ca: |
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----

and then select them by name where required in the base::trusted_cas list:

base::trusted_cas:
    - my_own_ca

There is already a predefined CA psi_ssl_interception which is used by the PSI firewall for SSL interception. So if your systems is treated by the firewall with SSL interception then you simply can do

base::trusted_cas:
    - psi_ssl_interception