You can add a user template in the CA server and configure the settings in the Workspace ONE UEM console to enable Workspace ONE UEM to fetch and use the CA certificates.