You can add a user template in the CA server and configure the settings in the AirWatch console to enable AirWatch to fetch and use the CA certificates.