You can add a user template in the CA server and configure the settings in the Workspace ONE UEM console to enable AirWatch to fetch and use the CA certificates.