christoph: root + ssl + thawte + ca