When TLS is enabled, this parameter specifies the name of a file containing Certificate Authority (CA) root certificates that may be required to validate TLS peer certificates. The certificates must be in PEM format. The file can contain several root certificates for one or more Certificate Authorities. Radiator looks for root certificates for RadSec connections in TLS_CAFile then in TLS_CAPath, so there usually is no need to set both.