I think the answer to the root CA issue is to add teh certificate to "Cluster Certificates (Optional)" in the "CSE Management" window. Will try and see if it works.
