You can maintain a list of CA root certificates in the database. You can then import these certificates into the various PSEs to specify which CA's the server should trust. The system also uses the certificates stored in the database to build the correct format for certificate request responses that exist in PEM format instead of the required PKCS#7 certification chain format.

See the following: