ansible-linux-infra/roles/logging_rsyslog/files/README.md

Place the customer's internal CA root/intermediate certificate here (filename set via syslog_ca_cert_src in group_vars, default: siem-ca.crt), unless the SIEM/syslog-collector certificate is already signed by a publicly trusted CA already present in the system trust store.

Only relevant when syslog_ca_cert_enabled: true.