[cpach]

Nit-pick: In that case the certs aren’t self-signed, they are regular leaf certs, chained to a “non-standard” CA.

[urda]

This is true, the user I replied to was asking about root CA's so I tried to address that.