RE: TLS Connections Between Dovecot & MariaDB

I'm using a MariaDB backend to a Dovecot server, with TLS required by the MariaDB server for connections.

My sql_dovecot.conf.ext file is using the following connection line: connect = host=mariadb.example.com dbname=mail_server user=vmail password={REDACTED} ssl_ca=/etc/pki/tls/certs/root_ca.crt.

I can't work out from the doco or Google what else I need in that line, but I suspect it'll be something like: ssl_cert=/etc/pki/tls/certs/vmail_rsa.pem ssl_key=/etc/pki/tls/certs/vmail_rsa.key.

Could someone please confirm this and let me know the actual extra commands/options - thanks

Why not add your CA to the OS default?