stream-ssl: Replace client CA list instead of adding to it.