Trust exactly the certificates in a PEM bundle, and nothing else — the company CA, or the self-signed certificate a staging node serves.
one or more -----BEGIN CERTIFICATE----- blocks, concatenated.
-----BEGIN CERTIFICATE-----
Redacted: a trust bundle is not secret, and a log line with a certificate in it is still noise.