http://l3tczdiiwoo63iwxty4lhs6p7eaxop5micbn7vbliydgv63x5zrrrfyd.onion/user-manual/howto.html
To do this, each browser has the certificates of multiple CAs in its trust store. The browser will only
accept the certificate if the CA that signed it is in its trust store, otherwise it will warn that the
certificate is not valid.