Help with rules to detect TLS/HTTPS traffic that is using untrusted CA

[Philippe_Antoine]

I mean you can store the certificates cf 8.16. SSL/TLS Keywords — Suricata 8.0.0-dev documentation , and then have some other tool post-process them like convert to PEM format