for each of the issuers for a certificate e.g. "AlphaSSL CA - SHA256 - G2" you'll need find and add this certificate to /var/osquery/server.pem. So that the entire chain can be validated and trusted.