For now, this is server-side TLS, not mTLS.
If a tls_ca is configured, the certificates in that file are PEM encoded. They
are the only trusted roots for server certificate verification on both gRPC and
HTTP connections. If tls_ca is set, no server name verification is done for
now.
