You can use the ipsec cert show command to view the subset of root certificates that Data ONTAP is currently using for certificate authentication.