syslog over TLS

[mark]

Hello,

logging to a syslog server with the following command is working fine:
-> swlog output socket syslog.example.com tls

It fails with unknown CA when server validation is enabled:
-> ssl pki client validate-certificate admin-state enable

I transferred the CA file to /flash/switch/cert.d/ca.pem and updated the CA certificate with:
-> aaa certificate update-ca-certificate ca.pem

But even after a switch reboot the TLS connection fails.
Is this the right command? Or where should the CA file be placed?

Thanks in advance,
Regards