Don't append CA if url is behind public CA

pkg/aggregation/server.go

@@ -26,12 +26,14 @@ func ListenAndServe(ctx context.Context, url string, caCert []byte, token string
 			InsecureSkipVerify: true,
 		}
 	} else if len(caCert) > 0 {
+		if _, err := http.Get(url); err != nil {
 			pool := x509.NewCertPool()
 			pool.AppendCertsFromPEM(caCert)
 			dialer.TLSClientConfig = &tls.Config{
 				RootCAs: pool,
 			}
 		}
+	}
 
 	handler = auth.ToMiddleware(auth.AuthenticatorFunc(auth.Impersonation))(handler)