Whaouh, a certificate is a protection for OCS ! Are you sure ?
(It's really very simple to get the certificate provided by the server and ... this is the certificate cacert.pem needed by agent with SSL_enabled=1 ! Definitively this is not a security !! Anyone could easily pollute your inventory. Begin you could start to filter using geography to your country ?)