Where does repo sync check its root CA?

Where does repo sync check its root CA? I can update my EPEL repo due to an SSL error. I saw the same issue with my Firefox, and I had to re-introduce the root CA from my nssdb. My question is how do I update the root CA for my repo sync?

--Laszlo