Retrieve the CA chain from DNS itself (CERT records, TXT fallback) over DoH — no portal access needed, only DNS reachability.