If the application uses p11-kit, or a TLS library that uses p11-kit such as OpenSSL, NSS, or GnuTLS, then Flatpak should automatically give it access to the host system's CA certificates.