Those are set via the store's URI, e.g.: https://substituter.invalid?ssl-cert=/path/to/cert.pem&ssl-key=/path/to/key.pem