I never coded on Espressif, but in other SDKs (e.g., mosquitto, mbedtls) typically this is done when you open the connection at the application layer (HTTPS, MQTTS). You pass in the cert bytes either as binary or PEM text as a char[]. Use a CA root cert(s) from your OS/browser.

EDIT: grammar and typos.

It depends on whether you want to connect to random hosts or ones that you know beforehand. The latter is very easy, I just hardcode the certificate fingerprint. The former/dealing with CAs is harder, I've never done it.

The high-level client in esp-idf handles ssl out of the box and comes with a list of pre-installed root cas.

The question, of course, is: What if these CAs expire?