Which certificate format does a Cisco WSA need when HTTPS proxy is configured?

Which certificate format does a Cisco WSA need when HTTPS proxy is configured?
A. DER
B. CER
C. PEM
D. CRL