According to the uri options spec (https://github.com/mongodb/specifications/blob/master/source/uri-options/uri-options.rst), the tlsCAFile option is "required if the driver's language/runtime allows non-global configuration."

The driver may be able to support this option using some combination of `RemoteCertificateValidationDelegate` and the ExtraStore property: https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509chainpolicy.extrastore?view=netstandard-2.0

(The property is available on net452, but on .NET Standard requires 2.0)

Additional reading:
https://github.com/dotnet/corefx/issues/25581
https://github.com/dotnet/corefx/issues/36606
https://en.programqa.com/question/7695438/