Similar to #8226

application/x-x509-ca-cert is the default response from our Spring-Boot application when there is an error like 404 and it was trying to get a cert file that doesn't exist: https://example.com/key.pem

But it is a valid response type when looking at https://www.iana.org/assignments/media-types/application/x-x509-ca-cert and https://datatracker.ietf.org/doc/html/rfc5280

4.2.1.1. CA Certificate Response Message Format
If the CA does not have any intermediate CA certificates, the response consists of a single X.509 CA certificate. The response will have a Content-Type of "application/x-x509-ca-cert".
"Content-Type: application/x-x509-ca-cert"

Steps to reproduce the behavior

1. Create spring-boot application
2. Scan a GET endpoint with ZAP, which will try with /key.pem
3. The report will have the "Unexpected Content-Type was returned" finding with application/x-x509-ca-cert

Screenshots