Ensure ca-bundle is run as root