use curl cacerts.pem to verify ca