use the more common phrase 'CA bundle'
only show --allow-no-ssl when no ssl