I'm uncomfortable merging this as-is because of this line.  I think we should ensure the CA cert is added to the system-wide trust store (i.e. `/etc/pki/tls/certs/$(openssl x509 -noout -hash -in $CERT).0`).