Use `cacert.pem` by default.

SSL is already on by default and curl itself no longer includes CAs by default.