curl: download CA bundle as well