make cacert.pem file available from Phar; closes #859