Where does cacert.pem come from?  What happens if it is absent?