new prerequisite "Mozilla::CA" to avoid '500 Can't verify SSL peers without knowning which Certificate Authorities to trust'