allow user to omit caCert, fallback to noverify