Only load ca.pem if DOCKER_TLS_VERIFY is on