binary ca_root_nss doesn't create the symlink to /etc/ssl/cert.pem
skip ri and rdoc for chef.