need to call update-ca-certificates, too