add up-to-date CA root certs and set `SSL_CERT_FILE` accordingly