Add a bundled cacert.pem as a last resort option