add custom trust store to work around BOA misconfigured certs