look for cacert.pem, rather than depending on ui