make cafile a parameter with a default to /etc/ssl/ca-certificates.crt