OpenElec on Rpi seems to be handling the root certs well, so removing the --insecure flag