Install cacert before running nix-channel

Also, make it more robust against incorrent SSL_CERT_FILE values.
Better error message