bootserver: let curl ask for the password when it needs it
bootserver: use rootca.pem to verify the peer