improve curl/openssl build + add root cert generation