Cache cacert.pem for local testing, wire up override, VM-aware path