fix #92379: don't check ca cert on download