The bundled cert file will need to be extracted from the composer.phar otherwise the openssl lib won't be able access it (similar to how Guzzle handles it here: https://github.com/guzzle/guzzle/blob/045ade85d801ce932b9e85bd94be4931110393e6/phar-stub.php)