Oh, also I recommend running `update-ca-certificates --fresh` before running any `curl` commands to make sure it handles `https` correctly.