link cacert.pem under embedded/