Use 'strict-ssl' and Git's CA config.