use certfile instead of fingerprint on darwin.

This requires curl-ca-bundle (installed via homebrew).