Make the ca_certs option useful again (CA-based cert validation)

It was broken since the fork.