FL-1159: ca-certificates unmask