- use API_CA_SSL_CRT (root CA authority cert), not API_SSL_CRT (actual