I've decided to move us to the centos cacert.pem from the mozilla one. It sucks hard - but we are getting screwed over by github's amazon s3 cert as well at the moment and this solves that problem as well 