See #60 for details.
For Ci droplets we use LE staging CA, so we need to provide curl
with the CA cert. Surprisingly, curl will still validate certs from
LE production CA even if "--cacert=./letsencrypt_fakelerootx1.pem" is
used.