diff --git a/network/curl/curl.conf b/network/curl/curl.conf
index 039115025..a1b05abc1 100644
--- a/network/curl/curl.conf
+++ b/network/curl/curl.conf
@@ -17,3 +17,11 @@
 if [ "$SDECFG_STATIC" = "1" ] ; then
 	var_insert confopt " " "--disable-shared"
 fi
+
+# we don't have a bundle, it can't be disabled on runtime
+# and if it's empty it fails to verify anything regardless
+# the capath
+var_append extraconfopt ' ' '--without-ca-bundle'
+if pkginstalled openssl; then
+	var_append extraconfopt ' ' '--with-ca-path=/etc/ssl/certs'
+fi