CMakeLists.txt looks for the system CA bundle in several locations, including /etc/ssl/certs/ca-certificates.crt. This works for non-sandboxed builds but fails inside a sandbox.