Olta pointed out that using the package links is indeed the correct way to handle the absolute location of the ca root certificates, and this change was not needed for things to work.