ca-certificates alone didn't fully resolve sentry-cli's TLS handshake against GlitchTip in the Docker builder stage -- explicitly pointing its vendored OpenSSL at the installed CA bundle location is the documented workaround for this class of Rust-binary-on-Alpine cert issue.