update-ca-trust is also necessary

roles/rke2/tasks/setup_host.yml

@@ -72,7 +72,15 @@
 #     policy: targeted
 #     state: permissive
 #   when: ( 'control-plane' in group_names )
-
+#Download the mozilla root CA into the right directory, and update the trust chain
+- name: Download root CA
+  get_url:
+    url: https://curl.se/ca/cacert.pem
+    dest: /etc/ssl/certs
+
+- name: Update CA trust
+  shell: update-ca-trust
+  
 - name: Disable SELinux
   selinux:
     policy: targeted