Don't change cert store if the system one is good

[stevegraham]

System cert store is more likely to be kept current. It would be sensible to detect if the system is broken then only act at that point. Suggestions welcome.

cc @martoche