I have solved the problem by going to http://curl.haxx.se/docs/caextract.html. However, instead of downloading the latest cacert.pem, I jumped down a paragrapgh to here:

RSA-1024 removed

Around early September 2014, Mozilla removed the trust bits from the certs in their CA bundle that were still using RSA 1024 bit keys. This may lead to TLS libraries having a hard time to verify some sites if the library in question doesn't properly support "path discovery" as per RFC 4158. (That includes OpenSSL and GnuTLS.)
The last CA bundle we converted from before that cleanup: an older ca-bundle from github.

I downloaded the older ca-bundle and it worked a treat. Happy days.