We need to also disable loading of dynamic shared objects (modules) with no-dso.
Without this it defaulted to $prefix/ssl which was /usr/ssl. However ca-certificates installs the certificates in /etc/ssl. Also there is no longer anything at "${COOKBOOK_STAGE}/"{share,ssl} to delete.