diff --git a/.travis.yml b/.travis.yml
index 55824dfa2e..62dbb73847 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,7 +15,7 @@ matrix:
         - os: osx
           env:
             # On OS X the frameworks/dylibs contain hard coded paths, so we have to re-create the paths in the VM exactly
-            - SWBASE=/Users/kovid SW=$SWBASE/sw PATH=$SW/bin:$SW/qt/bin:$SW/python/Python.framework/Versions/2.7/bin:$PWD/node_modules/.bin:$PATH CFLAGS=-I$SW/include LDFLAGS=-L$SW/lib QMAKE=$SW/qt/bin/qmake QT_PLUGIN_PATH=$SW/qt/plugins MACOSX_DEPLOYMENT_TARGET=10.7
+            - SWBASE=/Users/kovid SW=$SWBASE/sw PATH=$SW/bin:$SW/qt/bin:$SW/python/Python.framework/Versions/2.7/bin:$PWD/node_modules/.bin:$PATH CFLAGS=-I$SW/include LDFLAGS=-L$SW/lib QMAKE=$SW/qt/bin/qmake QT_PLUGIN_PATH=$SW/qt/plugins SSL_CERT_FILE=$PWD/resources/mozilla-ca-certs.pem
 
 before_install:
     - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then curl https://download.calibre-ebook.com/travis/sw-linux.tar.xz | tar xJ -C $HOME; fi
diff --git a/setup/resources.py b/setup/resources.py
index b4ce05dd53..df11ac24f0 100644
--- a/setup/resources.py
+++ b/setup/resources.py
@@ -6,7 +6,7 @@ __license__   = 'GPL v3'
 __copyright__ = '2009, Kovid Goyal <kovid@kovidgoyal.net>'
 __docformat__ = 'restructuredtext en'
 
-import os, cPickle, re, shutil, marshal, zipfile, glob, time, sys, hashlib, json, urllib, errno
+import os, cPickle, re, shutil, marshal, zipfile, glob, time, sys, hashlib, json, errno, subprocess
 from zlib import compress
 from itertools import chain
 
@@ -235,7 +235,10 @@ class CACerts(Command):  # {{{
             if err.errno != errno.ENOENT:
                 raise
             raw = b''
-        nraw = urllib.urlopen('https://curl.haxx.se/ca/cacert.pem').read()
+        # We use curl here as on some OSes (OS X) when bootstrapping calibre,
+        # python will be unable to validate certificates until after cacerts is
+        # installed
+        nraw = subprocess.check_output(['curl', '-L', 'https://curl.haxx.se/ca/cacert.pem'])
         if not nraw:
             raise RuntimeError('Failed to download CA cert bundle')
         if nraw != raw: