i specified a pem with just the root CA amazon uses and still had that problem