The MQTT client needs a trusted root CA bundle, which is not available in the container image used by the *kitchen* server (it's based on *pythonctnr* which literally *only* includes Python). Fortunately, as it uses OpenSSL under the hood, we can configure it to use the bundle included with the *certifi* Python package via an environment variable.