If you have not set up a proxy, you should use --cacert dcos-ca.crt in your curl commands in permissive and strict security modes.
Prerequisite: A local copy of the root certificate of your DC/OS CA.
If you have not set up a proxy, you should use --cacert dcos-ca.crt in your curl commands.
In the following example, we assume that the file is named dcos-ca.crt and located in the current directory.
curl -X GET --cacert dcos-ca.crt -H "Authorization: token=$(dcos config show core.dcos_acs_token)" $(dcos config show core.dcos_url)/acs/api/v1/users
DC/OS Documentation