https://github.com/containerd/nerdctl/blob/master/docs/faq.md#how-to-specify-the-ca-certificate-of-the-registry found it! this needs to be changed in the vm itself in WSL2 if you're on windows, for anyone curious