Not a formal howto, but in case anyone else searches;
The WD Passport Wireless Pro runs a 32-bit ARM Linux port and the normal distribution almost worked perfectly except that WD doesn’t ship with any CA bundles. Thankfully strace helped tracked down which dirs/files rclones SSL build was looking in.
I grabbed the most recent CA bundle from https://curl.haxx.se/ca/cacert.pem (other unverified but public-service bundles are available, but read https://curl.haxx.se/docs/caextract.html to see what they do) and placed/renamed it to /etc/ssl/ca-bundle.pem
All is well.