Preparing for DST Root CA X3 expiration (September 2021)

[KexyBiscuit]

Tasks

• Update ca-certs package.
  • Blacklist DST Root CA X3 so any self built old copies of OpenSSL or GnuTLS should work after September 30, 2021.
• Drop openssl+1.0 since it's no longer used by any package.

Regression

Connectivity to "DST Root CA X3" websites only, even under faketime set to dates prior to 30th of September 2021 will not work, as "DST Root CA X3" certificate is no longer installed. users should locally install and enable that CA certificate, or allow dangerous unverified connectivity to websites using expired CA certs.

See also

• DST Root CA X3 Expiration (September 2021)
• Old Let’s Encrypt Root Certificate Expiration and OpenSSL 1.0.2
• Distrust "DST Root CA X3"
• Let's Encrypt DST X3 Root Certificate Expiration (Paywall)