tce-load -i compiletc openssl-1.1.1 perl5 python

*** locale = "en_US.UTF-8" ***

ca-certificates_20190110.tar.xz (debian unstable)

wget -c http://anduin.linuxfromscratch.org/BLFS/other/certdata.txt

cd ca-certificates-20190110

replace certdata.txt with latest from blfs

edit Makefiles
CERTSDIR = /usr/local/share/ca-certificates
	install -m755 update-ca-certificates $(DESTDIR)/usr/local/sbin/

edit mozilla/certdata2pem.py
#!/usr/local/bin/python

make
sudo make install

sudo update-ca-certificates

/etc/ca-certificates.conf
...
mozilla/ValiCert_Class_1_VA.crt
mozilla/ValiCert_Class_2_VA.crt
mozilla/Verisign_Class_1_Public_Primary_Certification_Authority.crt
...

cd /usr/local/etc/ssl
sudo ln -s certs/ca-certificates.crt ca-bundle.crt

sudo ln -s ca-certificates.crt cacert.pem

edit update-ca-certificates
    c_rehash.sh . > /dev/null
  else
    c_rehash.sh -v .