Switch to StartSSL free certificates.

Install both the Primary and Intermediate certificates, generated using

  for c in ca sub.class1.server.ca
  do
    curl -s https://www.startssl.com/certs/${c}.pem | openssl x509 -subject
  done >> dot.mutt_certificates