dist/install-ssl-certs: use /usr/share, add config hack

Older versions of update-ca-certificates did not use /usr/local/share