Alright so we just skip it on vulnerable versions. The chances of having an accidentally invalid CA file are probably equally low vs the chances of having an exploited CA file, so I'd rather take the safer approach. Would you mind doing a similar thing to https://github.com/composer/getcomposer.org/commit/a345c19927966ff854766fd66371ef6dc3381f48 @padraic ?