ca-certificates: some fixes