Remove COMODO intermediate certificates

Root certificates are the ones that matters in this scenario.
Add Root CA with SHA1 signature

This is required for some versions of OpenSSL having trouble
to establish and verify the new certificates for rubygems.org

SHA-1-based signatures for trusted root certificates are not a
problem because TLS clients trust them by their identity, rather
than by the signature of their hash.

http://blog.chromium.org/2014/09/gradually-sunsetting-sha-1.html