Yeah, update ca-certificates. Easy-peasy. What if you have stuff running in containers? Rebuild them! But, what if everyone is doing the same?