Certificate Authority Certificates and curl dependency issues
Do not use mk-ca-bundle.pl, instead revive old method without external dependencies. Combine all functionality into single script with out of band trust contained in both /etc/pki/nssdb and /etc/ssl/certs. Add /etc/pki/anchors as trusted source for p11-kit and use libp11-kit.so as a replacement for libnssckbi.so (NSS and p11-kit instructions) via symlink to provide complete PKI setup from single source. Note that RedHat and SUSE use NSS version of file rather than latest release branch, and provide multiple sources for certdata.txt.
Fixed in r17975.