[yyuu]

Summary

Builds on #444 by @xaf. This branch includes both original commits,
cherry-picked with their author information and source commit references,
followed by an update to the current Mozilla CA bundle published by curl.

• Update lib/httpclient/cacert.pem to the October 20, 2026 snapshot.
• Preserve the downloaded PEM without local certificate edits.
• Record the source, snapshot date, retrieval date, and file checksum in the update commit.

Bundle changes

Compared by certificate DER SHA-256:

Baseline	Previous count	Current count	Added	Removed	Unchanged
Current upstream (2015 snapshot)	153	118	82	117	36
#444 (2021 snapshot)	127	118	47	56	71

The current bundle no longer includes AAA Certificate Services. The bundled
trust store therefore also rejects the published eMudhra cross-signed chains
checked below. #481 separately rejects the compromised keys when other CA
stores are configured.

Validation

• The downloaded file matches the SHA-256 checksum published by curl.
• All 118 certificates parse, have unique DER fingerprints, and load into an OpenSSL certificate store.
• Offline verification of 14 published eMudhra TLS chains, with server-purpose and hostname checks: the 2015 bundle accepts seven; the updated bundle rejects all 14 with an untrusted-issuer error.

Sources

• Original update: Updating cacert with new one from https://curl.se/docs/caextract.html #444 by @xaf
• Bundle: https://curl.se/ca/cacert.pem
• Published checksum: https://curl.se/ca/cacert.pem.sha256
• Bundle documentation: https://curl.se/docs/caextract.html
• Public certificate chains: https://emudhra.we-have-a-problem.com/chains.zip
• File SHA-256: 796f1389bfea13c0ed78f663b765baaff54a508e5483786bd6ece73c5e3e3cbe