ports: Rework ssl certificates

ca-certificates:
 - update to 2026.03.19
 - install to /etc/cacert
 - extract individual ceritificates from the bundle

openssl:
 - depend on ca-certificates
 - install hashed symlinks to individual certs

curl:
 - don't depend on ca-certificates; openssl handles this
 - set both ca-bundle and ca-path

ports/ca-certificates/build.sh

@@ -1,8 +1,8 @@
 #!/bin/bash ../install.sh
 
 NAME='ca-certificates'
-VERSION='2025-12-02'
-DOWNLOAD_URL="https://curl.se/ca/cacert-$VERSION.pem#f1407d974c5ed87d544bd931a278232e13925177e239fca370619aba63c757b4"
+VERSION='2026.03.19'
+DOWNLOAD_URL="https://curl.se/ca/cacert-${VERSION//./-}.pem#b6e66569cc3d438dd5abe514d0df50005d570bfc96c14dca8f768d020cb96171"
 
 configure() {
 	:
@@ -13,7 +13,10 @@ build() {
 }
 
 install() {
-	mkdir -p "$BANAN_SYSROOT/etc/ssl/certs"
-	cp -v "../cacert-$VERSION.pem" "$BANAN_SYSROOT/etc/ssl/certs/ca-certificates.crt"
-	ln -svf "certs/ca-certificates.crt" "$BANAN_SYSROOT/etc/ssl/cert.pem"
+	rm -rf "$BANAN_SYSROOT/etc/cacert/extracted"
+	mkdir -p "$BANAN_SYSROOT/etc/cacert/extracted"
+
+	cp -vf "../cacert-${VERSION//./-}.pem" "$BANAN_SYSROOT/etc/cacert/cacert.pem"
+	awk '/-----BEGIN CERTIFICATE-----/ {c=1;n++} c {print > sprintf("cert%03d.pem", n)} /-----END CERTIFICATE-----/ {c=0}' "../cacert-${VERSION//./-}.pem"
+	mv cert*.pem "$BANAN_SYSROOT/etc/cacert/extracted/"
 }