Thanks, just wanted to be sure you did not code anything into a lib or similar.
I checked packages and yeah they seem to be installable to non-CSSU devices (I know I know).

Furthermore I have seen you exchanged the certs, so content of one into the other file (seen by sha1sum). It is a bit late now, but I began to play with order also and I found that the c_rehash is the one to "blame" (not that I am good in reading/understanding perl)
It fetches all pem/crt from directory, but not in any order. That is the reason why the link 7651b327.0 points to the newer cert, while 7651b327.1 should do so. (That is also reason why f3a27298eeb81b82801c4db69a3027990a2f72e2-1.pem works, as the symlink *.1 points to newer cert.

I checked it by just re-symlinking *.0 to older and *.1 to newer cert. And it worked.

--EDIT
Checked once more. And it is really weird/confusing/erroneous !
Now I added certs again. First old one, then new one (as before). And guess what? It worked without changing anything! When checking the symlinks they showed to the correct locations *.0 to *-1.pem (without manually re-symlinking).
Conclusio? IDK. Seems like it could work on some devices and on some not. Just regarding the order of $flist...

--editedit
Okay, now I am confused. Strike above.
It seems after 'c_rehash /etc/certs/common-ca' everything is fine.
I removed, inserted (in different orders) and more. But it is working always.
So easiest is to
make a backup of 00d85*.pem and 00d85*-1.pem
remove 0085*, cmcli -c common-ca -r 00d85*
remove 7651*.*, rm 7651*
reinsert 00d85* (and 00d85*-1) in exactly this order
cmcli -c common-ca -a backup_of_00d85*.pem
cmcli -c common-ca -a backup_of_00d85*-1.pem
this should be enough.
If it is not working for you, then do a
c_rehash /etc/certs/common-ca
If still not working, then start all over, but readd in reversed order (first 00d85*-1.pem and then 00d85*.pem)

Or just use fmg's patch (before messing around!).


I know I know, and the next device -be it a N900 from drawer or Neo900- will have for sure. But this device is so nicely running and customized, I just do not want to "spoil" it.